What a Vivek Shah CIPA Demand Letter Means for Your Business

A growing number of Missouri businesses are receiving demand letters alleging that the tracking technologies on their websites violate the California Invasion of Privacy Act (CIPA) — a 1967 law designed to combat “Big Brother” surveillance. Many of these letters come from California resident Vivek Shah, a “serial tester”¹ who has filed numerous website privacy claims and reportedly sent demand letters to thousands of businesses across the country.

The claims have targeted manufacturers, distributors, professional service firms, and other companies with little apparent connection to California. Industry, size, and geographic location appear to offer little protection from receiving his demands. When companies refuse to pay, Shah has shown a willingness to sue.

What this means: Missouri businesses that receive a CIPA demand letter should contact an attorney. A demand letter is not a lawsuit, but it does call for a measured response.

These demand letters reflect a broader trend in website privacy litigation, which has expanded rapidly in recent years. Plaintiffs increasingly are using California law to pursue novel claims involving website technologies. Businesses that have never considered themselves part of the privacy-law landscape may find themselves evaluating claims based on technologies operating on their websites.

What Does a Vivek Shah CIPA Demand Letter Claim?

Recent CIPA website-tracking claims have generally focused on two theories:

Communication-Interception Claims. These claims allege that website tracking technologies unlawfully intercepted communications between a website visitor and the website operator. Plaintiffs often focus on technologies such as analytics tools (e.g. Google Analytics), chat features, search bars, cookies, advertising trackers (e.g. Meta Pixel), and online forms.
Pen-Register or Trap-and-Trace Claims. These claims allege that website tracking technologies captured routing or addressing information associated with internet communications, such as IP addresses. More recent demand letters sent to Missouri businesses appear to focus on this theory.

These claims attract attention because CIPA provides a private right of action and minimum statutory damages of $5,000 per violation, even where no actual harm is alleged.

California courts have not reached a consensus on whether common website-tracking technologies violate CIPA. This inconsistency creates uncertainty for businesses facing CIPA claims. The outcomes often depend on the court, the technology involved, and the theory pursued.

Can a Missouri Business Be Sued in California?

Before addressing whether their website violates California law, Missouri businesses should consider a more basic question: can they be sued in California at all?

A California resident’s decision to visit a Missouri company’s website does not automatically give California courts authority over that company. Courts generally need personal jurisdiction (a sufficient connection between the defendant and the state where the lawsuit is filed) before they can require a business to litigate a case there.

Courts will look at the business’s own connections to California, such as employees, offices, customers, targeted advertising, or other activities directed toward the state. Importantly, the lawsuit must arise out of these connections, not connections initiated by the plaintiff.

A manufacturer whose business is concentrated in the Midwest may be in a different position than a company actively marketing its products or services throughout California. Likewise, a website that merely provides information may raise different jurisdictional considerations than a website used to conduct business with California residents. An attorney can help evaluate a business’s connections and determine whether a jurisdictional challenge is available.

What Should a Missouri Business Do About a CIPA Claim?

Missouri businesses do not need to become experts in California privacy law, but they should understand what technologies operate on their websites.

Businesses that have not received a demand letter can take preventative measures by working with counsel to audit their websites’ search functions, chat features, and analytics tools, particularly those installed by third-party vendors. Because many CIPA claims focus as much on consent and disclosure as on the underlying technology, identifying what information those technologies collect and whether the websites’ privacy notices, cookie banners, and consent mechanisms accurately reflect those practices are important first steps toward evaluating risk.

Businesses that receive a demand letter should resist the urge to ignore it or immediately modify their websites. Although a demand letter is not a judgment and does not mean the claim has merit, it warrants prompt attention. Altering website features or tracking tools after receiving a demand letter can create unnecessary disputes regarding the preservation of evidence, while failing to respond may limit available defenses and response options. Before taking any action, businesses should consult legal counsel.

Your Legal Partner for Business Advisory and Litigation Services

When faced with a demand letter, businesses must decide whether to respond, negotiate, challenge the claim, or prepare for litigation. Those decisions can affect not only the immediate dispute, but also relationships with existing vendors, customers, insurers, and other stakeholders.

If your business receives a CIPA demand letter from Vivek Shah, or any other demand letter from a “serial tester,” our Business Advisory and Litigation attorneys can help evaluate the allegations, assess risk exposure, and develop a response strategy that aligns with your business objectives.

Written by attorney Ruth Binger, with research and contributions by attorney Sarah Ayers and law clerk Jeremy Thorpe.

¹ An individual who systematically tests websites to ‘find’ privacy violations and seek compensation from website owners.

Business Law Ruth Binger Sarah Ayers