Pro Se Litigant Fuels Surge in California Privacy Lawsuits Over Web Analytics
Vivek Shah, a pro se litigant, has filed hundreds of California privacy lawsuits over website analytics use.
Why it matters: This surge increases legal risk for website operators under the California Invasion of Privacy Act (CIPA). In-house counsel must reassess compliance and litigation strategies to manage potential claims.
- Vivek Shah has filed over 1,000 pro se lawsuits alleging violations of the California Invasion of Privacy Act (CIPA) involving analytics tools like Google Analytics.
- Lofty sued Shah on July 8, 2026, seeking declaratory relief on its compliance with CIPA and launched a CIPA Defense Program on July 9, 2026.
- From 2023 to 2026, nearly 2,000 CIPA cases were filed in California state courts, with five law firms dominating filings since 2024.
- CIPA violations carry $5,000 statutory damages per incident; settlements typically range from $5,000 to $15,000.
The California Invasion of Privacy Act (CIPA), specifically Section 638.51, prohibits unlawful interception and use of electronic communications. Recently, this law has driven a sharp rise in litigation targeting website operators using web analytics tools.
At the center is Vivek Shah, a pro se litigant who has filed more than 1,000 lawsuits alleging that analytics platforms like Google Analytics transmit user data without proper consent required by CIPA. Shah’s filings, publicly docketed in California state courts, claim these practices violate users’ privacy rights under the law. Their focus on lack of explicit consent raises novel legal questions about standard data collection on websites.
On July 8, 2026, Lofty, a proptech company supporting over 30,000 websites and 91,000 real estate professionals, filed a declaratory judgment action against Shah in California state court. Lofty sought judicial affirmation that its analytics use complies with CIPA. The following day, Lofty launched its CIPA Defense Program to support clients facing similar lawsuits by providing legal assistance and strategic guidance.
Data from the California state court system shows that nearly 2,000 CIPA lawsuits were filed between 2023 and 2026, mostly in state courts, with an additional 250 in federal courts. About 40% of defendants are retail businesses. Since January 2024, five law firms have filed a majority of these cases, but Shah’s pro se filings constitute a significant recent increase.
CIPA allows up to $5,000 in statutory damages per violation, with settlements often ranging from $5,000 to $15,000. Legal experts note ongoing uncertainty about how CIPA applies to website analytics, which creates compliance challenges and exposure to legal risks for companies. Lofty and other defendants advocate for defenses focused on dismissal rather than settlement.
For additional context, the Law360 report on CIPA analytics litigation provides an independent legal analysis of these developments, discussing the broader implications for website operators and privacy compliance.
By the numbers:
- 1,000+ — lawsuits filed by pro se litigant Vivek Shah alleging CIPA violations
- 2,000 — total CIPA cases filed in California state courts from 2023 to 2026
- $5,000 — statutory damages per CIPA violation
Yes, but: While the surge in pro se filings raises concern, many cases may face procedural hurdles due to limited legal representation and evolving interpretations of CIPA's application to web analytics.
What's next: Courts are expected to issue rulings on several key cases in late 2026, which could clarify CIPA’s standards for web analytics and influence future litigation trends.