CIPA Claim Demand Letters and Litigation

Website privacy litigation is changing quickly, and Marsh McLennan Agency (MMA) has recently seen a spike in California Invasion of Privacy Act (CIPA) claims against clients from pro se “serial litigant” Vivek Shah. His demand letters and lawsuits typically allege that companies’ websites use third‑party tracking technologies that operate like “pen registers” under California law—tools that record or decode routing/addressing/signaling information from electronic communications—often pointing to whether tracking fired before a cookie/consent banner appeared. With statutory damages of $5,000 per violation and multiple trackers potentially triggering multiple “violations,” alleged exposure can escalate rapidly.

This alert provides guidance on how to proceed if you have received correspondence regarding CIPA.