In prior legal alerts (June 2026 and December 2025), we have described a rapid increase in class action privacy suits based on website tracking without consent. There is now, however, growing judicial and legislative concern with website lawsuits perceived as abusive or designed primarily to extract settlements rather than remedy genuine consumer harm. To help stem these cases:
- One federal court in California recently imposed filing requirements on serial claimant Vivek Shah.
- A new Missouri law seeks to reduce abusive suits against operators of websites allegedly lacking in ADA accommodation features.
- The California legislature is moving toward limitations on CIPA “trap-and-trace” lawsuits against website operators.
Federal Court Declares Vivek Shah a Vexatious Litigant
On July 20, 2026, a federal court entered an order requiring Vivek Shah, one of the more active CIPA trap-and-trace plaintiffs, to obtain court permission before filing similar lawsuits.
The judge in the Central District of California found that Shah qualified as a vexatious litigant based on patterns in 29 suits filed since 2021, and in seven identical CIPA suits in 2026 alone. The court found his suits appeared intended primarily to pressure defendants into settlements. He can still file such suits, but the court must approve them first.
Despite this action limiting one litigant, CIPA lawsuits against companies across the country continue to fill the dockets of federal and state courts in California. These cases are not typically brought by pro se litigants like Mr. Shah, but rather by law firms such as Pacific Trial Attorneys, Manning Law, Mou Law, Tauler Smith and others.
Missouri Targets Abusive ADA Website Litigation
The Missouri “Act Against Abusive Website Access Litigation” becomes effective on August 28, 2026. It will allow Missouri businesses sued for website accessibility deficiencies to bring their own suits alleging “abusive litigation.” The Missouri Attorney General will also be empowered to bring such suits.
To determine whether a lawsuit is “abusive,” courts may consider factors such as:
- the number of substantially similar lawsuits;
- the notice and/or cure opportunity before suit;
- the nature of settlement demands;
- any history of sanctions or bad-faith conduct; and
- whether the litigation appears designed primarily to obtain payment based on defense costs rather than to improve accessibility
The act also protects defendants in website accessibility suits who have undertaken remediation efforts in good faith after receiving notice. If your business has undertaken efforts to make its website more accessible, you should document and continue them.
Proposed California Senate Bill 690 Would Limit CIPA Lawsuits
California is considering legislation to limit CIPA claims for the collection of the metadata of a website visit under the California Invasion of Privacy Act (CIPA). See CIPA § 638.50 (pen register) and § 638.51 (trap-and-trace).
Such legislation has been debated in prior sessions, but there is a growing expectation that this time the law may pass and Governor Gavin Newsom may sign it. As currently amended in July, SB 690 would:
- Bar private actions against private actors for Section 638.51 claims alleged to arise from conduct on an internet website, online application or mobile application.
- Reserve those covered Section 638.51 actions to enforcement by the California Attorney General.
- Only apply to data collection on websites, online applications and mobile apps.
- Retroactively impact filed claims looking back two years.
SB 690 does not remove CIPA exposure from risk analysis. The claims targeted by the bill focus on alleged use of a pen register or trap-and-trace device under Section 638.51. Section 638.50 defines those technologies by reference to dialing, routing, addressing or signaling information, and expressly excludes the contents of a communication.
Expect plaintiffs to reframe such data as the “contents” of a communication and their claims as straight CIPA “wiretapping” violations, which remain unaffected by SB 690. Even if enacted, SB 690 should be treated as a significant narrowing of one category of website and app tracking claims, not as a complete defense to CIPA exposure.
Key Takeaways
- Courts and state legislatures are trying to reduce nuisance website litigation, while allowing valid consumer claims to go forward.
- Businesses should continue efforts to reduce liability for their websites, especially for inaccessibility and improper data collection.
- Organizations should be aware that new hurdles and defenses may exist for those who have been blanketing demands on website operators.
If you have questions about CIPA and its risks for your business, please contact Tedrick Housh, Chiara Portner or Alexandra Bass, or your regular Lathrop GPM attorney.