Privacy LitigationDemand Letters
Vivek Shah Is a Vexatious Litigant. Will His CIPA Demand Letters Continue?
On July 20, 2026, a federal judge in Los Angeles declared Vivek Shah, the most prolific individual filer in the CIPA litigation wave, a vexatious litigant. The order is a win for the businesses he targets. It is also narrower than the headlines suggest.
By Alex ProctorSummary
A federal court found that Vivek Shah's CIPA campaign exists to "harass defendants into coercive settlements," and barred him from filing new privacy suits in the Central District of California without a judge's approval. That gives every business he targets leverage it did not have before. The ruling will not impact the demand letter economy, though. The letters can continue, and the main legal theory behind them remains available.
Who Is Vivek Shah?
Shah is a pro se plaintiff who has spent roughly two years sending California Invasion of Privacy Act (CIPA) demand letters at an unprecedented scale. He began filing boilerplate CIPA complaints in Los Angeles Superior Court around September 2024, and the letters accelerated through 2025 and into 2026. The model runs on confidential settlements and, increasingly, on arbitration. Lawsuits, when occasionally filed, tend to be recycled and frequently dropped.
The Ruling: Shah v. Crain Communications
The vexatious litigant order came from Judge R. Gary Klausner of the Central District of California on a motion by Crain Communications, a business media company Shah had sued, which chose to fight rather than settle.
The court found that Shah's purpose was to "harass defendants into coercive settlements" rather than seek redress from the judiciary in good faith, pointing to complaints that were "near copies of class action complaints filed by unrelated plaintiffs" and to his pattern of voluntary dismissals. The designation carries a prefiling order, so a judge must sign off before Shah can open a new case in the Central District alleging CIPA or related digital privacy claims.
What Changed, and What Did Not
| What Changed | What Did Not Change |
|---|---|
|
|
What Has Changed Since the Ruling?
California has since narrowed one of the two theories behind these letters. Governor Newsom signed SB 690 on September 30, 2026. Starting January 1, 2027, only the Attorney General can bring Section 638.51 pen register claims over website tracking, and private claims filed since 2025 end if they are still pending. Section 631(a) wiretapping claims are not affected, and many demand letters rely on them.
What Does It Mean for Your Website?
If a Shah letter arrives now, you and your counsel can cite the federal court's assessment of his motives in your response. That is an advantage, but not necessarily a defense. The order leaves the theories behind the letter in place, and the facts about your own site still decide the claim.
Imitators will read the Crain decision as carefully as anyone and adjust their venues and tactics. Newer demand letters already lean on arbitration, which the order does not reach. The practical questions are the same as they were before. What does your site do before and after a visitor makes a choice, and does your privacy notice describe it accurately?
Questions
What is a vexatious litigant order?+
A court finding that a person has abused the litigation process, paired with restrictions on what they can file next. In federal court it usually takes the form of a prefiling order, which is what Shah received. He can still sue in the Central District of California, but a judge has to review and approve the complaint first.
Does the order stop Vivek Shah's demand letters?+
It does not. The vexatious litigant order governs new lawsuits in one federal district, not correspondence, so the letters can continue at the same volume. Each one still has to be evaluated on its own facts.
What changed is that a recipient now has the federal court's findings about Shah's purpose to consider in the response. Expect Shah to shift his model further toward arbitration and away from the courts as a result.
Should a Vivek Shah letter still be taken seriously?+
Yes. The finding is about his conduct, not the statute. A separate California law, SB 690, ends private pen register claims over website tracking on January 1, 2027, but Section 631(a) wiretapping claims remain available. Whether a claim has merit depends on what your site did, not on who sent the letter, so treat it as you would any CIPA demand and involve counsel.
Briefings are informational and do not constitute legal advice.
Received a letter?
I'll test the claims against your live site.
Website Privacy Audits include a detailed video review of your live site, a written report for your team or counsel, and a remediation review call. Priority audits add 72-hour delivery and testing of demand letter claims.
Standard $449. Priority $649.
My audits are most useful when you have a consent management setup to validate, a demand letter with specific claims to assess, or a team or client that needs an external web privacy expert. If you already know you have major gaps, your budget may be better spent addressing them directly. I recommend Captain Compliance, the platform I help build, for privacy technology needs.