Client Alert: Vivek Shah Continues Pursuing CIPA Claims Through Arbitration—What To Know Now

What’s Happening

Now that Vivek Shah has been designated a vexatious litigant by the Central District of California, Shah has continued filing arbitration demands at full force, and these have been with the assistance of attorneys. This is consistent with what we flagged in our last alert: the vexatious litigant order only reaches new federal complaints in the Central District of California. It does not reach arbitration, and it does not stop Shah from pursuing the same CIPA and digital-privacy theories in that forum.

Why Arbitration Is Now His Venue of Choice

Court filings now carry the added friction of the vexatious litigant order and the credibility findings behind it, and California state courts are increasingly skeptical of CIPA pen-register theories as applied to modern website tools. Arbitration offers an alternative, and many companies’ own terms of service unintentionally hand Shah the forum: a broad arbitration clause that doesn’t carve out or exclude privacy claims (including CIPA). Arbitrations happen behind closed doors and the probability of getting wildly disparate rulings from different arbitrators is high. He can also apply for fee waivers or to impose all of the arbitration costs onto the companies he sues.

What This Means For Your Business

• Review your Terms of Service and any arbitration provisions now, before a demand arrives. If your terms of service include an arbitration clause, check whether it excludes privacy or statutory claims. A clause that is silent on CIPA, or that broadly covers “any dispute,” may be read to require arbitration of these claims—effectively opening the door for Shah’s arbitration demands.
• Understand the tradeoffs. An arbitration clause without a CIPA carve-out can cut both ways: it may keep you out of court, but it can also make your business a more attractive target for litigants like Shah, since arbitration may face less resistance than his prior court strategy.
• Keep your website compliance work going. The most durable protection remains sound data-collection and consent practices—clear privacy disclosures and functioning consent mechanisms to obtain consent prior to the firing of any non-essential cookies, pixels, chat and session-replay tools—regardless of which forum Shah or others like him choose. Speak with us about a sound compliance strategy before implementing updates.

If You Hear From Him, Let Us Know

If your business receives a demand letter, arbitration demand or any communication from Vivek Shah, please reach out to us before responding or updating your website. We are tracking his activity closely across venues and can help you evaluate your arbitration provisions, assess your exposure and determine the most effective response.