Many companies are opening their mail to find a one-page “Informal Dispute Resolution” letter signed by Vivek Shah, accompanied by a ready-to-file complaint alleging that the company’s website violates the California Invasion of Privacy Act (CIPA). If you have received one, do not ignore it—but also do not assume the demand is as strong as it sounds. Below is what these letters say, the legal theory behind them, and the measured steps a business should take.
What the demand looks like:
The package typically arrives by first-class mail and has two parts:
- A short demand letter stating that the recipient has violated CIPA and that a complaint is “prepared and ready to be filed” in California Superior Court unless the matter is resolved.
- An unfiled draft complaint naming the company as defendant and demanding a jury trial.
The theories vary. Some letters rely on California’s wiretapping provision, Cal. Penal Code § 631(a), alleging that text typed into a website search bar or form is transmitted to third-party analytics and advertising vendors. Others rely on California’s pen register provisions, Cal. Penal Code §§ 638.50(b), 638.51(a), and 637.2, alleging that third-party scripts, pixels, and tags cause a visitor’s browser to transmit IP addresses and device/browser identifiers on page load, before any consent. The complaints commonly attach a screenshot of the browser “Network” tab as Exhibit A purporting to show requests firing to vendors such as Google Analytics, HubSpot, AdRoll, and similar services.
The legal theory—and why it is contested:
CIPA’s pen register sections define a “pen register” as a device or process that records or decodes dialing, routing, addressing, or signaling information, and § 638.51(a) generally bars installing or using one without a court order. The plaintiff’s argument is that ordinary web-tracking technology is a “pen register” or the use of these technologies involve unlawful “interception” of communications. The demand letters usually allege that automatic page-load transmissions occur before a visitor can consent. This is an aggressive and unsettled application of a statute written for telephone surveillance. Courts in California are actively splitting on whether common analytics and advertising tools fall within CIPA at all, which is highly dependent on the specific nature of the tracking technology used and data captured. The case law is also evolving on potential defenses for website operators, including consent, standing, the “party exception,” and constitutional concerns. A demand letter states one side of a contested question; it is not an adjudication.
Who is Vivek Shah?
Vivek Shah is a pro se litigant—he is not a lawyer—who has been sending these demands to businesses nationwide. His name may be familiar for another reason. The same Vivek Shah appears to be the person who, according to the U.S. Department of Justice, was sentenced to 7 years and 3 months in federal prison for orchestrating a multimillion-dollar extortion scheme in which he threatened to kill family members of several prominent victims—including movie producer Harvey Weinstein, Groupon co-founder Eric Lefkofsky, and coal executive Chris Cline—unless his targets wired tens of millions of dollars into offshore accounts. Public court records reflect that Vivek Shah was sentenced to 87 months in September 2013 and released roughly five and a half years later. This history is a matter of public record and is reported here for context. It does not, by itself, determine the merits of any civil claim. But it is relevant background for any business evaluating a pre-suit demand and deciding how to respond.
What to do if you receive a letter:
- Do not ignore it, and do not panic. An unfiled draft complaint is a negotiating tool, not a lawsuit. But the deadline and filing risk are real.
- Preserve records. Keep the envelope, letter, and exhibits. Preserve a record of your website’s current configuration and tag-manager settings; do not let routine changes destroy any record of the state of the site as of the visit.
- Do not communicate directly with the sender before consulting counsel. Statements made in response can be used in negotiation or pleadings.
- Pull your site’s actual tracking stack. The complaint’s screenshot describes generic page-load behavior; an accurate technical inventory of what fires, when, and with what consent is essential.
- Review your consent banner and CMP. Whether tags fire before consent is frequently the pivotal fact.
- Assess insurance. Some cyber, media, or general liability policies may respond. Often it is advisable to tender early.
- Evaluate venue, standing, arbitration, and consent defenses before deciding whether to ignore, respond, or negotiate.
