- Vivek Shah sends mass demand letters claiming website tracking violates the California Invasion of Privacy Act (CIPA), targeting businesses with faulty cookie banners or search bars, and offers to settle for payment.
- CIPA pen register and trap-and-trace claims now account for roughly two-thirds of all active California privacy litigation, with filings surging from 600 to over 4,000 in a short period.
- Shah's campaign evolved from wiretap claims (Section 631(a)) to pen register claims (Section 638.51), and faces a recent legal defeat in Shah v. Talentbridge, where a federal court dismissed his claim for lack of standing.
- CIPA applies to California residents visiting a website, regardless of the business's location, making geographic defenses ineffective; defense requires valid consent and proper site configuration.
- Two critical developments: imminent appellate rulings on whether website pixels qualify as pen registers, and SB 690, which could retroactively eliminate private rights of action under CIPA's pen register provisions.
- Recommended steps for recipients: get a free audit from Captain Compliance, preserve website configurations, notify insurers, test claims against site behavior, and avoid paying without investigation.
- A defensible posture requires complete inventory of scripts/pixels, data maps, adversarial testing, heightened security on sensitive pages, and vendor contracts with privacy compliance clauses.