If your business, or one of your clients, recently received a letter titled “Informal Dispute Resolution” accusing your website of illegally “wiretapping” visitors under the California Invasion of Privacy Act (CIPA), you are one of thousands of recipients of a mass mailed template letter. The sender, Vivek Shah, has become one of the most prolific individual filers of these claims nationwide.
What Is the Claim?
CIPA has prohibited wiretapping in California for nearly six decades, but it has only recently been repurposed to target website tracking technology. Plaintiffs like Shah argue that ordinary cookies, pixels, and analytics scripts used without upfront, opt in consent amount to illegal wiretapping.
His original theory under CIPA Section 631(a) involves typing a search term, often his own name, “VIVEK,” into a site’s search bar with developer tools open, capturing screenshots showing that term being sent to Google Analytics, Meta, or HubSpot, and arguing the business “aided and conspired” in an unauthorized interception.
More recently, he has shifted to CIPA Sections 638.50 and 638.51, arguing that any script capturing a visitor’s IP address or device identifiers when the page loads, before a cookie banner appears, functions as an unlawful “pen register.”
Every letter follows a similar format:
- A cover letter
- An unfiled draft complaint prepared for Los Angeles Superior Court
- Screenshot exhibits
- A settlement demand, often around $50,000, calculated at $5,000 per alleged violation, with each third party counted separately
The letters typically threaten litigation in California state court or arbitration if the website’s terms and conditions include an arbitration provision.
How Many Letters Has He Sent?
Estimates vary, but they all point in the same direction.
Fisher Phillips estimates that Shah sent thousands of letters between fall 2025 and June 2026 and is currently involved in more than 80 active matters, with that number continuing to grow.
Troutman Amin’s CIPAWorld describes the activity as operating on an “industrial scale,” affecting businesses across virtually every industry, including many with little or no connection to California.
Some compliance software vendors estimate the number of letters is in the tens of thousands. While those figures should be viewed with caution, even conservative estimates indicate that thousands of businesses have received these demand letters.
Who Has Been Targeted?
The letters have been sent broadly across industries, including:
- Manufacturers
- Schools
- Automobile dealerships
- Retail businesses
- Nonprofits
- B2B companies
- B2C companies
Many recipients are not consumer facing businesses, and some have little connection to California. While lawsuits are generally filed in California because CIPA is a California law, demand letters have been sent to businesses throughout the United States.
How Many Lawsuits Has He Actually Filed?
Although thousands of demand letters have reportedly been sent, far fewer have resulted in filed lawsuits.
When cases are filed, Shah typically represents himself and pursues the litigation aggressively. Several publicly reported cases include:
| Case | Filed | Outcome |
|---|---|---|
| Shah v. Mondelez Global LLC | Los Angeles Superior Court, Sept. 2024 | Dismissed with prejudice by stipulation, July 2025 |
| Shah v. The Harvard Drug Group LLC | Los Angeles Superior Court, Sept. 2024 | Motion to dismiss granted, April 2025 |
| Shah v. Card Delivery LLC | Central District of California, Sept. 2025 | Voluntarily dismissed by Shah, Nov. 2025 |
| Shah v. TalentBridge, Inc. | Central District of California | Dismissed with prejudice, May 2026 for lack of Article III standing |
Many courts have ruled against these claims over the past 18 months, often concluding that an alleged statutory violation alone does not establish a concrete injury. At least one dismissal has been appealed to the Ninth Circuit.
What Should You Do If You Receive a Letter?
Receiving a demand letter can be unsettling, but it is important to respond thoughtfully.
Consider the following steps:
- Do not ignore the letter.
- Do not communicate directly with the sender before speaking with legal counsel.
- Audit your website to identify all tracking technologies, cookies, pixels, and third party services.
- Review how your website discloses data collection and sharing practices.
- Confirm that non essential tracking technologies are properly managed through your consent process.
- Document your website’s current configuration before making changes.
- Consult an attorney experienced in CIPA and website privacy litigation before responding.
If you do not already work with legal counsel experienced in this area, Social Spice Media can help connect you with attorneys who regularly handle CIPA related matters.
The Bottom Line
Vivek Shah has built a large scale demand letter operation targeting businesses across a wide range of industries. While relatively few of these claims ultimately become lawsuits, businesses should not ignore them.
At the same time, receiving a demand letter does not automatically mean your business has violated the law or that you should immediately settle. Taking the time to understand your website, review your privacy practices, and consult experienced legal counsel can help you make informed decisions based on your specific circumstances.
