Are privacy compliance and AI governance poised to remain stand-alone practices within the large enterprise? What is their interplay with an all-encompassing compliance effort? How will we deal with consent in the world of AI Agents?

Erica Irvin is SVP, Commercial and Innovation Law, and Chief Privacy Counsel at Lowe’s Companies, Inc., where she leads legal strategy for commercial operations, privacy, and innovation. With nearly 30 years of in-house experience across retail, tech, and education, she is known for building agile legal teams and shaping ethical approaches to Privacy by Design, AI and digital transformation. Erica is also a frequent speaker and advisor on privacy, data governance, and legal innovation.

References:

• Erica Irvin on LinkedIn
• Linsey Krolik: the growing role of the Product Counsel in privacy and AI compliance (Masters of Privacy, May 2025)
• Gam Dias: Agents Unleashed, understanding the Agentic AI stack (Masters of Privacy, April 2025)

What is “manipulative design”? How does this concept differ from “dark patterns”? How could we expand website and mobile app monitoring to a company’s ad stack? 

Boltive’s Christine Desrosiers has joined us for another Privacy Tech interview. She is an operations and product professional with 20 years of experience building best-in-class publisher ad stacks and ops teams, and integrating ad and site stacks with Privacy Tech. She is involved in a number of industry working groups and advisory boards, working to raise the bar on privacy, security and transparency. 

References:

• Christine Desrosiers on LinkedIn
• Boltive: monitor security and privacy compliance across the consumer front end (including publishing and AdTech)
• Jessica B. Lee, Chair of Loeb & Loeb LLP’s Privacy, Security & Data Innovations practice
• Global Privacy Enforcement Network: 2024 “sweep” on deceptive design patterns
• FTC, ICPEN, GPEN Announce Results of Review of Use of Dark Patterns Affecting Subscription Services, Privacy (FTC, July 2024)
• Bringing Dark Patterns to Light (FTC, September 2022)
• Daniel Solove, A Taxonomy of Privacy (UPenn Law Review, January 2006) - see “decisional interference”
• Website Privacy Controls (New York State Attorney General)
• FTC study finds ‘dark patterns’ used by a majority of subscription apps and websites (TechCrunch, July 2024)
• FTC vs. Amazon (“Roach Motel” pattern through the internally called “Illiad” process for consumers to cancel their Amazon Prime membership)
• California SB 690: A new hope for CIPA litigation overload? (Norton Rose Fulbright)
• Daniel Solove: On Privacy and Technology (Masters of Privacy, March 2025)
• Max Anderson (Ketch): Privacy Tech spotlight I – the future of CMPs, value vs. hype in privacy compliance SaaS (Masters of Privacy, April 2025)
• Daniel Barber (DataGrail): Privacy Tech spotlight II – widespread non-compliance, opt-out challenges, and shadow AI (Masters of Privacy, May 2025)
• Cillian Kieran (Ethyca): Privacy Tech spotlight III – compliance as an engineering challenge (Masters of Privacy, June 2025)
• Vaibhav Antil (Privado): Privacy Tech spotlight IV - from trust to evidence (Masters of Privacy, July 2025)

Could transparency and control requirements be seamlessly integrated within delightful customer journeys? How has a famously design-led company (Airbnb) mastered Privacy User Experience?

Ansuman Acharya serves as a Principal Product Manager at Airbnb, where he leads the design and development of cutting-edge privacy experiences that safeguard the trust of millions across the globe. With a foundation in privacy technology and user-centric design, he artfully bridges engineering depth with ethical product leadership. His 11-year journey at Microsoft, spanning Hyderabad, India and Bellevue, WA shaped his multidisciplinary expertise across enterprise and consumer domains spanning commerce, collaboration/productivity and healthcare tech. Ansuman holds a Master’s from the University of Washington’s Foster School in Information Systems and a Bachelors degree in Computer Science Engineering from NIT Rourkela in India.

References:

• Ansuman Acharya on LinkedIn
• Airbnb: privacy choices
• USENIX Conference on Privacy Engineering Practice and Respect
• Defining Privacy UX (UserTesting)

Will EU cybersecurity laws result in new global standards? Should companies handle NIS2 compliance in concert with GDPR, AI Act, or Data Act requirements? Does it make sense to take data localization to its ultimate consequences?

Nathalie Barrera serves as the Director for Privacy for the EMEA region at Palo Alto Networks, which is a leading provider of cybersecurity solutions. Her expertise involves the company’s compliance with NIS2, the AI Act, the GDPR, and DORA. She also assists customers in navigating their own complex regulatory requirements. She has previously spent seven years at Cisco Systems working as commercial counsel and Privacy and Security Counsel.  She studied law and completed her LLM at the University of Navarra. 

References:

• Nathalie Barrera on LinkedIn
• EU Network and Information Services Directive II
• EU Data Act
• EU Digital Operational Resilience Act (DORA)

How do we move from mere words to actual baked-in privacy? Can built-in alerts, code scanning tools, or server-side auditing make life much easier for DPOs and legal teams? 

We are joined by Vaibhav Antil in a new installment of our Privacy Tech series. Vaibhav is founder & CEO of Privado.ai. Before starting Privado.ai, Vaibhav led product management at a tech company and worked with the legal team on GDPR compliance. Vaibhav started Privado.ai to solve the language gap between legal, privacy, and product engineering teams.

References:

• Vaibhav Antil on LinkedIn
• Privado: Evidence-based Privacy
• Bridge: Technical Privacy Summit (by Privado)
• CNIL: Use analytics on your websites and applications (how analytical cookies can be exempt from consent)
• Max Anderson (Ketch): Privacy Tech spotlight I – the future of CMPs, value vs. hype in privacy compliance SaaS (Masters of Privacy, April 2025)
• Daniel Barber (DataGrail): Privacy Tech spotlight II – widespread non-compliance, opt-out challenges, and shadow AI (Masters of Privacy, May 2025)
• Cillian Kieran (Ethyca): Privacy Tech spotlight III – compliance as an engineering challenge (Masters of Privacy, June 2025)

John Pavolotsky is a partner at Stoel Rives in San Francisco. He is co-chair of the firm's AI, Privacy & Cybersecurity group and focuses his practice on data privacy, information security, and complex technology transactions. He has also been chair of the Intellectual Property Section of the California Lawyers Association. 

John has taught Technology Transactions Law at the UC Davis School of Law and Comparative Privacy Law at the Santa Clara University School of Law. John has also guest lectured on technology and privacy law topics at the University of California, Berkeley, Haas School of Business; the University of San Francisco School of Management; and Stanford University.

References:

• John Pavolotsky on LinkedIn
• John Pavolotksy at Stoel Rives
• Timeline of discussions (House, Senate) leading to a final decision on a 10-year moratorium on state-level AI laws (final deadline: July 4, 2025), Techcrunch
• Texas Legislature Passes House Bill 149 to Regulate AI Use (Nelson Mullins)
• Colorado AI Act
• California Privacy Protection Agency: Draft Automated Decision-making Technology Regulations
• California Gov. Newsom vetoes AI safety bill that divided Silicon Valley (September 2024), NPR
• Poland puts pausing enforcement of the AI Act on EU ministers' table (June 2025, MLex - paywalled)
• A Brief Overview of the Federal Trade Commission's Investigative, Law Enforcement, and Rulemaking Authority (FTC)

Who can really claim to be a privacy engineer? Does this change in the digital marketing arena? What is the winning formula to integrate this role within the company’s privacy practice?

Thomas Ghys has worked as a management consultant, data scientist, and data strategist, including a 5-year stint at McKinsey, prior to setting up his own privacy engineering practice. He has deep expertise in MarTech and AdTech, auditing traditional machine learning models and data flows. He is also the founder and CEO of Webclew, a tool that helps with the auditing of websites and mobile apps.

References:

• Thomas Ghys on LinkedIn
• Webclew: scanning websites and apps for privacy risks
• CNIL: a focus on mobile SDKs, announcing enforcement actions in 2025
• Thomas Ghys: BAPD expectations for cookie compliancy unattainable for most publishers
• Dr. Augustine Fou: dismantling marketing attribution, ad fraud controls, and the business case for third-party cookies (Masters of Privacy, February 2024)

Can we shift the focus from documentation to technical implementation? How can we bridge the cultural differences between legal teams and engineers? What do we mean with open-source data classification?

We are joined by Cillian Kieran, Ethyca’s CEO and founder, in a new installment of our Privacy Tech series. Cillian is a serial entrepreneur and seasoned privacy engineer with two decades of experience leading data-intensive businesses. He combines deep technical expertise with a track record of building and scaling companies, including a global digital agency serving Fortune 500 clients. 

References:

• Fides: the open source language for data privacy
• Cillian Kieran on LinkedIn
• Ethyca
• Max Anderson (Ketch): Privacy Tech spotlight I – the future of CMPs, value vs. hype in privacy compliance SaaS (Masters of Privacy, April 2025)
• Daniel Barber (DataGrail): Privacy Tech spotlight II – widespread non-compliance, opt-out challenges, and shadow AI (Masters of Privacy, May 2025)

It is time for a seasonal update at the intersection of Marketing, Data, Privacy and Technology. We are today covering the first four of our usual five blocks: ePrivacy & regulatory updates; MarTech & AdTech; AI, Competition and Digital Markets; PETs and Zero-Party Data. 

All references and links can be found in this episode’s blog post: Masters of Privacy.

Allow us to thank two people in advance for their routine work in breaking down the news across some of the topics and jurisdictions covered here: Robert Bateman and his Privacy Corner and Federico Marengo with his Privacy and AI newsletter.

Also, an important disclaimer: the voice that joins me today is a text-to-speech output generated with Eleven Labs.

What do we refer to with “privacy metrics”? Are privacy professionals delusional regarding the impact of the discipline in the overall business context?

Lauren Reid is founder of The Privacy Pro, a boutique firm that provides essential training, tools, and support for privacy professionals to turn knowledge into action. In addition to leading The Privacy Pro, Lauren works with executives, boards, and product teams to build privacy data governance strategies that support responsible innovation and prepare companies for investor and regulatory scrutiny. She has a 20-year track record in this space.

References:

• Lauren Reid on LinkedIn
• The Privacy Pro
• Lauren Reid: Rethinking Privacy Metrics: Aligning with Business Strategy