Hi CIPAWorld!
For anyone who regularly follows this blog and all the recent developments regarding Vivek Shah, they all too well know the script by now. A company’s website secretly installed spyware, it violated the California Invasion of Privacy Act and either pay up or a lawsuit will be filed. For the company getting these letters, maybe they read it twice and even forwarded it to their general counsel with five exclamation points and a “can he actually do this and get away with it???” The general counsel and their software team then sit and stare at the monitor wondering when did their cookie banner become a crime scene (no, I am not writing a pitch or bible for a tv show…yet).
For those companies, take a breather because this is a case where a company that was on the receiving end on one of these Vivek Shah demands and lawsuit actually won and there are good takeaways to draw from it.
The case is Shah v. WPromote, LLC, No. B350071, 2026 WL 2427606 (Cal. Ct. App. Aug. 19, 2026) and it’s a good one to get into. Vivek Shah, representing himself, sued marketing agency Wpromote in September 2024, alleging its website tracked him without his knowledge, sent his search terms where they shouldn’t have gone, and gave him no meaningful way to opt out. He brought two CIPA claims, one for wiretapping under section 631 and another for an unlawful pen register under section 638.51.
A procedural history is worth discussing because it’s a relatable mess that happened and may provide some comfort to future defendants if they find themselves in a similar situation. Wpromote missed its deadline to respond to the complaint, and Shah got a default entered against the company and it took three separate motions by Wpromote before a court finally agreed to undo it. While the first two attempts failed, the third succeeded with Wpromote’s counsel noting to the court that 2024 had been a rough year on the legal team, enough turnover that, as the declaration put it, “not all process, including the Complaint,” had been received promptly. The trial court bought this reason and decided to set Shah’s default aside. He countered on appeal arguing three points.
The first argument might seem a reasonable one in that he served Wpromote properly, so the default that got entered was valid, and Wpromote shouldn’t get to just undo something that had been done right. However, the court noted that he was bringing this from the wrong perspective as section 473 doesn’t require any showing that service was defective to begin with. Rather the purpose of § 473 is to help defendants who were adequately served but still missed the deadline due to mistake, inadvertence, surprise, or excusable neglect. The second argument was that the third motion to vacate shouldn’t have worked because it was basically a rerun of the first two noting that nothing that had actually changed. Courts look down on when someone keeps refiling the same losing motion but here, the Court of Appeal did not address it. Instead, it turned to Shah’s third argument that the trial court botched some procedural steps along the way, skipping a tentative ruling, referencing a “reply” brief from Wpromote that he insisted was never actually filed and thus was harmed. However, the Appellate court was not moved because not getting a default judgment granted or affirmed is not the kind of “harm” that would justify Shah winning on a technicality as opposed to a concrete harm that the law is designed to protect and rectify. In so many words, the Court of Appeal’s reason was simple: the law has a strong preference for deciding things on the actual facts and merits and getting the case sent back to actually litigate it rather than deciding it on a technicality is exactly how the judicial process is supposed to operate.
Moving to the fun part of the case, Wpromote moved for judgment on the pleadings by pointing to its own website, a pop-up banner saying “Okay, got it,” “Use necessary cookies only,” or “Show details” and its own privacy policy laying out exactly how information gets collected and shared. The trial court agreed with Wpromote that what it did contradicted what Shah was claiming.
The Court of Appeal took a slightly different approach and focused on the fact at the pleadings stage, a court has to accept the plaintiff’s allegations as true (even the ones that sound very unlikely), and it can’t yet weigh a defendant’s own website against them. The Court Appeals said that specific fight belongs at the summary judgment stage or trial. However, the good news here is that this did not cost Wpromote the case as the dismissal got affirmed anyway, just on cleaner footing, and honestly, one that is more useful to defense counsel going forward than the cookie banner argument ever was.
Furthermore, the real reason Wpromote won was that following a closer examination of Shah’s own complaint, it didn’t pass muster. Shah claimed that Wpromote intercepted his “chat conversations” but he never claimed to have had any chat conversations. He said he used a search bar which is not the same thing, and no amount of creative lawyering makes them the same thing. Additionally, he also said some kind of “beacon” collected his IP address like it was an illegal pen register but never explained how that beacon actually worked or what it supposedly captured. It’s a bit like accusing your neighbor of stealing your car and then, under questioning, admitting you don’t own a car. Those who get these Shah demands know all too well the playbook he keeps trying and this case illustrates exactly what the problem with Shah’s strategy is. The court caught that gap between what was pled and what was actually alleged and dismissed on that basis.
Shah did get leave to amend, which is pretty standard for a first complaint under California’s generous rules, so this particular case isn’t fully over but even then, this case is otherwise a genuinely pleasant outcome. Default cleared on solid legal footing as opposed to a technicality, dismissal affirmed, and an opinion that spells out, in plain terms, exactly where these boilerplate complaints tend to fall apart. Another Vivek Shah loss here is another weapon in a defendant’s armory.
We know that Shah has been declared a vexatious litigant in the Central District of California and that Lofty is engaged in its own righteous fight against Shah (see the other article posted today for the update on that case). He is not new to any of this but because of that, this case shows that not only was this not a fluke win for Wpromote, but it is one more data point in an extensive pattern that shows that when courts actually tackle these Shah complaints with the rigor and scrutiny that is required, they keep finding the same problem. The right law may be presented but the facts do not nearly meet the criteria to back those claims up.
So, if a company and its general counsel has one of these letters sitting around, don’t fret and resist the urge to just move to settlement. Engage competent counsel (such as Troutman Amin) to actually check if the claims line up with the facts. Chances are that the allegations are not as airtight as they may seem in the complaint or demand letter. Wpromote is proof that where a company is willing to do the work that is required, it may come out better than it originally thought.
Talk to you soon CIPAWorld and as always, be safe.