Serial CIPA Website-Wiretap Filer Declared a Vexatious Litigant
Serial CIPA Website-Wiretapping Filer Vivek Shah Declared a Vexatious Litigant
A federal judge in California declared prolific plaintiff Vivek Shah a vexatious litigant on July 20, 2026, barring him from filing new California Invasion of Privacy Act website-tracking suits in the Central District of California without permission after finding a pattern of coercive, copy-paste litigation.
Information last verified on July 25, 2026. This is a developing story; we update it as the record changes.
Jurisdiction scope: This article addresses a federal pre-filing order under California law in the U.S. District Court for the Central District of California, and the California Invasion of Privacy Act (CIPA). It does not address other states' wiretap statutes and is not legal advice about any specific demand letter or lawsuit. For the underlying rule, see our guide to California's recording and wiretap laws.
What Happened
On July 20, 2026, Judge R. Gary Klausner of the U.S. District Court for the Central District of California entered a pre-filing order declaring plaintiff Vivek Shah a vexatious litigant in Shah v. Crain Communications, Inc., No. 2:26-cv-03070-RGK-CTS. The order requires Shah to obtain leave of court before filing any new lawsuit in that district asserting CIPA or related digital-privacy claims. It does not dismiss his pending case against Crain Communications; the restriction is prospective.
The court described a litigation record of at least 29 proceedings since 2021, including seven nearly identical complaints under California Penal Code Section 631(a) filed against seven different defendants in the seven months before the order. According to the court, Shah repeatedly filed suits, established jurisdiction, and then voluntarily dismissed them when defendants pushed back, without litigating a claim to the merits. Judge Klausner found that this pattern showed Shah's purpose was to "harass defendants into coercive settlements" "rather than seek redress from the judiciary in good faith."
The ruling was reported the following week across client alerts from Duane Morris, Glaser Weil, Shumaker, and Baker Donelson, and in trade coverage from the National Law Review's CIPAWorld.
What the Law Actually Says
The California Invasion of Privacy Act is California's anti-wiretapping statute. Section 631(a) targets the unauthorized interception of communications in transit, while Section 632 addresses eavesdropping on or recording confidential communications with a device. Section 632 is the two-party-consent provision behind California's rule that you generally need everyone's consent to record a confidential conversation, which we cover in our guides to recording phone calls in California and California's broader consent rules.
The wave of website-wiretapping suits, including Shah's, rests on Section 631(a). Plaintiffs argue that when a website loads a third-party tracker, an analytics pixel, session-replay software, a chat widget, or even a search bar, and that tool transmits a visitor's input to a third party without prior consent, it is an unlawful interception under a statute written for telephone wiretapping in 1967. Those theories overlap with California's data privacy regime, including consent and opt-out rules explained in our overview of what the CCPA covers.
A vexatious-litigant pre-filing order does not resolve those theories. Under the Ninth Circuit's standard in De Long v. Hennessey, 912 F.2d 1144 (9th Cir. 1990), a court may require a specific person to seek advance approval before filing new suits of a defined type, but only after notice and a hearing, an adequate record, substantive findings of frivolousness or harassment, and an order narrowly tailored to the conduct. The court found each factor met as to Shah's filing pattern, not as to the validity of CIPA claims in general.
Analysis: Why This Matters
The following is analysis from the Recording Law Editorial Team.
The most important thing about this order is what it does not say. It does not hold that pixel tracking, session replay, or analytics are lawful, and it does not bind any other plaintiff or law firm. It is a ruling about one litigant's conduct, grounded in the Ninth Circuit's pre-filing-order doctrine, not a merits ruling on Section 631(a). Reading it as the end of CIPA website-tracking exposure would be a mistake.
At the same time, the order is a signal that courts can and will use existing tools against high-volume, copy-paste filing campaigns when the record shows a pattern of dismissing rather than litigating. The underlying legal question, whether a two-party-consent wiretap statute reaches ordinary web analytics, remains active and contested in other cases and other courts. The practical distinction for readers is between a serial filer being sanctioned for abusive conduct and a court blessing the technology at issue. Those are not the same thing, and this order is only the first.
How This Affects You
Businesses that operate websites have received large volumes of CIPA demand letters over the past year. In general terms, companies facing them commonly review which third-party tools their sites load, how consent is obtained before those tools run, and their options for responding. Whether any specific tracker or consent setup creates exposure depends on the facts and is a question for qualified counsel, so this general reporting is not advice about your situation.
This is general legal information, not legal advice. It covers a federal pre-filing order and the California Invasion of Privacy Act, and reflects sources verified on July 25, 2026. Laws vary and this story is developing; consult a lawyer licensed in your jurisdiction about your specific situation.
Related articles
- California recording and wiretap laws
- Recording phone calls in California
- California data privacy law
- What the CCPA covers
Last updated: 2026-07-25. This is a developing story; details verified as of 2026-07-25.
Frequently Asked Questions
What is a CIPA website-wiretapping lawsuit?
These suits allege that a website's third-party tools, such as analytics pixels, session-replay software, chat widgets, or search bars, transmit a visitor's activity or typed input to a third party without prior consent, which plaintiffs argue is an unlawful interception under California Penal Code Section 631(a), part of the California Invasion of Privacy Act first enacted in 1967.
What did the court actually decide in the Vivek Shah case?
On July 20, 2026, Judge R. Gary Klausner of the Central District of California declared Vivek Shah a vexatious litigant and ordered that he must get court permission before filing new CIPA or related digital-privacy suits in that district, citing about 29 proceedings since 2021 and seven near-identical Section 631(a) complaints in the prior seven months.
What is a vexatious-litigant pre-filing order?
It is a court-imposed restriction, allowed under the Ninth Circuit's De Long v. Hennessey (1990) standard, that requires a specific person to obtain a judge's advance approval before filing new lawsuits of a defined type. It is reserved for litigants whose filing pattern shows frivolousness or an intent to harass rather than a good-faith effort to litigate.
Does this ruling stop CIPA website-tracking lawsuits?
No. The order applies to one plaintiff, in one federal district, for one category of claims. It does not bind other plaintiffs or firms, does not reach California state court or other federal districts, and does not decide whether tracking tools violate CIPA. Similar suits and demand letters from other plaintiffs continue.
What is the difference between CIPA Section 631 and Section 632?
Section 631(a) addresses unauthorized interception of communications in transit, the theory used against website trackers. Section 632 addresses eavesdropping on or recording confidential communications with a device, and is the provision behind California's two-party-consent rule for recording phone and in-person conversations.
Was Shah's underlying case against Crain Communications dismissed by this order?
No. Coverage describes the order as prospective, restricting Shah's future filings. It did not dismiss the pending Crain Communications case.
I received a CIPA demand letter about my website. What are my general options?
This is general background, not advice for your situation. Businesses receiving CIPA demand letters commonly consult privacy or data-defense counsel to review the specific tools at issue, evaluate consent mechanisms such as banners and script gating, and weigh response options. Consult a licensed attorney about any specific letter.
Sources and References
- Shah v. Crain Communications, Inc., No. 2:26-cv-03070-RGK-CTS (C.D. Cal.), docket(courtlistener.com)
- California Penal Code Section 631 (California Invasion of Privacy Act)(leginfo.legislature.ca.gov).gov
- California Penal Code Section 632 (recording of confidential communications)(leginfo.legislature.ca.gov).gov
- Central District of California Declares Serial CIPA Plaintiff a Vexatious Litigant, Duane Morris LLP (July 2026)(duanemorris.com)