Hi CIPAWorld,
Vivek Shah continues to accumulate losses, and the latest one is additional evidence that courts are getting fed up with his tactics. This latest ruling, Shah v. Drexel Chemical Co., No. 2:26-CV-01605-HDV-KES, 2026 WL 2602923 (C.D. Cal. Sept. 1, 2026), is a good one to get into because it shows exactly what a court expects a plaintiff to actually prove before an individual can allege that a website supposedly tracked them and violated CIPA.
Shah sued Drexel Chemical Company, which is an agricultural chemical outfit that sells things such as herbicides, fungicides, and pesticides to farmers and distributors across the country. As he does in many of these demands and lawsuits, Shah claimed that Drexel’s website secretly shipped his search queries off to Google and other third parties without his consent, and stacked seven additional causes of action on top of that theory. Besides CIPA, among others, it also included the Federal Wiretap Act, and a good old fashioned fraud claim.
So what exactly did Shah search for on Drexel’s website that caused him all this harm you ask? Well…drum roll…he typed “CALIFORNIA,” then “CALIFORNIA1,” then “CALIFORNIA12,” and then “CALIFORNIA 123” which reads less like a privacy violation and more like someone testing whether a search bar has opinions about incrementing numbers. He also looked up the names of pesticide ingredients such as glyphosate and malathion, which are printed on the label of a bag of weed killer, and watched an autoplaying video of crop spraying equipment on the “About Us” page.
Drexel moved to dismiss with an argument that comes down to simply asking: so what? Even taking every one of Shah’s allegations as true, none of it adds up to an actual injury that belongs in federal court. The judge agreed, and in citing Mitchener v. CuriosityStream, Inc., 815 F. Supp. 3d 845, 850 (N.D. Cal. 2025), explained that to survive a motion to dismiss, a plaintiff has to identify the specific personal information he disclosed that implicates a protectable private interest, not just gesture vaguely at some data changing hands. Making a search on a chemical company’s website doesn’t clear that threshold and the court noted, that if it were to accept Shah’s argument then literally anyone considering obtaining Drexel’s products could have typed those exact same search terms. The analogy here is almost similar to one claiming their privacy was violated because you saw them buy milk at the grocery store, which can be true as they observed you doing it, but the thing itself was never a secret.
The court then quickly dismissed Shah’s argument that his IP address, combined with some browser metadata and his search history, added up to a personal profile substantial enough to count as a privacy harm. Relying on United States v. Forrester, 512F.3d 500, 510 (9th Cir. 2008) and Heeger v. Facebook, Inc., 509 F. Supp. 3d 1182, 1189 (N.D. Cal. 2020), the court noted plainly that there is no legally protected privacy interest in an IP address, full stop and that including a non-private data point on top of some generic search terms doesn’t magically produce something private either. In simple mathematics it amounts to this: zero plus zero is still zero. Shah relied on In re Facebook, Inc. Internet Tracking Litigation, 956 F.3d 589 (9th Cir. 2020), where Facebook allegedly continued collecting users’ browsing histories after logout. But the court distinguished that case because Shah identified no sensitive information collected beyond basic agricultural search terms and standard data, which does not implicate a protectable privacy interest.
The court leaned most heavily on Popa v. Microsoft Corp., 153 F.4th 784, 792 (9th Cir. 2025) which involved a session-replay software on a pet supplies website, where the plaintiff’s browsing activity had been recorded and handed to the site owner for analysis. Even there, the Ninth Circuit dismissed the case, holding that the injury wasn’t remotely similar to the kind of “highly offensive” disclosure actionable at common law, since the plaintiff never pointed to anything embarrassing, invasive, or genuinely private. The court here found that reasoning to fit Shah’s case perfectly. Watching a video of crop spraying equipment or searching for a pesticide name just isn’t in the same universe, and the court reiterated that under TransUnion LLC v. Ramirez, 594 U.S. 413, 426 (2021), even a real statutory violation still needs a concrete injury attached to it, emphasizing that the statute alone doesn’t do the standing work for you.
Since Shah couldn’t clear this basic threshold, the court didn’t need to address Drexel’s other arguments pertaining to jurisdiction and venue. And as we have discussed here previously, the court noted in the footnote that just days after briefing was complete, Shah had been declared a vexatious litigant in Vivek Shah v. Crain Commc’ns, Inc, No. 2:26-CV-03070-RGK-CTS, 2026 WL 2177397 (C.D. Cal. July 20, 2026), an entirely separate case built on nearly identical allegations.
Lastly, it is worth a quick mention that the readers will recognize the name Drexel because this isn’t the first time Drexel has been fending off Shah. As we discussed in our recent update regarding Shah’s ongoing fight with Lofty, before this California case even got underway, Drexel had already gone to the Chancery Court in Tennessee to try to get ahead of one of Shah’s demand letters, arguing he lacked standing and that his threatened complaint wouldn’t survive if filed. That case got dismissed on Tennessee’s own procedural grounds, and Shah later tried to use that dismissal as ammunition against Lofty, an attempt that didn’t go especially well for him either. Same plaintiff at two different courts with two different theories, but the same basic problem at the center of both of them.
Including only generic search terms and routine website metadata, even when a plaintiff dresses them up with the right statutory citations, doesn’t automatically add up to a real injury. As this case shows, making the plaintiff show his actual harm is sometimes the one thing that never quite materializes. Another Vivek Shah loss and one more piece of ammunition for the defense side. We will be more than happy to take it.
Talk to you soon CIPAWorld and as always, be safe.