Client Alert: Two Businesses Go on the Offensive Against Vivek Shah’s Nationwide CIPA Demand Letter Campaign

Glaser Weil has been closely tracking Vivek Shah’s mass demand-letter campaign under the California Invasion of Privacy Act (CIPA). Shah has sent hundreds, if not thousands, of templated demand letters and “ready to file” draft complaints to businesses across the country, including many with no meaningful connection to California, alleging that ordinary website analytics tools violate CIPA.

This month, two of Shah’s targets went on the offensive. Both filed their own declaratory judgment actions, and one cites and relies heavily on Shah v. TalentBridge, Inc., No. 2:26-cv-00222-AH-SSCx, 2026 WL 1507888 (C.D. Cal. May 28, 2026), in which Glaser Weil obtained dismissal without leave to amend of a complaint Shah filed against the firm's client, TalentBridge, Inc.

Glaser Weil litigated against Shah and, after a hard-fought battle, prevailed when the federal court in Los Angeles dismissed Shah’s case for lack of Article III standing. This was the first decision of its kind against Shah. Since then, numerous lawyers and companies have relied on the TalentBridge case precedent.

• Lofty Inc. v. Shah was filed July 8, 2026, in the Central District of California (Los Angeles). In the action, Lofty seeks a declaration that its website does not violate CIPA and that Shah lacks standing to sue the company for alleged CIPA violations. Lofty is a real estate technology company serving more than 91,000 customers across over 30,000 websites, all running the same standard analytics configuration Shah is challenging. Rather than litigate letter-by-letter, Lofty is seeking a single ruling that would apply across its platform—a strategy aimed at resolving the issue at scale rather than responding to individual demands.
• Ovadia Law Group, P.A. v. Shah was filed June 26, 2026, in the Southern District of Florida. Ovadia Law Group, a Florida-based law firm, received one of Shah’s demand letters and seeks a declaration that CIPA does not apply to a Florida-only law firm or business with no California contacts. The firm also seeks damages for abuse of process. Ovadia maintains that its website already complies with all applicable privacy laws, including CIPA, and argues that a statute designed to protect California residents has no basis to reach an out-of-state business with no connection to California.

Key Takeaways

• Going on the offensive and filing suit first is a viable, tested option. Lofty and Ovadia both chose to pursue declaratory judgment actions rather than wait to be sued— an aggressive posture that can put a business back in control of the timing and forum. Ovadia has a much higher prospect of success litigating its case in its home-court in Florida than in California.
• The TalentBridge victory has become an influential authority. Glaser Weil secured dismissal without leave to amend in TalentBridge, and the decision is now being relied upon by lawyers and businesses nationwide responding to Shah’s demands. Several of the defenses advanced by Glaser Weil have since been adopted by other litigants, including arguments that Shah is a serial “tester” who intentionally visits websites to generate litigation and that he suffered no actual injury from the collection of search terms or routine website data such as IP addresses and device information.
• Shah’s criminal history has become part of the public record and has been raised in multiple cases. Glaser Weil uncovered and disclosed Shah’s criminal history in its court filings, including prior federal extortion convictions and related criminal proceedings. Other litigants—including Ovadia—have cited that history as evidence of a broader coercive pattern and questionable motives.
• This is a nationwide issue affecting hundreds, if not thousands, of businesses. As demonstrated by Ovadia Law Group, businesses with no California contacts continue to receive demand letters despite having little or no connection to the state.

Glaser Weil is monitoring both actions closely. These cases represent one of the clearest indications yet that businesses are beginning to shift from a defensive posture to a more proactive approach in response to the current wave of CIPA website-tracking claims. The outcomes could have a meaningful impact on litigation strategy, settlement dynamics, and risk assessments for companies operating consumer-facing websites.

If your business has received a demand letter from Shah—or believes it may be a target—please contact a member of Glaser Weil’s litigation team to discuss available options, including the proactive strategies pursued in these recent cases.