Vivek Shah’s lawsuits fall into two very different chapters. In the first, he was the defendant: a federal extortion case that sent him to prison for more than seven years after he threatened to kill the family members of billionaires unless they wired him money. In the second, he is the plaintiff, running a nationwide campaign of demand letters and lawsuits that accuse businesses of violating California’s Invasion of Privacy Act (CIPA) through routine website tracking tools.1https://www.justice.gov/
Who Vivek Shah Is
Shah is a California-based serial pro se litigant. Before he started suing companies, he was prosecuted by them, or rather by the federal government on behalf of his victims.
In the summer of 2012, Shah, then 25, mailed letters labeled “Extortion Notice” to seven wealthy individuals, naming specific family members he threatened to kill unless the recipients wired money to offshore accounts. The demands totaled more than $122 million. His targets included oil heiress Dannine Avara ($35 million), Buffalo Sabres owner Terry Pegula ($34 million), Groupon co-founder Eric Lefkofsky ($16 million), coal magnate Chris Cline ($13 million), Relativity Media founder Ryan Kavanaugh ($11.3 million), Playtone owner Gary Goetzman ($9.6 million), and film executive Harvey Weinstein ($4 million).
Shah worked hard to hide his identity. He used aliases, opened fraudulent financial accounts in his victims’ names, made purchases with prepaid debit cards, connected through public Wi-Fi, altered his network card addresses, routed communications through identity-masking servers, and set up U.S. Postal Service accounts under false names. Federal authorities alleged he sought handgun training in the days before his arrest.
FBI agents arrested him on August 10, 2012, near his parents’ home in Schaumburg, Illinois. A federal grand jury in West Virginia indicted him, and in May 2013 he pleaded guilty to one count of transmitting a threat with intent to extort and seven counts of mailing threatening communications. He was sentenced on September 11, 2013, to 87 months in federal prison followed by three years of supervised release. A January 2019 court order shows he was in a Chicago halfway house with a release date of February 4, 2019, after a court denied his emergency motion for immediate release under the First Step Act.
The CIPA Demand Letter Campaign
Beginning in 2024, Shah launched what has become his most prolific form of litigation. He sends pre-litigation demand letters to businesses across the country accusing them of violating California Penal Code Section 631(a) by allowing website search bars and input forms to transmit user-entered content to third-party services such as Google, Meta, and HubSpot before the user consents. One analysis described him as having sent “hundreds” of these letters.
His method is repeatable. Shah visits a company’s website, types his name into a search bar or form field, and uses browser developer tools to capture network traffic showing that text being sent to outside domains. Each demand packet goes to the company’s registered agent for service and contains a cover letter proposing “Informal Dispute Resolution,” a draft complaint prepared for the Los Angeles Superior Court, and screenshots of the captured transmissions. He demands $5,000 per violation under CIPA’s statutory damages provision and treats each third-party recipient as a separate violation, which often pushes total demands to roughly $50,000 per letter.
The legal theory is that search queries are protected “contents” of a communication rather than mere metadata, and that transmitting them to third-party trackers amounts to a “digital wiretap.” Shah frequently cites the Ninth Circuit’s decision in Javier v. Assurance IQ, LLC (2022) for the argument that retroactive consent through privacy policies or cookie banners does not count, because consent must come before any data moves. He also relies on Heerde v. Learfield Communications (2024), a California federal ruling that treated search terms as protected “contents” under CIPA.
Filed CIPA Lawsuits and Their Outcomes
Not every demand letter turns into a filed case, but Shah has brought suits in both state and federal courts. Three with identifiable outcomes give a sense of how his cases have gone.
Shah v. Mondelez Global LLC
Shah filed this action in Los Angeles Superior Court on September 10, 2024. Mondelez removed it to the Central District of California, where it was assigned to District Judge Andre Birotte Jr. The parties filed a joint stipulation of dismissal with prejudice on July 9, 2025, a resolution consistent with a confidential settlement.
Shah v. The Harvard Drug Group LLC
Also filed in Los Angeles Superior Court, on September 19, 2024, and removed to the Central District of California. Judge Maame Ewusi-Mensah Frimpong granted The Harvard Drug Group’s motion to dismiss and entered judgment against Shah without leave to amend on April 17, 2025.
Shah v. Card Delivery LLC
Filed in the Central District of California on September 9, 2025, and assigned to Judge John F. Walter. Shah personally served the defendant’s owner in early November, but filed a notice of voluntary dismissal with prejudice on November 22, 2025, before any substantive motion practice.
Legal commentary in December 2025 noted that despite Shah’s threats to file in Los Angeles Superior Court, there was no evidence at that point that he had filed the specific state court lawsuits threatened in his letters, though defendants had removed several of his filings to federal court. By April 2026, commentary confirmed that the campaign had expanded into both state and federal forums.
Earlier Post-Prison Lawsuits
Before the CIPA campaign, Shah tried civil litigation on two other fronts, and lost both.
In Shah v. N.Y.P. Holdings, Inc., filed in the Northern District of Illinois, he sued the New York Post’s publisher and other news outlets, claiming he owned the copyrights to photographs of himself posing with celebrities like Tom Cruise, Angelina Jolie, and Zach Galifianakis that the outlets had run after his arrest. He argued that friends or bystanders had taken the pictures using his camera at his direction. In January 2023, an Illinois federal judge dismissed the case, ruling that under the Copyright Act the author is the person who actually creates the work, and because third parties operated the camera, Shah was not the author. The court also rejected his joint-authorship and “operation of law” theories. The Seventh Circuit affirmed in August 2024.
In Shah v. Blueground US, Inc., filed in the Central District of California, Shah accused a furnished apartment rental company of discriminating against him based on his criminal record. District Judge George H. Wu dismissed the case in September 2023 for lack of subject matter jurisdiction, finding Shah had not established diversity jurisdiction. The Ninth Circuit affirmed in a memorandum opinion in January 2025.
How Businesses Are Responding
Companies that receive one of Shah’s letters face real settlement pressure, because CIPA’s $5,000-per-violation damages and the cost of defense often make a modest payment cheaper than a fight. Legal commentators have suggested a handful of responses: implementing granular consent mechanisms that block non-essential scripts until a user opts in, auditing the site using the same developer tools Shah uses, and challenging whether the captured data was actually “in transit” as the statute requires. Some defendants have raised personal jurisdiction defenses, arguing that an out-of-state company with a passive website lacks the California contacts needed to be sued there.
Court outcomes on the underlying theory have been inconsistent. Some California state courts have dismissed CIPA claims over IP-address collection on the grounds that users lack a reasonable expectation of privacy in their IP addresses and that tracking scripts are not “pen registers.” In Sanchez v. Cars.com, Inc., a Los Angeles Superior Court held that CIPA Section 638.51 applies to telephone tracking, not internet communications. In Rodriguez v. Fountain9, Inc., another state court ruled that collecting an IP address alone gives “no information about the user” and cannot support a concrete injury. Federal courts have split, with some allowing similar claims to proceed and others dismissing suits brought by statutory testers.
The Legislative Response
California lawmakers have taken notice of the broader CIPA wave that Shah’s letters are part of. State Senator Anna Caballero authored SB 690, which would create a “commercial business purpose” exemption covering common tracking tools like cookies, pixels, and chatbots, effectively removing the CIPA private right of action for standard website analytics. The bill passed the state Senate unanimously, 32-0. An original retroactivity clause that would have reached pending cases was stripped in May 2025 after opposition from privacy advocates. SB 690 then stalled in the Assembly Judiciary process and was designated a “two-year bill,” meaning it did not become law in 2025 but remains eligible for reconsideration in the 2026 session. The deadline for passage is August 31, 2026. Whether it clears the Assembly will shape how long Shah’s business model, and others like it, remain viable.