--><br>Received a Vivek Shah CIPA Demand Letter? Don't Pay Yet — Here's How to Beat It: Website Tracking Claims, Case Law, and Your Response Plan | Captain Compliance - JDSupra
July 20, 2026
Received a Vivek Shah CIPA Demand Letter? Don't Pay Yet — Here's How to Beat It: Website Tracking Claims, Case Law, and Your Response Plan
Richart Ruddie
Captain Compliance
+ Follow<br>x Following<br>x Following<br>- Unfollow<br>Contact
Send
Embed
To embed, copy and paste the code into your website or blog:
Somewhere in your organization a general inbox, a registered agent, a front-desk mail pile there may already be an envelope from Vivek Shah. Thousands of businesses and nonprofits across the country have received one since Fall 2025: a demand letter alleging privacy violations and an ask for compensation because you have a faulty cookie banner or a search bar without proper disclosures set up on your website.
Vivek is sending out demand letters claiming that the ordinary tracking technology on the website in question violates the California Invasion of Privacy Act (CIPA), a 1967 telephone wiretapping statute, and offering to make the claim go away for a payment. One national defense firm reports handling more than 100 active matters against Shah alone, with the number climbing daily and another firm that specializes in VC start ups has a whole task force setup to help deal with the Vivek Shah and wiretapping lawsuit claims for websites.
Shah is the most visible face of a much larger wave. By legislative estimates, CIPA pen register and trap-and-trace claims now account for roughly two-thirds of all active California privacy litigation, with filings under Section 638.51 exploding from approximately 600 to more than 4,000 in a short window. Class action firms are extracting seven-figure settlements on the same theories Shah asserts for four and five figures at a time and the numbers only go up unfortunately.
Captain Compliance maintains a continuously updated resource on the Vivek Shah campaign — his tactics, litigation history, and a full response framework that’s free to help anybody dealing with his serial litigation that you can find here: Vivek Shah CIPA Demand Letters: What They Are and How to Respond. This article covers who Shah is, how his campaign works, what the broader CIPA claims allege, where the courts and the California Legislature are heading, and the exact steps to take whether or not a letter has arrived. To date Captain Compliance clients have never had to pay out to Vivek Shah because they are able to provide detailed audits that rebuke the claims he makes as you will read about below.
So, Who Is Vivek Shah of Los Angeles?
Vivek Shah is a California-based serial pro se litigant he represents himself, without a law firm who has been asserting CIPA claims against business websites for the last couple of years and began sending demand letters at mass scale in Fall 2025 and we’ve seen a huge increase in June and July of 2026 as legislation is pending to stop his shenanigans. Law firm alerts covering the campaign describe him as a former actor with a prior federal felony conviction, and note that many of his targets are left wondering why he would have any legitimate reason to visit their websites at all. Many targets are not consumer-facing; some have no discernible connection to California outside of accepting web traffic from there but have a local services component that does not touch the Golden State.
(Read The Captain Compliance Breakdown of these CIPA Lawsuits here )
The targeting is genuinely indiscriminate. Recipients of Vivek Shah CIPA demand letters have included:
Manufacturers and mining companies;
Schools and nonprofits;
Auto dealerships and retailers;
Law firms
Staffing and professional services firms; and
B2B companies with no consumer audience whatsoever.
The unifying trait is not industry, size, or geography. It is a publicly accessible website running third-party ad targeting cookies and session replay technology. The most common being Facebooks Meta-Pixel and TikTok’s pixel. With millions of websites retargeting their visitors with these tools there’s millions of businesses out there at risk of being sued over privacy violations.
How the Vivek Shah Demand Letter Campaign Works
The campaign has evolved in identifiable phases, and knowing which phase produced your letter tells you a great deal about the claim's strength:
Fall 2024 — the wiretap phase. Shah's original claims were built on CIPA Section 631(a). He would visit a website with his browser's developer tools recording network traffic, type an innocuous term into the site's search bar or a form famously, his own first name in all caps and capture screenshots showing that input transmitting in real time to third parties like Google Analytics, Meta, and HubSpot. The theory: the vendors "intercepted" a communication in transit, and the website owner aided and abetted by...