California Governor Gavin Newsom has signed SB 690 into law, a legislative move that directly targets the wave of litigation brought under the California Invasion of Privacy Act (CIPA) against websites using tracking technologies. The law firm Baker Donelson flagged the development as significant for any business operating a website with analytics, chat, or advertising pixels — which, in practice, means nearly every commercial photographer and studio with an online storefront or portfolio.

The signing matters commercially because CIPA has become one of the most active bases for privacy lawsuits in California over the past several years. Plaintiffs' firms have filed thousands of claims arguing that common web tools — session replay software, chat widgets, Meta Pixels, and third-party analytics — function as unlawful wiretapping or interception under the statute, which dates to 1967. Settlements in these cases have ranged widely, but even small businesses have faced demands in the tens of thousands of dollars, plus defense costs.

For photo businesses, the exposure is concrete. A typical photographer's site uses Google Analytics, a booking widget, an Instagram embed, and possibly a live-chat or contact-form tracker. Each of those tools can transmit user data to third parties while a visitor browses. Under the pre-SB 690 litigation environment, that ordinary stack was enough to draw a demand letter in some cases, regardless of whether the site actually captured anything sensitive.

Baker Donelson's analysis centers on what the new law changes for that litigation pipeline. The firm's alert frames SB 690 as the legislature's response to courts and plaintiffs stretching a half-century-old wiretapping statute to cover routine web browsing behavior — a stretch that manufacturers, retailers, and service businesses, including studios and agencies, have paid to settle.

Photography businesses should treat this as a compliance and risk-pricing issue, not an abstract legal debate. Until the practical effects of SB 690 play out in court, three workflow questions remain worth auditing: which third-party scripts load on your portfolio or client-gallery pages; what those scripts transmit and to whom; and whether your consent banner actually gates them before a visitor's first click. Client-gallery platforms in particular handle names, emails, and sometimes proofing data, so the tracking question sits closer to client-confidentiality obligations than a plain marketing site does.

The law's arrival does not erase existing claims or pending settlements automatically; how it applies to filed cases and whether plaintiffs pivot to other theories — the California Consumer Privacy Act, unfair competition statutes, or federal wiretap claims — will shape exposure through the rest of 2025 and beyond. Businesses that already settled CIPA web-tracking claims will also be watching whether the new law creates any path to revisit those payments.

Baker Donelson indicates its full alert details the statutory text and its implications for pending and future CIPA litigation, and legal counsel reviewing a studio's site stack should read the specifics before assuming blanket immunity.

The next signal to watch: the first rulings interpreting SB 690's reach, which will determine whether the flood of CIPA web-tracking suits recedes or simply migrates to new legal ground.