Hi CIPAWorld:
A potentially consequential CIPA case has landed in the Central District of California. The lawsuit, filed against frequent CIPA plaintiff Vivek Shah, challenges some of the core legal theories behind the recent wave of website privacy lawsuits and could have implications well beyond the parties involved. See Lofty, Inc. v. Vivek Shah, 2:26-cv-07425 (C.D. Cal July 8, 2026).
For nearly two years, California privacy litigation has been shaped by a growing wave of lawsuits challenging technologies that are now standard across the internet. What began with claims targeting chat features and session replay tools has expanded to include allegations that ordinary website analytics platforms—used by virtually every commercial website—violate California’s decades-old pen register statute. As a result, businesses across industries have been forced to defend lawsuits based simply on their use of commonplace website analytics tools but this Shah case might help turn the tide.
Instead of waiting to be sued, Lofty Inc., a real estate technology company whose platform supports more than 91,000 real estate professionals across roughly 30,000 websites, has filed suit against frequent CIPA plaintiff Vivek Shah. Rather than defending another privacy case, Lofty is asking a federal court to decide a question that has hovered over dozens of pending lawsuits: does the routine use of website analytics software violate California’s pen register statute?
According to the complaint, the dispute began with a demand letter Shah sent on June 13, 2026. Like many similar letters reportedly sent to businesses nationwide, it alleged that Lofty’s website unlawfully used Google Analytics 4 and other third-party technologies “without a court order and without [Mr. Shah’s] informed and specific consent” in violation of California Penal Code section 638.51. The letter allegedly demanded payment, included a draft complaint described as “ready to be filed,” and sought statutory damages, declaratory relief, and an injunction requiring Lofty to stop using the challenged technologies which Lofty says would require the company to “re-architect” its platform to implement several corrective measures.
Although the dispute stems from a single demand letter, the complaint describes what Lofty characterizes as a broader campaign. It alleges that Shah has sent substantially similar demand letters to businesses across the country, all advancing the theory that common website analytics technologies function as unlawful pen registers. The complaint further describes Shah as a litigation “tester” who intentionally visits websites to identify potential claims before sending demand letters and, if necessary, filing suit. Those allegations have not been tested in court (since all Shah does is send demand letters), but they mirror shared concerns of many companies who operate consumer-facing websites in California.
The best part is Lofty unequivocally decided not to settle and pursue action. It took the position that standard website analytics tools do not qualify as pen registers or trap-and-trace devices under CIPA. It also argued that California’s broader privacy laws, including the California Consumer Privacy Act, expressly permit businesses to collect and process website data in the ordinary course of operations, so long as they satisfy the statute’s disclosure and consumer rights requirements. After Shah rejected those arguments and reiterated his intent to sue, Lofty filed this declaratory judgment action before any enforcement action was initiated.
The complaint also places substantial emphasis on standing. One of the cases Lofty cited was Casillas v. BOP LLC, No. 24STCV15581 (L.A. Super. Ct. June 18, 2025), where the court rejected a Penal Code § 638.51 claim predicated on the collection of an IP address, holding that the website “is an electronic communication service, and under the terms of the statute, obtaining IP addresses from ordinary user access does not violate the pen register statute.” Whether courts ultimately accept that theory remains an open question, but defendants have increasingly argued that litigation-driven website visits should be treated differently from ordinary consumer interactions.
Lofty alleges that Shah did not access its website as a prospective customer but instead visited for the purpose of documenting analytics activity in anticipation of litigation. According to the complaint, Shah used software to capture network communications during his visit and therefore cannot plausibly claim that ordinary website tracking invaded any objectively reasonable expectation of privacy.
The case also raises issues that reach beyond Lofty’s own operations. It asks whether a statute enacted decades before the rise of the commercial internet applies to technologies such as Google Analytics, which collect routing information, device identifiers, and other technical data as part of routine website functionality.
Lofty argues that it does not. According to the complaint, California’s pen register provisions were designed to regulate telephone surveillance, not internet communications, and construing them to cover ordinary website analytics tools would conflict with the framework established by the CCPA, which regulates—rather than prohibits—the commercial collection of website data. Lofty also emphasizes the practical implications of that interpretation. Because its platform supports tens of thousands of websites, eliminating standard analytics technologies would require substantial changes to its systems and would affect thousands of customers.
California’s appellate courts have not weighed in, but a number of Los Angeles Superior Court judges have dismissed these claims. Decisions in Sanchez v. Cars.com, Inc., No. 24STCV13201, 2025 WL 487194, at *3 (Cal. Super. Ct. L.A. Cnty. Jan. 27, 2025), Aviles v. LiveRamp, Inc., No. 24STCV19869, 2025 WL 487196, at *3 (Cal. Super. Ct. L.A. Cnty. Jan. 28, 2025), Licea v. Hickory Farms LLC, No. 23STCV26148, 2024 WL 1698147, at *4 (Cal. Super. Ct. L.A. Cnty. Mar. 13, 2024), Rodriguez v. Ink America Int’l Group LLC, No. 25STCV15350, 2025 WL 4034985, at *3, 5 (Cal. Super. Ct. L.A. Cnty. Dec. 10, 2025), and Blaker v. NetScout Systems, Inc., No. 25STCV31283, 2026 WL 1709143, at *4 (Cal. Super. Ct. L.A. Cnty. May 27, 2026) all concluded, in one way or another, that the statute was written to address telephone surveillance—not the collection of technical information that occurs during normal website operations.
Some courts focused on the statutory text and legislative history, while others emphasized the practical consequences of treating routine website analytics as criminal conduct. Several also pointed to the CCPA, observing that it would be an odd result if California chose to regulate common website data collection through one statute while making the same conduct a crime under another.
That said, Lofty acknowledged that the picture is not entirely one-sided. Federal district courts, including Shah v. Fandom, Inc., 754 F. Supp. 3d 924, 929–33 (N.D. Cal. 2024), Greenley v. Kochava, Inc., 684 F. Supp. 3d 1024, 1050–51 (S.D. Cal. 2023), and Gabrielli v. Haleon US Inc., 815 F. Supp. 3d 852, 871–72 (N.D. Cal. 2025), have allowed similar claims to move forward at the pleading stage, concluding that the statute’s reference to “electronic communications” may be broad enough to cover internet communications.
That is what makes the Lofty case important. The court now has the opportunity to weigh in on an issue that continues to divide state and federal courts, and its decision could influence how future CIPA website analytics cases are litigated. While a trial court ruling will not settle the question statewide, another well-reasoned decision could further shape the debate until California’s appellate courts finally provide a definitive answer.
The lawsuit also comes as California lawmakers continue to consider legislation aimed at curbing the surge in CIPA website litigation. As Lofty notes, pending legislation would substantially limit private enforcement of CIPA’s pen register provisions in the website context by vesting enforcement authority in the California Attorney General instead of private plaintiffs. See Puja Amin’s article below that discusses the proposed changes and why they may fall short of what businesses were anticipating.
Whether those proposals ultimately become law remains uncertain, but their introduction reflects growing concern among businesses (as well as practitioners and even policymakers) about the expanding scope of website privacy litigation.
For businesses, the importance of Lofty’s lawsuit goes well beyond the parties involved. At its core, the case asks whether technology used on countless commercial websites can be treated as a criminal pen register under a statute enacted decades before the modern internet. It also presents a chance for a federal court to consider whether individuals, like Vivek Shah, who actively search for potential privacy violations have suffered the kind of injury needed to bring CIPA claims in the first place. Whether the court agrees with Lofty remains to be seen. By filing suit before any enforcement action was brought, however, Lofty has turned what could have been another pre-litigation dispute into a case that may provide much-needed guidance on an issue that continues to generate new lawsuits.
For Vivek Shah, Lofty’s lawsuit changes the dynamic. Rather than responding to another demand letter, the company has taken the issue to court and put Shah’s own conduct at the center of the dispute. Lofty alleges that Shah did not visit the website as a typical consumer seeking services, but instead accessed the platform to investigate a potential privacy claim and prepare a demand letter. The company argues that a person who visits a website specifically to search for a potential lawsuit should not later be able to claim that the same visit created a privacy injury. If the court agrees, the decision could make it more difficult for repeat CIPA plaintiffs who actively seek out websites as potential litigation targets to establish standing.
Vivek is in for a fight and we will be watching every round of it. We will keep you posted on all developments.
Talk to you soon CIPAWorld and as always, be safe.