Hi CIPAWorld!
Twenty-nine lawsuits in under five years. Seven nearly identical complaints in seven months. And almost none of them ever saw the inside of a courtroom before the plaintiff himself pulled the plug. That’s the résumé a federal judge in Los Angeles was staring at when he decided one man had officially worn out his welcome in the Central District of California.
If you’ve done any privacy defense work in California, you already know the lawsuit at the center of all this by heart, even before reading a word of the complaint. A website runs some kind of chat tool or analytics software, and supposedly that means it “intercepted” a visitor’s communications in violation of the California Invasion of Privacy Act. Swap out the defendant’s name and the URL, and you’ve read them all.
On July 20, 2026, Judge R. Gary Klausner decided one plaintiff, Vivek Shah, had taken that playbook a little too far. In Vivek Shah v. Crain Communications, Inc., 2:26-cv-003070-RGK-CTS (C.D. Cal Jul. 20, 2026) the court declared Shah a vexatious litigant, meaning that from here on out, he can’t file a new CIPA lawsuit in that court without a judge signing off first. It’s a short opinion, but it’s a genuinely satisfying read if you’ve ever wondered exactly what it takes for a court to conclude that a plaintiff has stopped litigating in good faith and started treating the legal system as a leverage machine.
Shah’s lawsuit against Crain, the publisher of Ad Age, followed the familiar script: he claimed the company’s website secretly captured the contents of his communications through its tracking tools. On its own, that’s just another CIPA complaint, one of hundreds filed in California over the past few years.
What made this one different is what Crain’s lawyers found when they looked into Shah’s history. Since late 2021, he’d filed at least 29 lawsuits, in courts up and down the country, against a genuinely random mix of companies — Citibank, PayPal, Bumble, Robinhood, Udemy, American Express, a biopharma company, a university. Some were CIPA claims that read almost word-for-word like the one against Crain. Others alleged consumer fraud, RICO violations, discrimination, even breach of contract. And tucked into a footnote, the court noted something that probably raised a few eyebrows: several of Shah’s complaints looked like they’d been copied straight out of unrelated class-action lawsuits (i.e. Evens et al v. Paypal, Inc., No. 5:22-cv-00248-BLF (N.D. Cal. filed Jan. 13, 2022)) filed by completely different plaintiffs, with the class-action parts simply cut out.
The detail that seemed to really catch the judge’s attention, though, was the timing. In the seven months before this ruling, Shah filed seven nearly identical CIPA complaints against seven different companies. Almost every one of them died at the very start of the case. And here’s the part that mattered most: they didn’t die because a judge ruled against Shah on the merits. Over and over, the pattern was the same — Shah would sue, the defendant would file a motion to dismiss, and Shah would simply drop the case himself before the judge ever had to rule.
Courts don’t take away someone’s right to sue on a whim. There’s a well-established four-part test from a Ninth Circuit case called De Long v. Hennessey, 912 F. 2d 1144, 1148 (9th Cir. 1990) and a judge has to walk through all parts before restricting a litigant’s access to the courthouse.
First, the person has to get real notice and a chance to defend themselves — no ambushes. Shah got a formally noticed motion and filed an opposition, so that box was easy to check.
Second, the judge has to actually build a record — not just say “this guy sues a lot,” but lay out the specific cases, dates, and outcomes that support that conclusion. This is where the opinion gets almost encyclopedic, walking through all 29 of Shah’s prior cases one by one.
Third — and this is the part that requires real judgment, not just counting — the court has to find that the filings are genuinely frivolous or amount to harassment. This is trickier than it sounds, because the Ninth Circuit has been clear that just suing a lot isn’t enough to brand someone a vexatious litigant. Plenty of people have legitimate reasons to be in court repeatedly. The claims also have to be essentially meritless. So the judge had to explain why this wasn’t just an unusually persistent plaintiff exercising a legal right.
Two things seemed to tip the scales. First, Shah’s own complaints showed he understood, in some detail, exactly how the industry practices he was suing over worked — which undercut any argument that he was an innocent, injured bystander. Second, and more importantly, the pattern of filing a case and then abandoning it the second a company pushed back looked less like someone trying to win a lawsuit and more like someone trying to extract a quick settlement without ever testing whether the claim actually held up. The court leaned on an earlier Ninth Circuit case, Molski v. Evergreen Dynasty Corp., 500 F.3d 1047, 1058 (9th Cir. 2007), which allows a judge to draw exactly that inference from a plaintiff’s litigation behavior, without needing some kind of smoking-gun proof of bad intent.
To his credit, Shah did get one point in his favor: he filed almost all of these cases representing himself, without a lawyer, and courts are supposed to cut self-represented litigants some slack. The judge acknowledged that but found it wasn’t nearly enough to outweigh everything else in the record.
Here’s the part that’s easy to miss if you only read a headline: Shah wasn’t banned from suing anyone, and the case against Crain wasn’t dismissed or restricted at all. The Ninth Circuit has struck down pre-filing orders before for being too broad — for example, banning someone from filing any lawsuit whatsoever, or requiring that all their future filings be pre-approved as “meritorious.” Judge Klausner sidestepped both of those problems. The restriction he imposed applies only to new CIPA and related digital-privacy lawsuits Shah might want to file in the Central District of California from here on out. Everything else, including the lawsuit currently sitting in front of him, moves forward as normal. The judge also turned down Crain’s request to make Shah post a bond covering the company’s legal costs, though he noted that whichever judge eventually handles one of Shah’s future filings is free to require that if they think it’s warranted.
That precision is exactly the point. The last De Long part requires courts to make sure a pre-filing order fits the specific problem, not the litigant in general, and this one does that almost surgically: it reaches only the type of claim Shah was filing on repeat and walking away from, leaves him free to bring any other kind of lawsuit or sue in any other court, and doesn’t touch the case currently in front of the judge at all.
If your company has already been sued by Shah, this ruling is now a ready-made shield the next time his name shows up on a docket in that district. But the more interesting lesson here is for anyone dealing with the broader flood of session-replay and chatbot-related privacy lawsuits, regardless of who’s filing them.
Courts have generally been reluctant to crack down on this kind of high-volume litigation, mostly because any single complaint, read in isolation, can look perfectly plausible. What this ruling shows is that a defendant willing to put in the work — pulling together a plaintiff’s entire litigation history, not just the case in front of the judge — can hand a court exactly what it needs to see the forest instead of the trees. And the detail that mattered most wasn’t simply how many times Shah sued. It was what happened next: complaint after complaint filed, and complaint after complaint dropped the moment someone actually pushed back.
Interestingly, this ruling isn’t the only sign that businesses are getting more comfortable pushing back on Shah. Rather than sitting around and waiting to get served, at least one company decided to flip the script entirely. As I discussed recently on a separate blog, real estate technology company Lofty Inc. received a CIPA demand letter from Shah in June, and instead of negotiating a quiet settlement, Lofty went straight to federal court itself. On July 8, 2026, Lofty filed a declaratory judgment action in the Central District of California, asking a judge to rule outright that its website’s standard analytics tools don’t violate CIPA and that Shah lacks standing to claim otherwise in the first place. It’s a more assertive defense strategy that lets a company pick its own timing, forum, and framing of the dispute, rather than leaving all three of those choices to whoever sent the demand letter. You can read more about that case here:
A handful of Shah’s older cases are still pending on appeal before the Ninth Circuit, so this story may not be completely finished. But for the time being, at least in one federal court, a prolific privacy plaintiff now has to ask permission before filing the next one. And for Vivek Shah, that is a very bitter pill to swallow to say the least.
None of this means the CIPA gold rush is over. For every plaintiff a court manages to rein in, there are others still filing the same template complaint this week, betting that most defendants will pay to make the headache go away rather than fight. What this ruling really offers is a blueprint: proof that if a defendant does the unglamorous work of tracking a plaintiff’s history across courts and cases, a judge will notice the pattern, and will act on it. The lawsuits themselves aren’t going anywhere. But the plaintiffs who treat the courthouse as a vending machine just got a reminder that someone is finally keeping a tab.
We will continue to monitor and update you on all Vivek Shah developments as they happen CIPAWorld. As always, be safe and talk to you soon.