The court observed that this was the latest in a string of materially identical CIPA complaints—seven filed against seven different defendants in the seven months preceding this suit alone. 

On July 20, 2026, Judge R. Gary Klausner of the U.S. District Court for the Central District of California declared Vivek Shah a vexatious litigant and entered a pre-filing order requiring him to obtain leave of court before filing any new case in that district asserting claims under the California Invasion of Privacy Act (CIPA) or related digital privacy statutes. Vivek Shah v. Crain Communications, Inc., No. 2:26-cv-03070-RGK-CTS (C.D. Cal. July 20, 2026). For the companies that have received Shah’s demand letters and complaints over the past two years, this is a significant and welcome development—though it is important to understand precisely what the order does and does not do.

The underlying case follows the familiar pattern. Shah sued Crain Communications in March 2026, alleging that its website intercepted the contents of his electronic communications in violation of Section 631(a) of CIPA. The court observed that this was the latest in a string of materially identical CIPA complaints—seven filed against seven different defendants in the seven months preceding this suit alone. Looking at the broader record, the court cataloged at least 29 proceedings initiated by Shah since 2021, spanning CIPA, consumer fraud, RICO, copyright and trademark, discrimination and consumer credit claims. All but one were filed pro se. Nearly all were resolved at the pleading stage, most often by dismissal or by Shah’s voluntary dismissal after the defendant moved to dismiss. The court noted that several of his complaints were near copies of class action complaints filed by unrelated plaintiffs, that he has never tried a CIPA claim on the merits, and that his only recovery across the entire record was a $3,000 arbitration award against Citibank.

Applying the Ninth Circuit’s four-factor framework from De Long v. Hennessey, the court found that each factor was satisfied: (1) Shah had notice and an opportunity to be heard; (2) the record of his filings was adequate for review; (3) his conduct supported substantive findings of frivolousness and harassment; and (4) the order, as discussed below, was narrowly tailored to the specific conduct at issue. On the central substantive point, the court found that his practice of seeking out CIPA violations, filing template complaints and voluntarily dismissing when challenged “strongly indicates that Plaintiff’s purpose is to harass defendants into coercive settlements – rather than seek redress from the judiciary in good faith.” The court also observed that Shah is well acquainted with industry data-collection practices and has the means to verify whether a website transmits his data before visiting it, making his claimed injuries readily avoidable. Citing California authority, the court emphasized that a party who repeatedly files baseless actions only to dismiss them when challenged is no less vexatious than one who litigates them to an adverse conclusion. His pro se status was acknowledged as a mitigating factor but could not outweigh the record of harassment.

On the tailoring point, the order’s limits are important to understand. The order does not bar Shah from the courthouse. Instead, it requires him to obtain court permission before filing any new CIPA or related digital privacy case in the Central District of California; a complaint filed there without leave is subject to dismissal on that basis alone. The order does not restrict other types of claims, does not apply in other federal districts or in California state court and does not affect his currently pending cases—including the Crain Communications action itself. The court denied Crain’s request for a security-of-costs bond, but expressly noted that judges presiding over any future action falling under the prefiling order retain discretion to impose one.

Even with those limits, we expect the practical effect to be substantial. Within the Central District—where the bulk of Shah’s recent CIPA filings have been concentrated—the leave requirement, coupled with the prospect of a bond, is likely to reduce his new filings dramatically, perhaps to zero. Beyond that district, the order supplies a detailed, docket-by-docket road map that defendants can present as persuasive authority in support of similar motions in other federal and state courts, and we anticipate other courts will be receptive given the record compiled here. The order should carry particular force in California state court: under California Code of Civil Procedure Section 391(b)(4), a litigant who has previously been declared vexatious by any state or federal court in litigation based upon the same or substantially similar facts, transactions or occurrences may be declared a vexatious litigant on that ground alone. Any defendant served with a new complaint by Shah in California state court should therefore give serious consideration to filing a vexatious litigant motion—with a pre-filing order and security requirement—at the outset of the case. The order should also take much of the force out of the mass demand letters enclosing draft complaints that many companies have recently received: the implicit threat of a lawsuit is considerably less credible when filing one requires judicial permission, and the court’s findings can be cited in any response. We do expect Shah to continue to pursue arbitration demands through JAMS and AAA, where the pre-filing order does not directly apply—but the court’s findings regarding his litigation history and motives are available to challenge those claims and to support fee or sanctions requests in any forum.

Companies that receive a new CIPA complaint from Shah in the Central District of California should first verify whether he obtained leave to file; if he did not, dismissal is available on that ground. More broadly, this order is a reminder that the most durable protection against CIPA claims—whether from serial filers or otherwise—remains sound website data-collection and consent practices, including clear privacy disclosures and functioning consent mechanisms for cookies, pixels, chat and session-replay tools.

If you have received a demand letter or complaint from Vivek Shah, or have questions about CIPA compliance, experienced counsel can provide advice and insight on how to proceed.

For More Information  

If you have any questions about this Alert, please contact J. Colin Knisely, Sean Patterson, Michael S. Zullo, any of the attorneys in our Website Accessibility and Privacy Compliance Litigation Group, any of the attorneys in our Technology, Media and Telecom Industry Group or the attorney in the firm with whom you are regularly in contact.

Disclaimer: This Alert has been prepared and published for informational purposes only and is not offered, nor should be construed, as legal advice. For more information, please see the firm's full disclaimer.