We are thankful for warriors like Kevin Cole who fight back against privacy trolls like Vivek Shah. While we provide the software to protect against these claims attorneys like Cole can fight against them in court. When Vivek Shah sued Crain Communications under the California Invasion of Privacy Act, defense attorney Kevin J. Cole took a different approach. Rather than treating the case as another privacy claim to settle, Crain’s lawyers assembled Shah’s broader litigation history and asked a federal judge to examine the pattern. On July 20, 2026, Judge R. Gary Klausner did exactly that — and declared Shah a vexatious litigant.
The California Invasion of Privacy Act litigation boom has created a basic economic problem for thousands of businesses.
A company receives a demand letter alleging that some ordinary part of its website — Google Analytics, a search bar, a chatbot, a pixel, session-replay software or another third-party technology — illegally intercepted a visitor’s communications.
The amount demanded to resolve the claim may be substantially less than the cost of hiring counsel, retaining technical experts, conducting discovery and litigating a federal case.
Even a company convinced that it did nothing wrong has to do the math.
That imbalance is one reason website privacy litigation has grown so rapidly.
But when Vivek Shah sued Crain Communications, Inc. in March 2026, Crain and its lawyers at KJC Law Group chose another route.
They fought back.
More importantly, managing partner Kevin J. Cole and his team did not limit their examination to the allegations Shah made against Crain. They looked at Shah’s broader litigation history: the lawsuits, the similarities between complaints, the dismissals and what repeatedly happened when defendants challenged his claims.
That record eventually persuaded U.S. District Judge R. Gary Klausner to take the unusual step of declaring Shah a vexatious litigant and imposing a prefiling restriction on future CIPA and related digital-privacy lawsuits Shah seeks to bring in the Central District of California.
The decision did not hold that every CIPA claim Shah has made is invalid. It did not ban him from every courthouse, end CIPA litigation or decide whether the technology at issue on Crain’s website violated Section 631.
What the court did was different.
It examined the way Shah had been litigating.
And what Judge Klausner found provides one of the clearest examples yet of a court pushing back against the economics that have helped fuel serial website-privacy litigation.
How One Lawyer Fought Back Against Vivek Shah — and Got the Serial CIPA Plaintiff Declared a Vexatious Litigant
Kevin J. Cole is the managing partner of KJC Law Group. Along with attorney W. Blair Castle, he represented Crain Communications in Vivek Shah v. Crain Communications, Inc., Case No. 2:26-cv-03070-RGK-CTS, in the U.S. District Court for the Central District of California.
The case began conventionally enough.
On March 18, 2026, Shah, representing himself, sued Crain Communications under Section 631(a) of CIPA. The complaint alleged that Crain’s website intercepted the contents of Shah’s electronic communications. Public docket records identify the action as Shah v. Crain Communications, Inc. and confirm the March 18 filing date.
For businesses familiar with the recent CIPA litigation wave, the basic theory was recognizable.
Section 631 is California’s wiretapping provision. Plaintiffs increasingly have attempted to apply it to modern websites by alleging that third-party technologies receive communications between a visitor and a website without sufficient consent.
That can involve search terms, URLs, form inputs, chat communications, browsing activity or other information allegedly transmitted through third-party scripts.
Crain could have approached Shah’s lawsuit as a one-off dispute.
Instead, Cole and his team looked outward.
According to KJC Law Group’s account of the case, after reviewing Shah’s claims and concluding that Crain should fight them, the defense examined how many similar cases Shah had filed and the demand activity surrounding those cases. Crain then asked Judge Klausner to declare Shah a vexatious litigant and impose restrictions on future CIPA filings.
Cole later explained the underlying economic problem succinctly: many companies decide that settlement is cheaper than fighting.
That is precisely what makes the Crain strategy noteworthy.
Rather than evaluate the case exclusively on a spreadsheet comparing settlement cost against defense cost, the defense investigated whether the plaintiff’s litigation history itself provided another avenue of attack.
It did.
The Timeline: From a March CIPA Complaint to a July Vexatious Litigant Order
The speed with which the case developed is notable.
March 18, 2026: Shah Sues Crain Communications
Shah filed his complaint in the Central District of California on March 18, alleging a violation of CIPA Section 631(a). He contended that Crain’s website intercepted the contents of his electronic communications.
Crain retained KJC Law Group, with Kevin Cole and W. Blair Castle appearing for the company.
Spring 2026: The Defense Looks Beyond the Individual Complaint
Rather than treating Shah’s filing as an isolated privacy dispute, Crain investigated his broader record.
That became the foundation of its vexatious-litigant request.
The court ultimately considered at least 29 proceedings initiated by Shah between 2021 and 2026. Those proceedings were not all CIPA matters. They included litigation involving digital privacy as well as consumer, credit, intellectual-property, discrimination and other claims.
But Judge Klausner paid particular attention to the privacy counsel alerts about Vivek Shah’s recent CIPA activity.
In the seven months preceding the ruling, Shah had filed seven materially similar CIPA complaints against seven different defendants. According to the court’s analysis, those cases did not progress beyond the pleading stage; they were either voluntarily dismissed or dismissed by a court.
July 20, 2026: Judge Klausner Issues the Order
On July 20, Judge Klausner granted Crain’s request to declare Shah a vexatious litigant and entered a prefiling order.
The court required Shah to obtain permission before filing a new action in the Central District of California asserting claims under CIPA or related consumer digital-privacy laws.
The court did not simply count lawsuits.
It examined how Shah litigated them.
And that is where the ruling became unusually significant.
The Court Found a Pattern, Not Just a Large Number of Lawsuits
Filing many lawsuits does not automatically make someone a vexatious litigant.
People and businesses sometimes have legitimate reasons to bring multiple cases. Courts also have to exercise particular caution before restricting someone’s access to the judicial system.
Judge Klausner therefore had to find more than volume.
Crain’s record showed similarities between Shah’s pleadings that the court considered important.
The court found that a number of the complaints were either template versions of Shah’s previous CIPA complaints or closely copied versions of pending class-action complaints filed by others.
KJC reported that in at least one instance, the court identified a complaint that was effectively a near-copy of an existing class-action pleading with the class allegations removed. The court identified other duplicated pleadings as well.
The repeated use of similar pleadings was only part of the record.
Judge Klausner also focused on what happened when defendants fought.
According to the court, Shah had a pattern of voluntarily dismissing actions after defendants filed motions to dismiss and had not taken the CIPA claims identified in the court’s record through a trial on their merits.
The court also considered Shah’s own familiarity with website tracking technology.
Judge Klausner found that Shah was well acquainted with industry practices that he believed could violate CIPA and had the knowledge and means to determine whether websites were allegedly transmitting search queries to third parties.
That mattered because the court was not looking at a consumer who unknowingly encountered the same alleged invasion of privacy again and again.
The record indicated that Shah was actively looking for potential violations.
The court pointed specifically to a pattern of seeking out possible CIPA violations and submitting multiple search queries in an effort to establish the amount in controversy necessary for federal jurisdiction.
Taken together, Judge Klausner found the record supported a much more serious conclusion about the purpose of the litigation.
The court said the pattern strongly indicated an effort to “harass defendants into coercive settlements” rather than obtain judicial redress in good faith.
That sentence may end up being one of the most frequently cited passages from the entire order.
What It Takes to Declare Someone a Vexatious Litigant
Federal courts do not lightly impose restrictions on someone’s ability to file lawsuits.
In the Ninth Circuit, Judge Klausner applied the four-part framework from De Long v. Hennessey, 912 F.2d 1144 (9th Cir. 1990).
Before entering a prefiling restriction, a court generally must ensure:
- The litigant receives notice and an opportunity to be heard.
- The court develops an adequate record of the cases and filings supporting the order.
- The court makes substantive findings of frivolousness or harassment.
- The restriction is narrowly tailored to address the conduct at issue.
Judge Klausner found all four requirements satisfied.
The third factor is particularly important.
The order was not based simply on the proposition that Shah had lost some cases.
The court examined the combination of repetitive filings, copied or templated pleadings, intentional efforts to locate alleged violations, voluntary dismissals after challenges and the lack of adjudication on the merits.
The judge also addressed Shah’s status as a self-represented, or pro se, litigant.
Courts generally afford pro se litigants additional latitude, and the Ninth Circuit treats that status as a factor counseling caution before imposing a prefiling order. Judge Klausner acknowledged that consideration but concluded that it could not overcome the litigation record before him.
Crain Asked the Court to Look at the Business Model Behind the Litigation
This may be the most useful part of the case for defense lawyers and businesses receiving serial CIPA demands.
A conventional defense attacks the individual claim:
Did interception occur?
Was there consent?
Did the third party actually acquire the “contents” of a communication?
Was the technology acting as an extension of the website operator?
Does the plaintiff have Article III standing?
Was there a reasonable expectation of privacy?
Was the plaintiff actually injured?
Those issues remain critical.
But Crain added another question:
What does the plaintiff’s complete litigation record tell us about why this case was filed?
That required collecting evidence across cases rather than simply briefing the allegations in the complaint sitting in front of the court.
The result was a record covering at least 29 proceedings and a concentrated group of seven substantially similar CIPA actions filed in seven months.
For companies receiving high-volume privacy demand letters, that is an important lesson.
A claimant’s history can matter.
Prior complaints can matter.
Voluntary dismissals can matter.
The timing of those dismissals can matter.
Repeated allegations copied from one defendant to another can matter.
And whether claims are consistently pursued to judgment — or abandoned whenever substantive resistance appears — can matter.
None of those facts automatically defeats a legitimate privacy claim. But Shah v. Crain shows that, in an extreme enough case, a defendant can ask the court to consider the pattern rather than allowing every new complaint to be evaluated in a vacuum.
What the Vexatious Litigant Order Actually Does
The scope of Judge Klausner’s order needs to be stated carefully.
Shah has not been prohibited from filing every lawsuit in the United States.
The order is much narrower.
Before Shah can bring a new case in the U.S. District Court for the Central District of California asserting CIPA or related digital-privacy claims, he must obtain leave of court.
That gives a judge an opportunity to screen the proposed action before a defendant is forced to respond to it.
The order does not prohibit unrelated lawsuits.
It does not automatically bind California state courts.
It does not impose a nationwide filing ban.
It does not prohibit private demand letters.
And it does not, by itself, eliminate arbitration proceedings that may arise from website terms.
Most importantly, the court did not decide that CIPA does not apply to website technologies.
The underlying legal questions surrounding Section 631 remain alive.
That distinction matters both legally and editorially.
The story is not that Kevin Cole convinced a federal judge that CIPA website litigation is illegitimate.
The story is that Cole convinced a federal judge that this litigant’s filing history and conduct warranted an extraordinary procedural restriction.
The Court Declined to Require a Bond — For Now
Crain also asked the court to require Shah to post security for costs.
Judge Klausner declined to impose that requirement in the existing action.
But the court specifically left open the possibility that judges reviewing future cases under the prefiling order could require security as a condition of allowing a case to proceed.
That could become important.
The economics of serial litigation often depend on asymmetry: a claimant can prepare and reuse similar allegations relatively cheaply, while every new defendant must hire counsel and incur substantially greater defense costs.
Security requirements can alter that equation by forcing a litigant to put actual money at risk before imposing those costs on another party.
Judge Klausner did not impose that remedy here.
But his order did not take it off the table for future proceedings.
Shah Appeals
The July 20 order did not end the fight.
Four days later, on July 24, 2026, an appeal arising from the Crain litigation was opened in the U.S. Court of Appeals for the Ninth Circuit as Shah v. Crain Communications, Inc., No. 26-4739.
A second appellate docket arising from the same district-court matter, No. 26-5377, was opened on August 20. That docket records an opening brief and a motion by Shah seeking expedited treatment.
The Ninth Circuit declined to fast-track the appeal, according to subsequent reporting on the proceedings. Shah then returned to the district court seeking emergency relief that would pause the vexatious-litigant restriction while appellate proceedings continued.
Judge Klausner denied that ex parte request on August 24.
As of early September 2026, the prefiling order therefore remains in effect while appellate proceedings continue. The Ninth Circuit has not issued a final ruling reversing or affirming Judge Klausner’s vexatious-litigant determination.
That appellate process matters.
Prefiling restrictions implicate access to the courts, and the Ninth Circuit could ultimately examine whether Judge Klausner’s record and tailoring satisfy the demanding standards applicable to vexatious-litigant orders.
Until then, the district court order stands.
The Ruling Arrived During a Broader Backlash Against CIPA Litigation
The timing of Shah v. Crain Communications is difficult to ignore.
Judge Klausner issued the vexatious-litigant order on July 20.
Just over a month later, on August 28, the California Legislature passed SB 690, legislation aimed at another controversial area of CIPA litigation: private Section 638.51 pen-register and trap-and-trace claims involving websites and applications.
Those are separate developments.
The Crain case involves Shah’s litigation conduct and a Section 631 action.
SB 690 principally targets private enforcement of Section 638.51 in the website and app context.
They should not be conflated.
But together, they show growing resistance to litigation models that defendants, lawmakers and now at least one federal judge have concluded can create enormous settlement pressure without necessarily producing adjudication on the merits.
The Legislature is addressing one part of that problem through legislation.
Crain addressed another part by asking a federal court to examine the conduct of a repeat litigant.
This Is Not a License to Ignore a Vivek Shah Demand Letter
Businesses should resist the temptation to read the July 20 ruling too broadly.
A demand letter does not become meaningless because the sender has been declared a vexatious litigant in one federal district.
If a business receives a Shah demand — or a similar CIPA, ECPA, VPPA or state wiretap claim from anyone else — it still needs to investigate the underlying facts.
The most useful immediate steps generally include:
- Preserve the website as it existed when the alleged interaction occurred. Do not make changes and then lose the ability to establish what the site actually did.
- Capture the relevant network traffic. Determine exactly which technologies received information and when.
- Review the claimant’s evidence. Developer-console screenshots can look dramatic without necessarily proving the legal elements of interception.
- Determine whether consent existed before the disputed transmission.
- Identify what information was actually transmitted. An IP address, a generic search term and personally identifiable medical information present very different factual situations.
- Review the claimant’s litigation history. The Crain case makes this substantially more important when dealing with serial plaintiffs.
- Look for previous motions and rulings involving the same legal theory. Another defendant may already have tested the exact allegation.
- Review insurance coverage immediately. Cyber, privacy, media or other policies may contain notice obligations and potentially provide defense coverage.
The choice is not simply “settle or spend $100,000 fighting.”
The first step is understanding what actually happened.
What Kevin Cole’s Strategy Changes for Other Defendants
The Crain ruling does not create a universal defense to CIPA.
What it provides is a blueprint.
When a business receives a complaint from a repeat plaintiff, defense counsel can ask whether the plaintiff’s history contains a pattern relevant to the court’s inherent authority to control abusive litigation.
That means doing considerably more homework at the beginning of a case.
How many similar complaints exist?
How similar are they?
Are specific paragraphs copied?
Are the technical allegations tailored to the actual defendant?
How many cases were voluntarily dismissed?
When were they dismissed?
Did dismissal follow a motion to dismiss?
How many cases resulted in a substantive merits ruling?
Is the plaintiff intentionally creating interactions designed to manufacture jurisdiction or damages?
Is the plaintiff claiming repeated surprise from conduct they actively seek out and understand?
Those questions do not replace the substantive defense.
They add another layer to it.
That is what Cole and Crain did successfully.
The Larger Problem: Settlement Economics Created the Opportunity
It is easy to focus exclusively on Shah.
But the larger story is structural.
Website privacy litigation grew because the economic incentives made it possible.
A demand of $10,000, $20,000 or $50,000 may have little relationship to the theoretical statutory exposure alleged in a CIPA letter.
What matters is that it can be less than the defendant expects to spend litigating.
For a business owner, paying a settlement can therefore be rational even when the business disputes liability.
But each settlement can reinforce the economics of sending the next demand.
Cole addressed this directly after the Crain ruling, explaining that companies often conclude it is simply cheaper to settle than fight.
Crain made the opposite calculation.
And because it did, the result affected more than one lawsuit.
The Most Important Part of the Crain Decision
The headline is that Vivek Shah was declared a vexatious litigant.
The more significant point is how Crain got there.
It did not obtain the order merely by calling Shah a serial plaintiff.
It built a record.
It showed the court the prior cases.
It showed the similarities.
It showed what happened when defendants challenged them.
It showed the court a litigation pattern Judge Klausner ultimately found supported substantive findings of frivolousness and harassment.
That is why this case deserves attention from privacy lawyers, business owners, insurers and anyone dealing with the continuing wave of CIPA demand letters.
For years, the dominant assumption surrounding these claims has been that defense costs create their own settlement pressure.
Shah v. Crain Communications shows what can happen when a defendant decides the plaintiff’s litigation model itself deserves scrutiny.
The order remains narrow. Shah has appealed it. CIPA remains very much alive. Section 631 claims continue. Other plaintiffs remain free to sue. And a legitimate privacy violation does not disappear merely because serial litigation exists elsewhere.
But one thing has changed.
The next company that receives a substantially similar demand from Vivek Shah does not have to evaluate that letter in a vacuum.
There is now a federal court order examining the pattern behind those cases.
There is a record of at least 29 proceedings.
There is a judicial finding of frivolousness and harassment sufficient to support a prefiling restriction.
And there is an example of a defendant that chose to fight rather than simply write a check.
For companies confronting the economics of modern website privacy litigation, that may be the most useful precedent of all.