California SB 690, the Vivek Shah Ruling, and Website Privacy Lawsuits
Two things happened in California in 2026 that affect the wave of website privacy lawsuits known as CIPA cases. A new law, SB 690, narrowed one popular type of claim. And a federal court shut down one of the most active plaintiffs, Vivek Shah. Here is a simple guide to both, and why they are good news but not a reason to relax.
What SB 690 Does
SB 690 takes away one specific weapon. It removes the right of private individuals to sue websites and apps under CIPA’s “pen register / trap-and-trace” theory (Penal Code section 638.51). That theory was popular because it was easy to plead and hard to defend.
Only the California Attorney General can now bring that type of claim against a website or app. Private plaintiffs cannot.
It applies backward, too. It reaches pen-register lawsuits filed on or after January 1, 2025, so many pending cases can be dismissed.
The law passed the Legislature by a unanimous vote and is set to take effect January 1, 2027.
What SB 690 Does NOT Do
This is the part that matters most. SB 690 is narrow. It does not repeal CIPA, and it does not end website privacy lawsuits.
The main wiretapping and eavesdropping claims survive. Private plaintiffs can still sue under CIPA sections 631 and 632. Lawyers are expected to simply refile the same website-tracking claims under those sections instead.
It does not touch federal or other state laws. Claims under the federal Wiretap Act, the Video Privacy Protection Act, and other states’ wiretap laws are unaffected.
It does not spell out what counts as illegal tracking. Courts still have to decide that case by case.
The Vivek Shah Ruling
Vivek Shah was one of the most active CIPA filers. He sent demand letters and filed many near-identical lawsuits against businesses. On July 20, 2026, a federal court (the U.S. District Court for the Central District of California) declared him a “vexatious litigant.”
That label has teeth. The court found that Shah’s goal was to pressure companies into settlements, not to win cases on the merits. The record showed more than 29 cases since 2021, including seven look-alike CIPA suits against seven different companies in just seven months. His total recovery across all of it was a single $3,000 award. Going forward, he must get a judge’s permission before filing any new CIPA-type case in that court.
Why You Can Push Back on Shah, But Not Relax on CIPA
These two events are easy to mix up. Here is the key difference.
The Shah order is about one person, in one court. It is a gatekeeping order against Shah personally. It did not change the law. A demand letter from Shah now carries very little weight: there is a public court finding that his conduct was abusive, and he cannot easily file suit. In most cases, a Shah letter can be handled firmly with your lawyer instead of paid off.
CIPA itself is unchanged. Shah is not the only plaintiff. Other individuals and their attorneys can still send demand letters and file lawsuits. And SB 690 closed only one theory, not the whole statute.
The wave continues in a new shape. Expect the same website-tracking claims to come back under sections 631 and 632. Do not let one neutralized plaintiff create a false sense that the risk is gone.
What This Means for You
Know what is running on your website. Make a list of every tracking tool: chat, session replay, analytics, and ad pixels.
Get consent and disclose it clearly. Use a compliant cookie and consent banner, keep your privacy policy current, and confirm your vendor contracts are in order.
Do not panic-settle. Have a lawyer review any demand letter before you respond or pay, especially from a known serial filer.
Treat SB 690 as real but limited relief. It removes one common claim. It does not make website privacy compliance optional.
