[Enforcement library](/enforcement)

# Shah v. Crain Communications: a pre-filing order for new CIPA suits in one federal district

This page is about the plaintiff side. A federal judge in Los Angeles declared a self-represented CIPA plaintiff a vexatious litigant and limited his new privacy filings in that district. The tracking allegations, search terms sent to four ad and analytics vendors, were never tested.

US District Court, Central District of California · CIPA §631 and the All Writs Act · Pre-filing order, 20 July 2026; on appeal, Ninth Circuit No. 26-4739

## The problem

Vivek Shah, representing himself, alleged that when he searched adage.com, the site's tags sent his exact search terms, including his own name, to Meta, LinkedIn, Chartbeat and Google. He alleged the tags fired before the site's cookie notice could be read and kept firing after he chose "Opt-out" ([FAC ¶¶ 3–5](https://storage.courtlistener.com/recap/gov.uscourts.cacd.1013329/gov.uscourts.cacd.1013329.23.0.pdf)). Crain answered with a motion to dismiss and a motion to restrict his future filings. The court decided only the second. He is not the Vishal Shah of [Shah v. Politico](/enforcement/shah-v-politico) and [Shah v. MyFitnessPal](/enforcement/shah-v-myfitnesspal).

- The problem
- Case record
- What was alleged
- Technical issue
- Timeline
- Outcome
- What it cost
- Why it matters
- How Inth catches this
- Checks for your own systems
- Sources and limits

## Case record

| Fact | Record |
| --- | --- |
| Court | US District Court, Central District of California (Judge R. Gary Klausner) |
| Case number | 2:26-cv-03070-RGK-CTS |
| Parties | Vivek Shah v. Crain Communications, Inc. (publisher of Ad Age) |
| Counsel | Plaintiff: self-represented. Defendant: KJC Law Group, A.P.C. (\[Dkt. 46\](https://storage.courtlistener.com/recap/gov.uscourts.cacd.1013329/gov.uscourts.cacd.1013329.46.0.pdf)) |
| Laws | CIPA §631(a); intrusion upon seclusion; All Writs Act |
| Stage | Case dismissed with prejudice by the plaintiff; pre-filing order on appeal |
| Amount | None. The FAC claimed at least USD 375,000 in controversy; no money changed hands in the record |
| Source review | 17 October 2026 |

## What was alleged

| Claim or motion | Standard | Record | Result |
| --- | --- | --- | --- |
| CIPA §631(a), clauses two and four | Third party reads contents in transit; site aids it | Search URLs \`adage.com/search/?s=…\` sent to facebook.com/tr, px.ads.linkedin.com, ping.chartbeat.net and Google ad endpoints (FAC ¶¶ 29, 35–38); 60 violations at USD 5,000 each (¶¶ 7, 11) | Never decided; motion to dismiss mooted by voluntary dismissal |
| Intrusion upon seclusion | Reasonable expectation of privacy; highly offensive intrusion | Same | Never decided |
| Motion to declare a vexatious litigant (Crain) | Notice, adequate record, findings of frivolousness or harassment, narrow tailoring (\*De Long v. Hennessey\*) | Litigation history from 2021 to 2026 | Granted; security for costs denied (\[Dkt. 34\](https://storage.courtlistener.com/recap/gov.uscourts.cacd.1013329/gov.uscourts.cacd.1013329.34.0.pdf)) |

## Technical issue

These are allegations only; no court tested them.

- **Tools or vendors:** Meta Pixel, LinkedIn Insight Tag, Chartbeat's analytics beacon and Google Publisher Tag requests via DoubleClick (FAC ¶¶ 35–38). The FAC also names X and StackAdapt requests on information and belief (¶ 40).
- **Where:** adage.com search results pages, whose URLs carry the query (`?s=`).
- **What data:** the full results-page URL with the search terms, in Meta's `dl` parameter, LinkedIn's `url` parameter and Chartbeat's page parameter, plus identifiers (¶¶ 35–37).
- **What the notice said:** "By using this site, you agree with our use of cookies. Please see our privacy statement for more information," with "Accept" and "Opt-out" buttons (¶ 46).
- **When:** "the trackers fired the moment each page loaded, before Defendant's cookie banner could even be read," and continued after "Opt-out" (¶ 4).
- **Server-side:** not alleged.
- **How it came to light:** the plaintiff says he used browser developer tools and filtered for his search term; it "matched 33 of 486 requests in one capture" (¶ 39).

**Inth's technical interpretation:** a search page that puts the query in the URL leaks it to every tag that reports the page address. As alleged, the Meta, LinkedIn and Chartbeat requests each carried the full results URL. The same capture the plaintiff made is one an operator can make first, and keep.

Illustrative pattern, not the defendant's code.

```js
// Bad: search state in the URL, page-view tags read location.href
router.push(`/search/?s=${encodeURIComponent(term)}`);
fbq('track', 'PageView');            // sends dl=<full URL with term>
_linkedin_partner_id = 'PARTNER_ID'; // Insight Tag reports the URL too
```

Illustrative pattern, not the defendant's code. Generic consent API, not a c15t call.

```js
// Fixed: query kept off third-party URLs; tags wait for a recorded choice
router.push('/search/', { state: { term } });
if (consent.has('marketing')) fbq('track', 'PageView');
if (consent.has('analytics')) pSUPERFLY.virtualPage({ path: '/search/' }); // Chartbeat SPA call
```

## Timeline

| Date | Event |
| --- | --- |
| 31 October 2025 | Searches on adage.com described in the FAC (¶¶ 30–31) |
| 18 March 2026 | Complaint filed (\[docket\](https://www.courtlistener.com/docket/73121763/vivek-shah-v-crain-communications-inc/)) |
| 1 June 2026 | Crain moves to dismiss and to declare a vexatious litigant |
| 22 June 2026 | First amended complaint; first motion to dismiss denied as moot |
| 20 July 2026 | Vexatious-litigant motion granted (\[Dkt. 34\](https://storage.courtlistener.com/recap/gov.uscourts.cacd.1013329/gov.uscourts.cacd.1013329.34.0.pdf)) |
| 23 July 2026 | Plaintiff dismisses with prejudice and files a notice of appeal |
| 11 August 2026 | Ninth Circuit denies expedited treatment (as stated in \[Dkt. 46\](https://storage.courtlistener.com/recap/gov.uscourts.cacd.1013329/gov.uscourts.cacd.1013329.46.0.pdf)) |
| 24 August 2026 | Crain opposes an ex parte application to stay the order pending appeal; the ruling on it was not available |

## Outcome

The court applied the Ninth Circuit's four *De Long* requirements and found each met. It counted "at least twenty-nine proceedings" the plaintiff initiated from 2021 to 2026, and seven near-identical CIPA complaints in the prior seven months, none of which passed the pleading stage (Dkt. 34, pp. 1–2, 8). It noted that in all but one case he proceeded without a lawyer, which weighs against an order but does not bar one.

It found that his record of seeking out CIPA violations, dismissing cases when defendants moved to dismiss, and never trying a CIPA claim on the merits "strongly indicates that Plaintiff's purpose is to harass defendants into coercive settlements" rather than to seek redress in good faith (p. 9).

**Scope.** The order (1) declares him a vexatious litigant and (2) requires leave before he files any new case in the Central District of California alleging CIPA or related digital privacy claims (pp. 10–11). It does not cover other claims, other districts, state court or arbitration, or cases already pending. The court refused to require security for costs, leaving that to future judges (p. 11). The order is on appeal and may change.

## What it cost

| Item | Record |
| --- | --- |
| Damages or settlement | None; plaintiff dismissed with prejudice |
| Security for costs | Denied |
| Fees or costs | Not stated in the cited record |

## Why it matters

- **Courts look at filing patterns.** Pre-filing orders are an "extreme remedy" in the Ninth Circuit (Dkt. 34, p. 1). This one is limited by subject and district, the narrow form the court said *Molski* allows.
- **The allegations describe a real engineering pattern.** Search terms in URLs reaching ad and analytics vendors also feature in [Rodriguez v. Autotrader](/enforcement/rodriguez-v-autotrader) and [Shah v. MyFitnessPal](/enforcement/shah-v-myfitnesspal). The order does not say the adage.com allegations were false; it did not reach them.
- **Standing and testers.** The court observed the plaintiff "has the means and knowledge to verify" whether a site sends his queries to third parties (p. 9). Compare the tester rulings in [Rodriguez v. Autotrader](/enforcement/rodriguez-v-autotrader).

## How Inth catches this

The question here was the litigant's conduct, so Inth's role is the operator's own evidence for any similar allegation.

- **Website audit:** timestamped observations of which tags loaded on search pages and what domains they reached, by region and consent state, to set against a plaintiff's capture of the same page.
- **Consent banner:** consent records showing whether a visitor chose "Opt-out", in which country and under which policy. After an opt-out, the Consent banner sends the revocation to each integration and stops loading tags that have not loaded yet. Inth's default California policy is opt-out, so tags run until the visitor opts out; holding them until a choice in California needs an opt-in policy, which is a configuration choice.
- **Code audit:** flags a change that puts search terms into a URL read by third-party tags, and keeps the history of when each tag was added.
- **Evidence:** dated runtime records and consent records answer "what did the page send on that day, before and after the choice".

Records show what your site did; they cannot decide whether a claim is brought in good faith, which is for the court.

## Checks for your own systems

### In the repository

- Find search routes that put the query in the path or query string, and the tags that read `location.href`.
- Check the Opt-out handler stops Meta, LinkedIn and analytics beacons as well as future cookies.

### In the browser and network

- Search for a unique test word, filter the network panel for it, and count the third-party matches.
- Repeat after choosing Opt-out, and keep both captures with dates.

### With the people responsible

- When a letter or complaint arrives, compare its dates, pages and captures with your own records for those dates.
- Ask counsel whether any pre-filing order or other court ruling about the sender exists before responding.

## Sources and limits

- [Order of 20 July 2026 (Dkt. 34)](https://storage.courtlistener.com/recap/gov.uscourts.cacd.1013329/gov.uscourts.cacd.1013329.34.0.pdf)
- [First amended complaint, 22 June 2026 (Dkt. 23)](https://storage.courtlistener.com/recap/gov.uscourts.cacd.1013329/gov.uscourts.cacd.1013329.23.0.pdf)
- [Crain's opposition to stay application, 24 August 2026 (Dkt. 46)](https://storage.courtlistener.com/recap/gov.uscourts.cacd.1013329/gov.uscourts.cacd.1013329.46.0.pdf)
- [Docket, 2:26-cv-03070 (CourtListener)](https://www.courtlistener.com/docket/73121763/vivek-shah-v-crain-communications-inc/)

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit Crain Communications, Inc.'s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: [Rodriguez v. Autotrader](/enforcement/rodriguez-v-autotrader) · [Mitchener v. Talkspace](/enforcement/mitchener-v-talkspace) · [Demand letters](/enforcement/demand-letters) · [CIPA §631](/enforcement/laws/cipa-631-wiretapping)