Serial CIPA Website-Wiretap Filer Declared a Vexatious Litigant
Independently fact-checked against primary sources (last audited July 25, 2026). · 2 primary sources cited on this page. How we verify our legal content
Serial CIPA Website-Wiretapping Filer Vivek Shah Declared a Vexatious Litigant
A federal judge in California declared prolific plaintiff Vivek Shah a vexatious litigant on July 20, 2026, barring him from filing new California Invasion of Privacy Act website-tracking suits in the Central District of California without permission after finding a pattern of coercive, copy-paste litigation.
Information last verified on July 25, 2026. This is a developing story; we update it as the record changes.
Jurisdiction scope: This article addresses a federal pre-filing order under California law in the U.S. District Court for the Central District of California, and the California Invasion of Privacy Act (CIPA). It does not address other states' wiretap statutes and is not legal advice about any specific demand letter or lawsuit. For the underlying rule, see our guide to California's recording and wiretap laws.
What Happened
On July 20, 2026, Judge R. Gary Klausner of the U.S. District Court for the Central District of California entered a pre-filing order declaring plaintiff Vivek Shah a vexatious litigant in Shah v. Crain Communications, Inc., No. 2:26-cv-03070-RGK-CTS. The order requires Shah to obtain leave of court before filing any new lawsuit in that district asserting CIPA or related digital-privacy claims. It does not dismiss his pending case against Crain Communications; the restriction is prospective.
The court described a litigation record of at least 29 proceedings since 2021, including seven nearly identical complaints under California Penal Code Section 631(a) filed against seven different defendants in the seven months before the order. According to the court, Shah repeatedly filed suits, established jurisdiction, and then voluntarily dismissed them when defendants pushed back, without litigating a claim to the merits. Judge Klausner found that this pattern showed Shah's purpose was to "harass defendants into coercive settlements" "rather than seek redress from the judiciary in good faith."
The ruling was reported the following week across client alerts from Duane Morris, Glaser Weil, Shumaker, and Baker Donelson, and in trade coverage from the National Law Review's CIPAWorld.
What the Law Actually Says
The California Invasion of Privacy Act is California's anti-wiretapping statute. Section 631(a) targets the unauthorized interception of communications in transit, while Section 632 addresses eavesdropping on or recording confidential communications with a device. Section 632 is the two-party-consent provision behind California's rule that you generally need everyone's consent to record a confidential conversation, which we cover in our guides to recording phone calls in California and California's broader consent rules.
The wave of website-wiretapping suits, including Shah's, rests on Section 631(a). Plaintiffs argue that when a website loads a third-party tracker, an analytics pixel, session-replay software, a chat widget, or even a search bar, and that tool transmits a visitor's input to a third party without prior consent, it is an unlawful interception under a statute written for telephone wiretapping in 1967. Those theories overlap with California's data privacy regime, including consent and opt-out rules explained in our overview of what the CCPA covers.
A vexatious-litigant pre-filing order does not resolve those theories. Under the Ninth Circuit's standard in De Long v. Hennessey, 912 F.2d 1144 (9th Cir. 1990), a court may require a specific person to seek advance approval before filing new suits of a defined type, but only after notice and a hearing, an adequate record, substantive findings of frivolousness or harassment, and an order narrowly tailored to the conduct. The court found each factor met as to Shah's filing pattern, not as to the validity of CIPA claims in general.
Analysis: Why This Matters
The following is analysis from the Recording Law Editorial Team.
The most important thing about this order is what it does not say. It does not hold that pixel tracking, session replay, or analytics are lawful, and it does not bind any other plaintiff or law firm. It is a ruling about one litigant's conduct, grounded in the Ninth Circuit's pre-filing-order doctrine, not a merits ruling on Section 631(a). Reading it as the end of CIPA website-tracking exposure would be a mistake.
At the same time, the order is a signal that courts can and will use existing tools against high-volume, copy-paste filing campaigns when the record shows a pattern of dismissing rather than litigating. The underlying legal question, whether a two-party-consent wiretap statute reaches ordinary web analytics, remains active and contested in other cases and other courts. The practical distinction for readers is between a serial filer being sanctioned for abusive conduct and a court blessing the technology at issue. Those are not the same thing, and this order is only the first.
How This Affects You
Businesses that operate websites have received large volumes of CIPA demand letters over the past year. In general terms, companies facing them commonly review which third-party tools their sites load, how consent is obtained before those tools run, and their options for responding. Whether any specific tracker or consent setup creates exposure depends on the facts and is a question for qualified counsel, so this general reporting is not advice about your situation.
This is general legal information, not legal advice. It covers a federal pre-filing order and the California Invasion of Privacy Act, and reflects sources verified on July 25, 2026. Laws vary and this story is developing; consult a lawyer licensed in your jurisdiction about your specific situation.
Related articles
- California recording and wiretap laws
- Recording phone calls in California
- California data privacy law
- What the CCPA covers
Last updated: 2026-07-25. This is a developing story; details verified as of 2026-07-25.
Frequently Asked Questions
What is a CIPA website-wiretapping lawsuit?
These suits allege that a website's third-party tools, such as analytics pixels, session-replay software, chat widgets, or search bars, transmit a visitor's activity or typed input to a third party without prior consent, which plaintiffs argue is an unlawful interception under California Penal Code Section 631(a), part of the California Invasion of Privacy Act first enacted in 1967.
What did the court actually decide in the Vivek Shah case?
On July 20, 2026, Judge R. Gary Klausner of the Central District of California declared Vivek Shah a vexatious litigant and ordered that he must get court permission before filing new CIPA or related digital-privacy suits in that district, citing about 29 proceedings since 2021 and seven near-identical Section 631(a) complaints in the prior seven months.
What is a vexatious-litigant pre-filing order?
It is a court-imposed restriction, allowed under the Ninth Circuit's De Long v. Hennessey (1990) standard, that requires a specific person to obtain a judge's advance approval before filing new lawsuits of a defined type. It is reserved for litigants whose filing pattern shows frivolousness or an intent to harass rather than a good-faith effort to litigate.
Does this ruling stop CIPA website-tracking lawsuits?
No. The order applies to one plaintiff, in one federal district, for one category of claims. It does not bind other plaintiffs or firms, does not reach California state court or other federal districts, and does not decide whether tracking tools violate CIPA. Similar suits and demand letters from other plaintiffs continue.
What is the difference between CIPA Section 631 and Section 632?
Section 631(a) addresses unauthorized interception of communications in transit, the theory used against website trackers. Section 632 addresses eavesdropping on or recording confidential communications with a device, and is the provision behind California's two-party-consent rule for recording phone and in-person conversations.
Was Shah's underlying case against Crain Communications dismissed by this order?
No. Coverage describes the order as prospective, restricting Shah's future filings. It did not dismiss the pending Crain Communications case.
I received a CIPA demand letter about my website. What are my general options?
This is general background, not advice for your situation. Businesses receiving CIPA demand letters commonly consult privacy or data-defense counsel to review the specific tools at issue, evaluate consent mechanisms such as banners and script gating, and weigh response options. Consult a licensed attorney about any specific letter.
Updates
Independently fact-checked against the cited primary sources
The Law Behind This Article
This article rests on the statutory provisions below, held in our own legal record and retrieved from the official source. Tap a section to read the operative text.
California Penal Code
§ 631In forcecited in 13 of our articles
(a) Any person who, by means of any machine, instrument, or contrivance, or in any other manner, intentionally taps, or makes any unauthorized connection, whether physically, electrically, acoustically, inductively, or otherwise, with any telegraph or telephone wire, line, cable, or instrument, including the wire, line, cable, or instrument of any internal telephonic communication system, or who willfully and without the consent of all parties to the communication, or in any unauthorized manner, reads, or attempts to read, or to learn the contents or meaning of any message, report, or communication while the same is in transit or passing over any wire, line, or cable, or is being sent from, or received at any place within this state; or who uses, or attempts to use, in any manner, or for any purpose, or to communicate in any way, any information so obtained, or who aids, agrees with, employs, or conspires with any person or persons to unlawfully do, or permit, or cause to be done any of the acts or things mentioned above in this section, is punishable by a fine not exceeding two thousand five hundred dollars ($2,500), or by imprisonment in the county jail not exceeding one year,…
Official text (excerpt) · last checked 2026-09-16 · Read the full text in our law library · Verify at leginfo.legislature.ca.gov
Cited in 202 court opinions in our collectionLatest citing opinion in our collection: 2026
Opinions citing this section in our collection:
- Ribas v. Clark (California Supreme Court 1985, 38 Cal. 3d 355)“…iminal statutes prohibiting various forms of eavesdropping (Pen. Code, §§ 631, subd. (a), and 637), as well as for in…”
- Warden v. Kahn (California Court of Appeal 1979, 99 Cal. App. 3d 805)“…not to be found elsewhere among the states of the nation. Penal Code section 631 provides: "Any person who, by means of…”
- Rogers v. Ulrich (California Court of Appeal 1975, 52 Cal. App. 3d 894)“…nowledge the incident amounted to wiretapping as defined by Penal Code section 631; a statutory penalty in the amount of $…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: California Court Splits on Hospital Tracking Pixel Class Ruling, California Pixel-Wiretap Rulings Split the Same Week: Blue Shield Claim Dismissed, BlueChew Claims Advance, Five California Privacy Bills: Four Signed Into Law, One Vetoed
§ 632In forcecited in 55 of our articles
(a) A person who, intentionally and without the consent of all parties to a confidential communication, uses an electronic amplifying or recording device to eavesdrop upon or record the confidential communication, whether the communication is carried on among the parties in the presence of one another or by means of a telegraph, telephone, or other device, except a radio, shall be punished by a fine not exceeding two thousand five hundred dollars ($2,500) per violation, or imprisonment in a county jail not exceeding one year, or in the state prison, or by both that fine and imprisonment. If the person has previously been convicted of a violation of this section or Section 631, 632.5, 632.6, 632.7, or 636, the person shall be punished by a fine not exceeding ten thousand dollars ($10,000) per violation, by imprisonment in a county jail not exceeding one year, or in the state prison, or by both that fine and imprisonment.
Official text (excerpt) · last checked 2026-09-23 · Read the full text in our law library · Verify at leginfo.legislature.ca.gov
Cited in 267 court opinions in our collectionLatest citing opinion in our collection: 2026
In the courts (editorial summary, independently checked):Kimmel v. Goland (1990) held the section 47(2) litigation privilege does not bar a damages claim under Section 632 for recording confidential conversations without consent. Lieberman v. KCOP Television, Inc. (2003) held a Section 632 violation is complete the moment the recording is made, whether or not it is disclosed.
Opinions citing this section in our collection:
- Rubin v. Green (California Supreme Court 1993, 4 Cal. 4th 1187)“…f telephone conversations with defendants, an offense under Penal Code section 632. We noted that defendants alleged that…”
- Kimmel v. Goland (California Supreme Court 1990, 51 Cal. 3d 202)✓Mobilehome owners secretly taped phone calls with park management in anticipation of suing; the court held the section 47(2) litigation privilege did not bar the cross-complaint for damages under Penal Code section 632, since the injury came from recording, not publication.
- Shulman v. Group W Productions, Inc. (California Supreme Court 1998, 74 Cal. Rptr. 2d 843)✓A TV producer put a wireless microphone on the flight nurse treating a crash victim. No section 632 claim was before the court, but it called section 632 and the intrusion tort laws of general applicability and said the press may not eavesdrop in violation of section 632.
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: Can an Employer Record Conversations Without Consent? (2026), Can I Sue Someone for Recording Me on Private or Public Property?, Can You Record ICE Agents? Know Your Rights by State (2026)
Sources and References
- Shah v. Crain Communications, Inc., No. 2:26-cv-03070-RGK-CTS (C.D. Cal.), docket(courtlistener.com)
- California Penal Code Section 631 (California Invasion of Privacy Act)(leginfo.legislature.ca.gov).gov
- California Penal Code Section 632 (recording of confidential communications)(leginfo.legislature.ca.gov).gov
- Central District of California Declares Serial CIPA Plaintiff a Vexatious Litigant, Duane Morris LLP (July 2026)(duanemorris.com)