When we published our report The State of Web Privacylast November, our central argument was that privacy risk behaves less like a static compliance checkbox and more like cyber risk.
Just as security teams track attackers by their tradecraft, brokers now need to track the le
gal theories and law firms driving privacy claims so they can better advise their clients. The players change, the tactics evolve, and the potential exposure varies enormously from one actor to the next.
The frequency of privacy rights-related insurance claims in the first half of 2026 has doubled relative to 2025.* Beyond the headline number, there are several underlying trends and developments that may shape how brokers advise clients.
1. Nearly every business is exposed to CIPA
Our original report found that nearly three-quarters of web privacy claims cited the California Invasion of Privacy Act (CIPA), a 1967 wiretapping statute that plaintiffs are increasingly applying to common website tracking technologies like pixels, cookies, and analytics scripts.
See more beautiful photo albums Here >>>
CIPA remains a major claims driver in 2026, far out-numbering allegations related to modern privacy laws like the California Consumer Privacy Act (CCPA) or
California Privacy Rights Act (CPRA), even though these laws were actually designed to address web tracking.
When alleging CIPA violations, plaintiffs often argue that ordinary tracking technologies “intercept” website communications without all-party consent, with each alleged violation carrying $5,000 in statutory damages. Thes
e claims can be asserted even against websites that implemented opt-out mechanisms required by the more modern framework of CCPA.
These claims are also broader geographically than many businesses might expect. CIPA can apply when a California resident interacts with a website, regardless of where the business itself is located. To illustrate how far these lawsuits travel, we saw the first CIPA claims filed by Coalition policyholders in the UK and Australia this year.
Any client with a consumer-facing website that uses common marketing or analytics tools has meaningful exposure, whether they are a Fortune 500 retailer or a regional non-profit.
2. A prolific new (threat) actor: Vivek Shah
One of the clearest signs of how quickly the landscape has changed is the rise of Vivek Shah, a serial pro se litigant who is now the most prolific filer of website privacy complaints.
When we analyzed privacy claims for our 2025 report, we had not received a single Shah-related claim. By mid-2026, Shah outpaced all law firms combined in demand-letter volume, with especially sharp spikes in November 2025 and June 2026.
Shah is scaling up the playbook already deployed by law firms like Tauler Smith and Swigart Law:
Scale: Shah typically sends a short demand letter accompanied by a draft complaint, framed as a request for “informal dispute resolution” of an alleged CIPA violation. The complaints typically follow the same template, changing only small details about the specific nature of the website.
Everyday website tools: Shah focuses on any third-party tool used by the website. A particularly absurd complaint alleged that the loading of a cookie compliance banner without consent was a violation of CIPA (We ask: how can a website collect consent without loading a consent banner?)
Settlement pressure: Shah threatens to file the complaint in state court or, where a website’s terms include an arbitration clause, to compel arbitration. The strategy aims to make a quick, nuisance-value settlement look cheaper and less involved than a fight.