The CIPA demand-letter wave: serial filers, and how website tracking became a lawsuit factory (2026)
At a glance
- Brought by
- Private litigation (CIPA)
- Defendants
- Various defendants (pattern case)
- Sector
- Cross-sector consumer sites
- Law
- CIPA (California wiretap law)
- Amount
- No amount (prefiling order)
- Date
- Order Jul 20, 2026
- Status
- Repeat filer declared vexatious litigant
Summary
Repeat plaintiffs file CIPA website-tracking claims and demand letters at volume. In July 2026, a federal judge in Los Angeles declared one serial CIPA filer, Vivek Shah, a vexatious litigant and required court permission before he files new CIPA or related privacy suits in that district. Most targets are ordinary consumer sites running standard trackers.
What happened
Shah’s suits included one against Crain Communications, in which he said he could verify whether a website was sending his search queries to a third party. Judge R. Gary Klausner noted that Shah had started at least 29 proceedings from 2021 to 2026. The prefiling order covers any new CIPA or related digital privacy case he files in the Central District of California.
The mechanism
The theory is CIPA Section 631: that a site’s trackers intercept what a visitor types, such as a search term, in transit.
Why this matters for your site
One court has now called a serial filer’s pattern harassment. That doesn’t make the claims go away for everyone else. You do not need to have done anything unusual to receive a demand letter. You need to know what your site is actually sending.
In the court’s words
The court found that the serial filer’s pattern “strongly indicates that Plaintiff’s purpose is to harass defendants into coercive settlements.”
Timeline
- 2021 to 2026at least 29 proceedings initiated by Shah, per the order.
- Jul 20, 2026vexatious-litigant order filed.
Source
The order (C.D. Cal. 2:26-cv-03070, Document 34); Duane Morris alert.
dwt.com · duanemorris.comQuestions
Who is bringing these CIPA cases?
Private repeat plaintiffs filing large numbers of near-identical lawsuits and demand letters. These are private claims brought by plaintiffs, with no government enforcer involved. In July 2026, a federal judge declared one repeat filer, Vivek Shah, a vexatious litigant and required court permission before he files new CIPA or related privacy suits in the Central District of California.
Do you have to do something unusual to get a demand letter?
No. What helps is knowing exactly what your site is sending to third parties, and when.
Related cases
The LA Times CIPA settlement
Three ad trackers, pen-register theory
See what your tags send before it becomes a case
DataTrue runs real journeys on your site in each consent state and reads what each tag sends, field by field. A tag sending what it should not shows up in a test.
- Every page, with coverage scans
- Scheduled runs, with alerts when a result changes
- Full journeys, like checkout and signup, in each consent state
- What each tag sent, field by field
- PII detection with test personas
- iOS and Android app testing
- Pre-publish testing for GTM and Adobe Tags
- REST API, plus Slack and Jira alerts
The full platform, every feature, free for 30 days.
