Businesses Fight Back Against Vivek Shah’s Privacy Demand Letter Spree: 4 Recent Developments to Know

Businesses Fight Back Against Vivek Shah’s Privacy Demand Letter Spree: 4 Recent Developments to Know

Vivek Shah has sent thousands of website privacy demand letters to businesses nationwide over the past year and a half, alleging that ordinary website tracking tools violate California’s decades-old wiretapping law. But Shah’s prolific campaign – which might soon hit your business, regardless of your location – has hit turbulence on four separate fronts: a federal dismissal, an arbitration loss he’s now trying to undo, and two businesses that have gone on the offense and sued him directly. Here’s what happened and what it means for your business – and what to do you if you get a demand letter from Vivek Shah.

Quick Primer on Vivek Shah

Vivek Shah is a self-represented plaintiff who is asserting CIPA (California Invasion of Privacy Act) claims against businesses from coast to coast. Shah has asserted these claims in demand letters and lawsuits in court and arbitrations since at least Fall 2024.

Until his latest demand letter campaign spanning the last few months, Shah’s claims were primarily under Section 631, CIPA’s wiretapping provision. His theory? By sharing search terms he typed into a search bar (like his first name “VIVEK”) with third parties such as Google Analytics, the business websites committed “wiretapping.”

His most recent spree of demand letters asserts a different claim under Section 638.51, CIPA’s pen register (or trap & trace) provision.

Fisher Phillips alone has over 100 clients who received letters, arbitration claims, or lawsuits from this single plaintiff. In our experience, Shah demands a payment, and if the business does not pay his demand, he may file suit or commence an arbitration claim.

4 Recent Developments Provide Playbook for Businesses

If you are on the receiving end of a demand letter from Shah, or are otherwise litigating a digital wiretapping claim, you’ll want to track four recent developments to help you formulate a defense plan – or a plan of attack.

1. A Federal Court Dismissed Shah’s Claim Without Leave to Amend

On May 28, Judge Anne Hwang of the Central District of California dismissed Shah’s CIPA lawsuit against TalentBridge, Inc. on two independent grounds. Most significantly, the court held Shah lacked Article III standing. Shah’s claim centered on alleged privacy violations that occurred when he searched generic terms like “jobs no background check” on TalentBridge’s website.

The court ruled that generic search terms like these don’t create a protectable privacy interest because they aren’t tied to a searcher’s specific identity. As the court put it, a schoolteacher, a researcher, or an employer might type the exact same terms into a job search bar. Because amendment would be futile, the court denied Shah leave to amend and closed the case. Shah has appealed to the 9th Circuit Court of Appeals.

2. Shah Lost an Arbitration, Too, and is Now Trying to Undo It

In Vivek Shah v. Pashion Footwear Inc., an arbitrator dismissed both of Shah’s claims, a CIPA claim and a parallel federal Electronic Communications Privacy Act claim, in a May 4 award. The arbitrator denied Shah leave to amend and closed the case entirely.

On May 7, he filed a petition in the Central District of California asking the court to vacate that award. How the court resolves the petition is worth watching, since it will speak directly to whether Shah can keep using the same theories that have already failed him in federal court.

3. A Real Estate Tech Platform Sued Shah First

Instead of waiting to be sued, Lofty Inc., a real estate technology company, went on offense. After Shah sent Lofty a demand letter on June 13 alleging that its website violated CIPA’s pen register provision (Penal Code Section 638.51), Lofty filed suit in the Central District of California seeking a declaratory judgment that its analytics tools don’t violate CIPA and that Shah lacks standing to claim otherwise.

Lofty’s complaint relies on a growing body of court decisions rejecting the theory that routine website analytics tools qualify as illegal pen registers, a term originally written for telephone surveillance. Lofty also argues Shah lacks standing because he visited its platform not as a genuine customer, but as what the complaint calls a “litigation investigator” seeking to manufacture a claim.

4. An Out-of-State Law Firm Sued Shah, Too

Shah’s demand letters aren’t limited to California businesses. On June 3, he sent a demand letter to Ovadia Law Group, P.A., a Florida personal injury firm with no California offices, employees, or clients, alleging its website violated CIPA’s pen register provisions. Ovadia didn’t settle but instead sued Shah in the Southern District of Florida, seeking a declaration that CIPA doesn’t apply extraterritorially to a Florida-only business, along with damages for abuse of process.

What This Means If You’ve Received a Demand Letter

None of these four developments make Shah’s demand letters disappear, and they don’t resolve the underlying legal questions. But what’s changed is the practical landscape. Businesses now have recent court precedents and solid examples of companies successfully pushing back rather than settling to help guide their decision-making.

If your business has received a demand letter from Vivek Shah:

• Don’t ignore it, and don’t respond directly. Loop in counsel who knows Shah’s litigation history and the current state of the law before you do anything else.
• Document your website’s tracking setup now. Know what tools you’re running, what data they collect, and who receives it, in case you need that record later.
• Ask your attorney about your options beyond settlement. Dismissal, and in some cases going on offense the way Lofty and Ovadia did, are both now live possibilities backed by recent case law.
• Support efforts to enact a bill that would help to curb wiretapping lawsuits. You can read about SB 690 here, and then directly or indirectly support the various coalitions, including the Alliance for Legal Fairness and others. More specifically, in the next few weeks, contact your California state legislators and advocate for the bill. If you have been targeted by Vivek Shah, tell your story so that the legislators understand the real-world implications.
• Keep tracking developments. Our Digital Wiretapping Litigation Map tracks related cases across all 50 states, and we’ll continue to update this series as Shah’s appeal, the Lofty and Ovadia declaratory judgment actions, and his vacatur petition in the Pashion Footwear matter move forward.

Conclusion

To stay current on CIPA developments, legislative progress, and other California privacy litigation trends, subscribe to Fisher Phillips’ Insights. For guidance specific to your situation, contact your Fisher Phillips attorney, the authors of this Insight, or any member of our Digital Wiretapping Litigation Team or Privacy and Cyber Team.