Consumer Protection Dispatch
On July 20, 2026, Judge R. Gary Klausner of the U.S. District Court for the Central District of California declared Vivek Shah a vexatious litigant and entered a pre-filing order restricting his ability to bring new digital privacy cases in that district. Vivek Shah v. Crain Communications, Inc., No. 2:26-cv-03070-RGK-CTS (C.D. Cal. July 20, 2026).
The order is a meaningful development for businesses that have received demand letters, draft complaints or arbitration demands from Shah alleging that common website technologies violate the California Invasion of Privacy Act (CIPA). However, its practical effect should not be overstated. The order imposes a procedural screening requirement for Shah in one federal district and does not decide whether the website practices underlying Shah’s claims violate CIPA.
A Pattern of Repetitive Privacy Claims
Enacted in 1967, CIPA originally targeted emerging wiretapping and eavesdropping technologies and historically was litigated primarily in connection with telephone calls and recorded communications. However, in recent years, plaintiffs have increasingly applied the statute to websites, alleging session-replay software, chat tools, pixels and other third-party technologies intercept online communications without prior consent. This wave accelerated following decisions recognizing that Section 631 could apply to internet communications and that consent must precede the alleged interception. Plaintiffs have also advanced newer theories under CIPA’s pen-register provisions based on the collection of IP addresses, URLs and similar data. Although the scope and viability of these theories remain unsettled, CIPA’s private right of action and statutory damages have generated a substantial volume of demand letters and frequently repetitive lawsuits.
Against this backdrop, Shah filed the underlying action against Crain Communications in March 2026, alleging that the company’s website intercepted the contents of his electronic communication in violation of Section 631(a) of CIPA.
In considering Crain’s motion to declare Shah a vexatious litigant, the court reviewed at least 29 proceedings that Shah initiated beginning in 2021. Those matters included CIPA and other digital privacy claims, as well as consumer fraud, intellectual property, discrimination and credit-related claims. The court focused on seven materially similar CIPA complaints that Shah filed against different defendants during the seven months preceding the Crain Communications action.
Applying the Ninth Circuit’s four-part framework for pre-filing orders under De Long v. Hennessey, the court found: (1) Shah had received notice and an opportunity to respond; (2) the record was adequate for review; (3) his litigation conduct supported substantive findings of frivolousness or harassment; and (4) the requested order could be narrowly tailored.
The court emphasized Shah’s repeated use of substantially similar complaints, his practice of voluntarily dismissing matters after defendants moved to dismiss and his failure to pursue a CIPA claim through a decision on the merits. It concluded that the pattern strongly indicated an effort to use litigation to obtain settlements rather than to seek judicial resolution of claimed injuries. The court also found it significant that Shah appeared knowledgeable about website data-collection practices and repeatedly exposed himself to what the court viewed as similar and avoidable alleged injuries.
What the Pre-Filing Order Does
The order requires Shah to obtain the court’s permission before filing any new case in the Central District of California alleging claims under CIPA or “other related digital privacy claims.”
The court declined to require Shah to post security for costs in the pending Crain Communications action. It noted, however, that a judge presiding over a future case subject to the pre-filing order could impose such a requirement.
What the Order Does Not Resolve
The order does not prevent Shah from sending additional demand letters, including demands enclosing sample or draft complaints, or from initiating arbitrations. It also does not prohibit him from filing CIPA claims in California state court or another federal district, restrict non-privacy claims or affect cases that were already pending when the order was entered, including the Crain Communications action itself.
Nor does the order resolve the merits of Shah’s underlying CIPA theories. California courts continue to address whether and under what circumstances website analytics, pixels, session-replay tools, chat technologies and similar services may constitute unlawful interception or pen-register activity under CIPA.
Although the order does not bind other courts, its detailed findings concerning Shah’s filing history and litigation practices may provide persuasive support for defendants seeking comparable procedural relief elsewhere. California’s vexatious-litigant statute also recognizes certain prior state or federal vexatious-litigant determinations, although the availability of relief in a later case will depend on the applicable statutory requirements and the facts of that proceeding.
Practical Considerations
Businesses served with a newly filed complaint by Shah in the Central District of California should determine at the outset whether Shah obtained leave to file the action as required by the court’s pre-filing order. Separately, businesses that receive demand letters enclosing sample or draft complaints should recognize that the order does not prohibit Shah from continuing those demands. The order and the court’s findings may nevertheless be relevant when evaluating the credibility of the threatened litigation and developing an appropriate response strategy.
More broadly, companies responding to CIPA demands should consider:
- Preserving the relevant evidence.Before changing website configurations, document the scripts, pixels, consent settings and data flows in place during the relevant period.
- Investigating the alleged transmission.Determine what information the identified technology received, when it received the information and whether the data was transmitted to another party.
- Reviewing consent implementation.Confirm that consent tools operate as intended, including whether technologies that are supposed to depend on consent remain inactive until the required user choice is made.
- Assessing sensitive website functions.Give particular attention to search fields, chat tools, login pages, checkout flows, job applications and other areas where users may enter information.
- Coordinating the response.Avoid uncoordinated communications or payments before counsel has evaluated the allegations, available defenses and the company’s underlying website practices.
The pre-filing order may reduce the immediate litigation leverage associated with Shah’s demands in the Central District of California, but it does not eliminate broader CIPA exposure. Companies should continue to treat website privacy demands seriously and maintain defensible practices for deploying and governing online tracking technologies.
Pillsbury’s Privacy, Cybersecurity and Data Strategy team assists businesses in evaluating CIPA and other wiretapping, trap and trace, and pen-register demand letters and litigation, conducting website technology assessments and developing practical consent, disclosure and data-governance strategies.