The Web Privacy Podcast Transistor (https://transistor.fm) https://feeds.transistor.fm/the-web-privacy-podcast Most companies trust their website. They shouldn't. The leaders who know better are rebuilding what it means to govern a website, and every week we sit down with privacy executives, compliance teams, and digital risk pros at the world's largest enterprises. We dive into stories with the ones who caught a broken consent tool before the regulator did, traced a six-figure loss back to a failed tracking pixel, and rebuilt their entire data governance approach from scratch. The rules of digital trust are being rewritten right now. This show is where you hear it first. Brought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it. https://www.observepoint.com/ © 2026 ObservePoint 6cbc8634-4a2b-54bd-ad7c-096bba4d829f yes en Sat, 19 Sep 2026 04:55:43 -0600 Sat, 19 Sep 2026 04:56:12 -0600 https://www.observepoint.com/ https://img.transistorcdn.com/jBiiNg1YNbrNBsaOVaDLWf7aqqPEZFplTj2MdPAm2Uc/rs:fill:0:0:1/w:1400/h:1400/q:60/mb:500000/aHR0cHM6Ly9pbWct/dXBsb2FkLXByb2R1/Y3Rpb24udHJhbnNp/c3Rvci5mbS81MWZh/MzBiODVkMTA2OTE3/NmVlYWRlZDM1MWE1/MmUwZS5qcGc.jpg The Web Privacy Podcast https://www.observepoint.com/ episodic ObservePoint Most companies trust their website. They shouldn't. The leaders who know better are rebuilding what it means to govern a website, and every week we sit down with privacy executives, compliance teams, and digital risk pros at the world's largest enterprises. We dive into stories with the ones who caught a broken consent tool before the regulator did, traced a six-figure loss back to a failed tracking pixel, and rebuilt their entire data governance approach from scratch. The rules of digital trust are being rewritten right now. This show is where you hear it first. Brought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it. https://www.observepoint.com/ Most companies trust their website. web privacy,consent management,tag governance,website governance,data privacy,privacy compliance,GDPR,CCPA,cookie consent,tracking pixels,chief privacy officer,digital risk,data governance,privacy regulations Tanner Green tanner@executivemedianetwork.com No No From compliance to strategy with Fenwick & West 6 6 From compliance to strategy with Fenwick & West full ef8816e0-77a1-4055-88ec-fe669a7d0a77 https://share.transistor.fm/s/f7c36945 Summary
What happens to a privacy program after it declares itself ready for GDPR? According to Marcus Morissette, a privacy lawyer at Fenwick & West who was a CIPP before there were slashes, most of them stop evolving. Host Ethan Prete sits down with Marcus to unpack privacy 2.0, where compliance is table stakes and the real job is getting the business to its goals inside the company's risk appetite. Marcus explains why he told his eBay team never to say no and never to say yes, why the enforcement everyone feared turned out to be security's problem, and why the next generation of privacy lawyers has to understand the technology, from hashing versus encryption to the fact that no US law contains the word cookie. He also walks through Maslow's hierarchy of data, the four-layer pyramid he built with Aaron Weller at Concise Consulting, and why a company still worried about the CIA of its data isn't ready for AI governance. Along the way: the CIPA consent banner trap, an AI drone use case that sounds like science fiction, hiring for business acumen over law degrees, and how to make a company regulator-proof. Essential listening for privacy professionals, marketers, and anyone deciding where privacy should sit in the org.

Chapters
00:00 Introduction
02:35 Doing privacy before privacy existed
05:45 Why marketers should own privacy
08:10 How GDPR built programs that stalled
10:45 Privacy 2.0 is business enablement
12:30 The hashing versus encryption test
13:15 No US law regulates cookies
14:30 The CIPA consent banner trap
19:50 Maslow's hierarchy of data
24:15 What AI governance actually means
28:15 Building and funding a privacy team
34:15 Predictions for the next three years
37:30 Making your program regulator-proof

Takeaways

-Compliance is table stakes, not the finish line. Privacy 2.0 is business enablement: getting the business to its outcome inside the company's chosen risk appetite.

-Privacy teams are guidance, not decision-makers. Never say no and never say yes; act as a risk Sherpa who presents the upside and downside so the business can decide.

-The renaissance privacy lawyer has to know the technology. If you can't explain hashing versus encryption or follow the ad tech spaghetti diagram, you can't advise your business through it.

-No US law regulates cookies by name; they are regulated as a sale because regulators didn't understand the tech, and consent banners deployed where they weren't required have become CIPA litigation bait.

-Maslow's hierarchy of data runs security, privacy, information governance, then AI governance. A company still worried about the confidentiality, integrity, and availability of its data is not ready for an AI governance conversation.

Connect with the Guest
LinkedIn: https://www.linkedin.com/in/mmorissette/
Website: https://www.fenwick.com

Sponsor
Brought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it.

Learn more about your website here

]]> Summary
What happens to a privacy program after it declares itself ready for GDPR? According to Marcus Morissette, a privacy lawyer at Fenwick & West who was a CIPP before there were slashes, most of them stop evolving. Host Ethan Prete sits down with Marcus to unpack privacy 2.0, where compliance is table stakes and the real job is getting the business to its goals inside the company's risk appetite. Marcus explains why he told his eBay team never to say no and never to say yes, why the enforcement everyone feared turned out to be security's problem, and why the next generation of privacy lawyers has to understand the technology, from hashing versus encryption to the fact that no US law contains the word cookie. He also walks through Maslow's hierarchy of data, the four-layer pyramid he built with Aaron Weller at Concise Consulting, and why a company still worried about the CIA of its data isn't ready for AI governance. Along the way: the CIPA consent banner trap, an AI drone use case that sounds like science fiction, hiring for business acumen over law degrees, and how to make a company regulator-proof. Essential listening for privacy professionals, marketers, and anyone deciding where privacy should sit in the org.

Chapters
00:00 Introduction
02:35 Doing privacy before privacy existed
05:45 Why marketers should own privacy
08:10 How GDPR built programs that stalled
10:45 Privacy 2.0 is business enablement
12:30 The hashing versus encryption test
13:15 No US law regulates cookies
14:30 The CIPA consent banner trap
19:50 Maslow's hierarchy of data
24:15 What AI governance actually means
28:15 Building and funding a privacy team
34:15 Predictions for the next three years
37:30 Making your program regulator-proof

Takeaways

-Compliance is table stakes, not the finish line. Privacy 2.0 is business enablement: getting the business to its outcome inside the company's chosen risk appetite.

-Privacy teams are guidance, not decision-makers. Never say no and never say yes; act as a risk Sherpa who presents the upside and downside so the business can decide.

-The renaissance privacy lawyer has to know the technology. If you can't explain hashing versus encryption or follow the ad tech spaghetti diagram, you can't advise your business through it.

-No US law regulates cookies by name; they are regulated as a sale because regulators didn't understand the tech, and consent banners deployed where they weren't required have become CIPA litigation bait.

-Maslow's hierarchy of data runs security, privacy, information governance, then AI governance. A company still worried about the confidentiality, integrity, and availability of its data is not ready for an AI governance conversation.

Connect with the Guest
LinkedIn: https://www.linkedin.com/in/mmorissette/
Website: https://www.fenwick.com

Sponsor
Brought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it.

Learn more about your website here

]]> Tue, 15 Sep 2026 04:30:00 -0600 ObservePoint ObservePoint 2626 Summary
What happens to a privacy program after it declares itself ready for GDPR? According to Marcus Morissette, a privacy lawyer at Fenwick & West who was a CIPP before there were slashes, most of them stop evolving. Host Ethan Prete sits down with Marcus to unpack privacy 2.0, where compliance is table stakes and the real job is getting the business to its goals inside the company's risk appetite. Marcus explains why he told his eBay team never to say no and never to say yes, why the enforcement everyone feared turned out to be security's problem, and why the next generation of privacy lawyers has to understand the technology, from hashing versus encryption to the fact that no US law contains the word cookie. He also walks through Maslow's hierarchy of data, the four-layer pyramid he built with Aaron Weller at Concise Consulting, and why a company still worried about the CIA of its data isn't ready for AI governance. Along the way: the CIPA consent banner trap, an AI drone use case that sounds like science fiction, hiring for business acumen over law degrees, and how to make a company regulator-proof. Essential listening for privacy professionals, marketers, and anyone deciding where privacy should sit in the org.

Chapters
00:00 Introduction
02:35 Doing privacy before privacy existed
05:45 Why marketers should own privacy
08:10 How GDPR built programs that stalled
10:45 Privacy 2.0 is business enablement
12:30 The hashing versus encryption test
13:15 No US law regulates cookies
14:30 The CIPA consent banner trap
19:50 Maslow's hierarchy of data
24:15 What AI governance actually means
28:15 Building and funding a privacy team
34:15 Predictions for the next three years
37:30 Making your program regulator-proof

Takeaways

-Compliance is table stakes, not the finish line. Privacy 2.0 is business enablement: getting the business to its outcome inside the company's chosen risk appetite.

-Privacy teams are guidance, not decision-makers. Never say no and never say yes; act as a risk Sherpa who presents the upside and downside so the business can decide.

-The renaissance privacy lawyer has to know the technology. If you can't explain hashing versus encryption or follow the ad tech spaghetti diagram, you can't advise your business through it.

-No US law regulates cookies by name; they are regulated as a sale because regulators didn't understand the tech, and consent banners deployed where they weren't required have become CIPA litigation bait.

-Maslow's hierarchy of data runs security, privacy, information governance, then AI governance. A company still worried about the confidentiality, integrity, and availability of its data is not ready for an AI governance conversation.

Connect with the Guest
LinkedIn: https://www.linkedin.com/in/mmorissette/
Website: https://www.fenwick.com

Sponsor
Brought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it.

Learn more about your website here

]]> web privacy,privacy compliance,privacy program maturity,gdpr readiness,ccpa compliance,cookie consent banner,cipa lawsuits,privacy lawyer,privacy by design,risk based privacy,business enablement,information governance,AI governance,data governance framework,privacy tech,martech compliance,privacy strategy,state privacy laws,dsar automation,privacy leadership No Privacy Is a Team Sport: Pari Sarnot, Privacy, Risk & Governance Leader 5 5 Privacy Is a Team Sport: Pari Sarnot, Privacy, Risk & Governance Leader full bea33efa-8c35-4470-8d8c-f8b480eb59b2 https://share.transistor.fm/s/44627d03 Summary
What do you do when privacy rights create a challenge your existing process was never designed to handle? Host Ethan Prete sits down with Pari Sarnot, a Privacy, Risk & Governance Leader with experience across organizations including Meta, Grant Thornton, eBay, and Microsoft, as well as an IAPP instructor and mentor. Pari shares an example from her broader professional experience involving a growing volume of GDPR access requests for customer service call recordings, and the privacy, operational, employee, and governance considerations that followed. She walks through how a cross-functional team evaluated multiple options and ultimately aligned the retention period more closely with the underlying business needs. Pari also discusses her approach to structured decision-making, why privacy is a team sport, the importance of cross-functional relationships, using metrics to anticipate operational challenges, and considerations around AI transparency and governance.

Chapters

00:00 Introduction

02:15 A pragmatic, risk based approach to privacy

04:30 Falling into privacy at Microsoft

06:15 Navigating call recording access requests

09:45 Responding to growing request volumes

12:30 Five options on the table

14:45 Rethinking the retention period

17:15 Privacy is a team sport

22:15 Metrics that spot the crisis early

29:00 AI transparency and model drift

31:45 Outcomes and final advice

Takeaways

-Retaining data without a continuing business need can introduce additional privacy, security, operational, and governance risk; aligning retention with legitimate business needs can help reduce that burden.

-When navigating a complex privacy issue, start by understanding the underlying business objective, then evaluate potential approaches against factors such as risk, applicable requirements, resources, operational impact, and customer expectations.

-Privacy is a team sport, and strong cross-functional relationships require continuous investment, not only engagement when an issue arises.

-Track privacy metrics and request-volume trends to identify emerging capacity and operational challenges early.

-Document key decisions, including the options considered, associated risks, rationale, and relevant sign-offs, so the reasoning remains clear over time.


Connect with the Guest
LinkedIn: https://www.linkedin.com/in/pari-sarnot/


Sponsor
Brought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it.

Learn more about your website here

]]> Summary
What do you do when privacy rights create a challenge your existing process was never designed to handle? Host Ethan Prete sits down with Pari Sarnot, a Privacy, Risk & Governance Leader with experience across organizations including Meta, Grant Thornton, eBay, and Microsoft, as well as an IAPP instructor and mentor. Pari shares an example from her broader professional experience involving a growing volume of GDPR access requests for customer service call recordings, and the privacy, operational, employee, and governance considerations that followed. She walks through how a cross-functional team evaluated multiple options and ultimately aligned the retention period more closely with the underlying business needs. Pari also discusses her approach to structured decision-making, why privacy is a team sport, the importance of cross-functional relationships, using metrics to anticipate operational challenges, and considerations around AI transparency and governance.

Chapters

00:00 Introduction

02:15 A pragmatic, risk based approach to privacy

04:30 Falling into privacy at Microsoft

06:15 Navigating call recording access requests

09:45 Responding to growing request volumes

12:30 Five options on the table

14:45 Rethinking the retention period

17:15 Privacy is a team sport

22:15 Metrics that spot the crisis early

29:00 AI transparency and model drift

31:45 Outcomes and final advice

Takeaways

-Retaining data without a continuing business need can introduce additional privacy, security, operational, and governance risk; aligning retention with legitimate business needs can help reduce that burden.

-When navigating a complex privacy issue, start by understanding the underlying business objective, then evaluate potential approaches against factors such as risk, applicable requirements, resources, operational impact, and customer expectations.

-Privacy is a team sport, and strong cross-functional relationships require continuous investment, not only engagement when an issue arises.

-Track privacy metrics and request-volume trends to identify emerging capacity and operational challenges early.

-Document key decisions, including the options considered, associated risks, rationale, and relevant sign-offs, so the reasoning remains clear over time.


Connect with the Guest
LinkedIn: https://www.linkedin.com/in/pari-sarnot/


Sponsor
Brought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it.

Learn more about your website here

]]> Tue, 08 Sep 2026 05:37:00 -0600 ObservePoint ObservePoint 2032 Summary
What do you do when privacy rights create a challenge your existing process was never designed to handle? Host Ethan Prete sits down with Pari Sarnot, a Privacy, Risk & Governance Leader with experience across organizations including Meta, Grant Thornton, eBay, and Microsoft, as well as an IAPP instructor and mentor. Pari shares an example from her broader professional experience involving a growing volume of GDPR access requests for customer service call recordings, and the privacy, operational, employee, and governance considerations that followed. She walks through how a cross-functional team evaluated multiple options and ultimately aligned the retention period more closely with the underlying business needs. Pari also discusses her approach to structured decision-making, why privacy is a team sport, the importance of cross-functional relationships, using metrics to anticipate operational challenges, and considerations around AI transparency and governance.

Chapters

00:00 Introduction

02:15 A pragmatic, risk based approach to privacy

04:30 Falling into privacy at Microsoft

06:15 Navigating call recording access requests

09:45 Responding to growing request volumes

12:30 Five options on the table

14:45 Rethinking the retention period

17:15 Privacy is a team sport

22:15 Metrics that spot the crisis early

29:00 AI transparency and model drift

31:45 Outcomes and final advice

Takeaways

-Retaining data without a continuing business need can introduce additional privacy, security, operational, and governance risk; aligning retention with legitimate business needs can help reduce that burden.

-When navigating a complex privacy issue, start by understanding the underlying business objective, then evaluate potential approaches against factors such as risk, applicable requirements, resources, operational impact, and customer expectations.

-Privacy is a team sport, and strong cross-functional relationships require continuous investment, not only engagement when an issue arises.

-Track privacy metrics and request-volume trends to identify emerging capacity and operational challenges early.

-Document key decisions, including the options considered, associated risks, rationale, and relevant sign-offs, so the reasoning remains clear over time.


Connect with the Guest
LinkedIn: https://www.linkedin.com/in/pari-sarnot/


Sponsor
Brought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it.

Learn more about your website here

]]> gdpr subject access request,dsar response,right of access,call recording privacy,data retention policy,data minimization,privacy risk management,privacy governance,cross functional collaboration,privacy metrics,kpis and kris,ccpa compliance,cpra,german works council,employee data privacy,web privacy,consent management,tag governance,AI governance,privacy program management No Customer Relationships That Last Decades: Will Clayton at Marriott Vacations 4 4 Customer Relationships That Last Decades: Will Clayton at Marriott Vacations full f80368e5-7564-4d70-a60e-bd47a4744e91 https://share.transistor.fm/s/fb066025 Summary
What does it take to run privacy for a brand where the customer relationship lasts decades? Host Ethan Prete sits down with Will Clayton, Data Privacy Director at Marriott Vacations Worldwide, whose privacy career stretches back to 2000 and the early days of ad tech. Will explains why day one of a new privacy law actually starts at day minus 200, what happens to consent architecture when a customer moves from an opt-out jurisdiction to an opt-in one, and why the smartest compliance strategy is a single ethical policy that satisfies every jurisdiction at once. Along the way: who belongs in the privacy war room, who should own the consent and preference center, the real cost of negative marketing events like bounces and complaints, CIPA demand letters, AI governance, and how to spot privacy laws being weaponized. Essential listening for privacy professionals, marketers, and anyone building the infrastructure that sits between the two.

Chapters

00:00 Introduction

02:45 From ad tech to privacy, a 26 year career

04:30 The line between caring and creepy

06:45 When customers move, preferences explode

09:00 Day one starts at day minus 200

11:00 Who sits in the privacy war room

13:45 One policy for every jurisdiction

20:45 Who owns the consent and preference center

23:00 Measuring the cost of negative events

28:45 AI governance and final predictions

Takeaways

-Day one of a new privacy law is a monitoring exercise, not a scramble: the program should be written, implemented, and tested 200 days before the effective date.

-When a customer moves from an opt-out jurisdiction to an opt-in one, a binary consent switch becomes a matrix of flags, so preference architecture must be designed for people who move.

-The strongest compliance strategy is finding the commonality: one ethical policy that satisfies every jurisdiction and extends rights even where no statute requires them.

-Privacy earns executive buy-in by accurately describing consequences, because a lack of respect for consumer privacy is an existential threat to the mission, not just a compliance gap.

-Marketers should measure negative events, including bounces, complaints, and opt-outs, with the same rigor as conversions, because creepy marketing is bad marketing.

Connect with the Guest
LinkedIn: https://www.linkedin.com/in/willclayton/
Website: https://www.marriottvacationsworldwide.com

Sponsor
Brought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it.

Learn more about your website here

]]> Summary
What does it take to run privacy for a brand where the customer relationship lasts decades? Host Ethan Prete sits down with Will Clayton, Data Privacy Director at Marriott Vacations Worldwide, whose privacy career stretches back to 2000 and the early days of ad tech. Will explains why day one of a new privacy law actually starts at day minus 200, what happens to consent architecture when a customer moves from an opt-out jurisdiction to an opt-in one, and why the smartest compliance strategy is a single ethical policy that satisfies every jurisdiction at once. Along the way: who belongs in the privacy war room, who should own the consent and preference center, the real cost of negative marketing events like bounces and complaints, CIPA demand letters, AI governance, and how to spot privacy laws being weaponized. Essential listening for privacy professionals, marketers, and anyone building the infrastructure that sits between the two.

Chapters

00:00 Introduction

02:45 From ad tech to privacy, a 26 year career

04:30 The line between caring and creepy

06:45 When customers move, preferences explode

09:00 Day one starts at day minus 200

11:00 Who sits in the privacy war room

13:45 One policy for every jurisdiction

20:45 Who owns the consent and preference center

23:00 Measuring the cost of negative events

28:45 AI governance and final predictions

Takeaways

-Day one of a new privacy law is a monitoring exercise, not a scramble: the program should be written, implemented, and tested 200 days before the effective date.

-When a customer moves from an opt-out jurisdiction to an opt-in one, a binary consent switch becomes a matrix of flags, so preference architecture must be designed for people who move.

-The strongest compliance strategy is finding the commonality: one ethical policy that satisfies every jurisdiction and extends rights even where no statute requires them.

-Privacy earns executive buy-in by accurately describing consequences, because a lack of respect for consumer privacy is an existential threat to the mission, not just a compliance gap.

-Marketers should measure negative events, including bounces, complaints, and opt-outs, with the same rigor as conversions, because creepy marketing is bad marketing.

Connect with the Guest
LinkedIn: https://www.linkedin.com/in/willclayton/
Website: https://www.marriottvacationsworldwide.com

Sponsor
Brought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it.

Learn more about your website here

]]> Tue, 01 Sep 2026 04:38:00 -0600 ObservePoint ObservePoint 2030 Summary
What does it take to run privacy for a brand where the customer relationship lasts decades? Host Ethan Prete sits down with Will Clayton, Data Privacy Director at Marriott Vacations Worldwide, whose privacy career stretches back to 2000 and the early days of ad tech. Will explains why day one of a new privacy law actually starts at day minus 200, what happens to consent architecture when a customer moves from an opt-out jurisdiction to an opt-in one, and why the smartest compliance strategy is a single ethical policy that satisfies every jurisdiction at once. Along the way: who belongs in the privacy war room, who should own the consent and preference center, the real cost of negative marketing events like bounces and complaints, CIPA demand letters, AI governance, and how to spot privacy laws being weaponized. Essential listening for privacy professionals, marketers, and anyone building the infrastructure that sits between the two.

Chapters

00:00 Introduction

02:45 From ad tech to privacy, a 26 year career

04:30 The line between caring and creepy

06:45 When customers move, preferences explode

09:00 Day one starts at day minus 200

11:00 Who sits in the privacy war room

13:45 One policy for every jurisdiction

20:45 Who owns the consent and preference center

23:00 Measuring the cost of negative events

28:45 AI governance and final predictions

Takeaways

-Day one of a new privacy law is a monitoring exercise, not a scramble: the program should be written, implemented, and tested 200 days before the effective date.

-When a customer moves from an opt-out jurisdiction to an opt-in one, a binary consent switch becomes a matrix of flags, so preference architecture must be designed for people who move.

-The strongest compliance strategy is finding the commonality: one ethical policy that satisfies every jurisdiction and extends rights even where no statute requires them.

-Privacy earns executive buy-in by accurately describing consequences, because a lack of respect for consumer privacy is an existential threat to the mission, not just a compliance gap.

-Marketers should measure negative events, including bounces, complaints, and opt-outs, with the same rigor as conversions, because creepy marketing is bad marketing.

Connect with the Guest
LinkedIn: https://www.linkedin.com/in/willclayton/
Website: https://www.marriottvacationsworldwide.com

Sponsor
Brought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it.

Learn more about your website here

]]> web privacy,privacy compliance,state privacy laws,ccpa compliance,gdpr compliance,consent management,preference center,data privacy strategy,privacy operations,ethical marketing,dsar workflow,privacy program management,data subject requests,cipa demand letters,privacy governance,AI governance,marketing compliance,opt in vs opt out,privacy architecture,consumer trust No Privacy Checks Are Trust Builders, Not Roadblocks with Uche Orji 3 3 Privacy Checks Are Trust Builders, Not Roadblocks with Uche Orji full 2c4a2d59-8c96-4553-8a8c-0ce9d81d0159 https://share.transistor.fm/s/0c826b32 Summary
What can a single pre-checked checkbox teach an entire company about consent? In this episode of The Web Privacy Podcast, host Ethan Prete talks with Uche Orji, Lawyer and Compliance officer, about the marketing signup form she flagged during an internal audit, and why "customers can always unsubscribe" is the mindset that leads to GDPR fines. Uche explains what the law actually requires of consent, how she replaced a lucky catch with a routine privacy workflow, why privacy checks are trust builders rather than roadblocks, and how legal teams can operationalize the law with process documents, education, and internal audits. The conversation closes with her advice to CMOs: focus on quality leads, because only a consenting customer converts. For privacy professionals, marketers, and anyone who owns a web form.

Chapters

00:45 Introduction

01:58 How Uche got into privacy

04:02 Where privacy should sit in the organization

05:31 A checkbox that took consent

07:14 The fix: double opt in and a paper trail

09:37 Finding the problem before the fine

11:42 Trust builders, not roadblocks

14:42 Think like an internal auditor

17:44 Cookies, resource downloads, and DSARs

20:49 No universal consent framework

23:15 Quality leads over lead volume

Takeaways

Consent must be unambiguous, unbundled, and actively given: a pre-checked box means the company took consent the customer never gave

Privacy checks are trust builders, not roadblocks: every check passed is a signal to customers that their data is safe

Operationalize the law: replace institutional knowledge with step-by-step process documents sent to every stakeholder

Think like an internal auditor: schedule walkthroughs of each department's processes and make teams show you, not tell you

Focus on quality leads over lead volume: only a consenting subscriber converts into a paying customer

Connect with the Guest
LinkedIn: https://www.linkedin.com/in/orjiuchechukwu/

Sponsor
Brought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it.

Learn more about your website here

]]> Summary
What can a single pre-checked checkbox teach an entire company about consent? In this episode of The Web Privacy Podcast, host Ethan Prete talks with Uche Orji, Lawyer and Compliance officer, about the marketing signup form she flagged during an internal audit, and why "customers can always unsubscribe" is the mindset that leads to GDPR fines. Uche explains what the law actually requires of consent, how she replaced a lucky catch with a routine privacy workflow, why privacy checks are trust builders rather than roadblocks, and how legal teams can operationalize the law with process documents, education, and internal audits. The conversation closes with her advice to CMOs: focus on quality leads, because only a consenting customer converts. For privacy professionals, marketers, and anyone who owns a web form.

Chapters

00:45 Introduction

01:58 How Uche got into privacy

04:02 Where privacy should sit in the organization

05:31 A checkbox that took consent

07:14 The fix: double opt in and a paper trail

09:37 Finding the problem before the fine

11:42 Trust builders, not roadblocks

14:42 Think like an internal auditor

17:44 Cookies, resource downloads, and DSARs

20:49 No universal consent framework

23:15 Quality leads over lead volume

Takeaways

Consent must be unambiguous, unbundled, and actively given: a pre-checked box means the company took consent the customer never gave

Privacy checks are trust builders, not roadblocks: every check passed is a signal to customers that their data is safe

Operationalize the law: replace institutional knowledge with step-by-step process documents sent to every stakeholder

Think like an internal auditor: schedule walkthroughs of each department's processes and make teams show you, not tell you

Focus on quality leads over lead volume: only a consenting subscriber converts into a paying customer

Connect with the Guest
LinkedIn: https://www.linkedin.com/in/orjiuchechukwu/

Sponsor
Brought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it.

Learn more about your website here

]]> Tue, 25 Aug 2026 04:39:00 -0600 ObservePoint ObservePoint 1585 Summary
What can a single pre-checked checkbox teach an entire company about consent? In this episode of The Web Privacy Podcast, host Ethan Prete talks with Uche Orji, Lawyer and Compliance officer, about the marketing signup form she flagged during an internal audit, and why "customers can always unsubscribe" is the mindset that leads to GDPR fines. Uche explains what the law actually requires of consent, how she replaced a lucky catch with a routine privacy workflow, why privacy checks are trust builders rather than roadblocks, and how legal teams can operationalize the law with process documents, education, and internal audits. The conversation closes with her advice to CMOs: focus on quality leads, because only a consenting customer converts. For privacy professionals, marketers, and anyone who owns a web form.

Chapters

00:45 Introduction

01:58 How Uche got into privacy

04:02 Where privacy should sit in the organization

05:31 A checkbox that took consent

07:14 The fix: double opt in and a paper trail

09:37 Finding the problem before the fine

11:42 Trust builders, not roadblocks

14:42 Think like an internal auditor

17:44 Cookies, resource downloads, and DSARs

20:49 No universal consent framework

23:15 Quality leads over lead volume

Takeaways

Consent must be unambiguous, unbundled, and actively given: a pre-checked box means the company took consent the customer never gave

Privacy checks are trust builders, not roadblocks: every check passed is a signal to customers that their data is safe

Operationalize the law: replace institutional knowledge with step-by-step process documents sent to every stakeholder

Think like an internal auditor: schedule walkthroughs of each department's processes and make teams show you, not tell you

Focus on quality leads over lead volume: only a consenting subscriber converts into a paying customer

Connect with the Guest
LinkedIn: https://www.linkedin.com/in/orjiuchechukwu/

Sponsor
Brought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it.

Learn more about your website here

]]> gdpr consent requirements,marketing compliance,pre checked checkbox,opt in vs opt out,email marketing consent,double opt in,privacy by design,cookie consent banner,dsar requests,privacy compliance audit,ccpa compliance,data protection officer,privacy in marketing,consent management,lead generation compliance,web privacy podcast,quality leads,privacy regulations,gdpr fines,data privacy audit No Why Privacy Lawyers Are Becoming AI Lawyers: Mark Sanders at Tekion 2 2 Why Privacy Lawyers Are Becoming AI Lawyers: Mark Sanders at Tekion full 40b79cb3-6e02-4dc3-9a2d-c3e25d35ca57 https://share.transistor.fm/s/d8ef3655 Summary
What happens to privacy lawyers when AI takes over the spotlight? In this episode of The Web Privacy Podcast, host Ethan Prete sits down with Mark Sanders, Sr Product AI & Data Privacy Counsel at Tekion, an AI native platform for car dealerships, and a 30 year veteran of in-house roles at Adobe, eBay, and Airbnb. Mark explains why the lawyers who mastered America's fragmented privacy patchwork are the best prepared to navigate AI regulation, what it looks like to work as embedded product counsel reviewing Figmas and data flows alongside engineers, and the three lens framework he uses to review every consumer facing AI agent: AI regulation, privacy, and channel specific consumer laws like TCPA and CAN-SPAM. This conversation is for privacy professionals, in-house counsel, and the analytics and marketing teams who work beside them.

Chapters

00:45 Meet Mark Sanders

01:45 From digital signatures to data privacy

04:45 The shift from privacy law to AI law

06:30 Inside Tekion and the DMS space

09:00 The end of review and approve legal

13:00 Bridging the lawyer engineer language gap

18:05 Privacy through a B2B lens

20:00 The FTC and the California CARS Act

22:55 AI agents as the new privacy frontier

27:05 What keeps Mark up at night

Takeaways

-Embedded product counsel reviews designs and data flows before anything ships, which is cheaper and faster than the review and approve model where legal is always running behind.

-Privacy lawyers who learned to navigate the fragmented US state patchwork are the best positioned professionals to handle AI regulation, which is developing the same way.

-AI and privacy are concentric circles with a constantly moving overlap: you cannot have AI without data, and personal data in AI always raises privacy questions.

-Every consumer facing AI agent needs a three lens review covering AI regulation, privacy, and channel laws like TCPA and CAN-SPAM that apply regardless of the technology.

-AI is only as good as the data it can reach, which makes database access for AI tools the most practical privacy risk companies face right now.

Connect with the Guest
LinkedIn: https://www.linkedin.com/in/msanderslaw/
Website: https://tekion.com

Sponsor
Brought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it.

Learn more about your website here

]]> Summary
What happens to privacy lawyers when AI takes over the spotlight? In this episode of The Web Privacy Podcast, host Ethan Prete sits down with Mark Sanders, Sr Product AI & Data Privacy Counsel at Tekion, an AI native platform for car dealerships, and a 30 year veteran of in-house roles at Adobe, eBay, and Airbnb. Mark explains why the lawyers who mastered America's fragmented privacy patchwork are the best prepared to navigate AI regulation, what it looks like to work as embedded product counsel reviewing Figmas and data flows alongside engineers, and the three lens framework he uses to review every consumer facing AI agent: AI regulation, privacy, and channel specific consumer laws like TCPA and CAN-SPAM. This conversation is for privacy professionals, in-house counsel, and the analytics and marketing teams who work beside them.

Chapters

00:45 Meet Mark Sanders

01:45 From digital signatures to data privacy

04:45 The shift from privacy law to AI law

06:30 Inside Tekion and the DMS space

09:00 The end of review and approve legal

13:00 Bridging the lawyer engineer language gap

18:05 Privacy through a B2B lens

20:00 The FTC and the California CARS Act

22:55 AI agents as the new privacy frontier

27:05 What keeps Mark up at night

Takeaways

-Embedded product counsel reviews designs and data flows before anything ships, which is cheaper and faster than the review and approve model where legal is always running behind.

-Privacy lawyers who learned to navigate the fragmented US state patchwork are the best positioned professionals to handle AI regulation, which is developing the same way.

-AI and privacy are concentric circles with a constantly moving overlap: you cannot have AI without data, and personal data in AI always raises privacy questions.

-Every consumer facing AI agent needs a three lens review covering AI regulation, privacy, and channel laws like TCPA and CAN-SPAM that apply regardless of the technology.

-AI is only as good as the data it can reach, which makes database access for AI tools the most practical privacy risk companies face right now.

Connect with the Guest
LinkedIn: https://www.linkedin.com/in/msanderslaw/
Website: https://tekion.com

Sponsor
Brought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it.

Learn more about your website here

]]> Tue, 18 Aug 2026 05:18:00 -0600 ObservePoint ObservePoint 1880 Summary
What happens to privacy lawyers when AI takes over the spotlight? In this episode of The Web Privacy Podcast, host Ethan Prete sits down with Mark Sanders, Sr Product AI & Data Privacy Counsel at Tekion, an AI native platform for car dealerships, and a 30 year veteran of in-house roles at Adobe, eBay, and Airbnb. Mark explains why the lawyers who mastered America's fragmented privacy patchwork are the best prepared to navigate AI regulation, what it looks like to work as embedded product counsel reviewing Figmas and data flows alongside engineers, and the three lens framework he uses to review every consumer facing AI agent: AI regulation, privacy, and channel specific consumer laws like TCPA and CAN-SPAM. This conversation is for privacy professionals, in-house counsel, and the analytics and marketing teams who work beside them.

Chapters

00:45 Meet Mark Sanders

01:45 From digital signatures to data privacy

04:45 The shift from privacy law to AI law

06:30 Inside Tekion and the DMS space

09:00 The end of review and approve legal

13:00 Bridging the lawyer engineer language gap

18:05 Privacy through a B2B lens

20:00 The FTC and the California CARS Act

22:55 AI agents as the new privacy frontier

27:05 What keeps Mark up at night

Takeaways

-Embedded product counsel reviews designs and data flows before anything ships, which is cheaper and faster than the review and approve model where legal is always running behind.

-Privacy lawyers who learned to navigate the fragmented US state patchwork are the best positioned professionals to handle AI regulation, which is developing the same way.

-AI and privacy are concentric circles with a constantly moving overlap: you cannot have AI without data, and personal data in AI always raises privacy questions.

-Every consumer facing AI agent needs a three lens review covering AI regulation, privacy, and channel laws like TCPA and CAN-SPAM that apply regardless of the technology.

-AI is only as good as the data it can reach, which makes database access for AI tools the most practical privacy risk companies face right now.

Connect with the Guest
LinkedIn: https://www.linkedin.com/in/msanderslaw/
Website: https://tekion.com

Sponsor
Brought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it.

Learn more about your website here

]]> ai privacy law,privacy lawyer,ai governance,product counsel,ai compliance,data privacy,ai regulation,privacy counsel,ai agents,agent compliance,web privacy,tcpa,can-spam,ccpa,gdpr,embedded legal counsel,ai native platform,dealer management software,consumer data protection,legal tech No The M&A Playbook from the Chief Privacy Officer at Synopsys Inc, Erin McCurdy 1 1 The M&A Playbook from the Chief Privacy Officer at Synopsys Inc, Erin McCurdy full 0d11815e-e441-4839-9c1d-468cd92454b5 https://share.transistor.fm/s/1e79e30c Summary
What does it take to share personal data during a merger or acquisition without creating regulatory liability before the deal even closes? Host Ethan Prete sits down with Erin McCurdy, Chief Privacy Officer and Data Protection Officer at Synopsys, who has managed privacy through three to five acquisitions a year at Ansys and then lived the sell side of the $32 billion Synopsys acquisition of Ansys. Erin breaks down the three non negotiables that must be in place before a single row of personal data moves, why aggregated data satisfies most buyer requests at the NDA stage, the difference between due diligence and integration after signing, and why a Legitimate Interest Assessment is the lawful basis that gets you to Day One. A must listen for privacy professionals, in house counsel, and anyone whose company might one day be on either side of a deal sheet.

Chapters
00:00 Introduction
02:15 Erin's path to chief privacy officer
05:30 Inside the Synopsys privacy team
08:45 Why a privacy notice is not a blanket pass
09:45 The three non negotiables before sharing data
12:45 Personal data under the NDA
14:45 The power of aggregated data
19:00 Diligence versus integration after signing
21:30 Day one readiness and the legitimate interest assessment
24:45 Web privacy audits and marketing consent
37:00 Preparing before the deal sheet hits
41:15 Know where your data is

Takeaways

  • Never share personal data at any deal stage without an executed data protection agreement in place
  • Keep due diligence and integration strictly separate, a signed agreement is not an all access pass
  • Default to aggregated or de identified data early, most buyer requests can be satisfied without individual records
  • Back every pre closing transfer with a documented legitimate interest assessment and a signed deletion clause in case the deal does not close
  • Know where your data is before the deal sheet arrives, data mapping and records of processing are the foundation of a defensible sale


Connect with the Guest
LinkedIn: https://www.linkedin.com/in/erin-e-mccurdy-11040017/
Website: https://www.synopsys.com


Sponsor
Brought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it.

Learn more about your website here

]]> Summary
What does it take to share personal data during a merger or acquisition without creating regulatory liability before the deal even closes? Host Ethan Prete sits down with Erin McCurdy, Chief Privacy Officer and Data Protection Officer at Synopsys, who has managed privacy through three to five acquisitions a year at Ansys and then lived the sell side of the $32 billion Synopsys acquisition of Ansys. Erin breaks down the three non negotiables that must be in place before a single row of personal data moves, why aggregated data satisfies most buyer requests at the NDA stage, the difference between due diligence and integration after signing, and why a Legitimate Interest Assessment is the lawful basis that gets you to Day One. A must listen for privacy professionals, in house counsel, and anyone whose company might one day be on either side of a deal sheet.

Chapters
00:00 Introduction
02:15 Erin's path to chief privacy officer
05:30 Inside the Synopsys privacy team
08:45 Why a privacy notice is not a blanket pass
09:45 The three non negotiables before sharing data
12:45 Personal data under the NDA
14:45 The power of aggregated data
19:00 Diligence versus integration after signing
21:30 Day one readiness and the legitimate interest assessment
24:45 Web privacy audits and marketing consent
37:00 Preparing before the deal sheet hits
41:15 Know where your data is

Takeaways

  • Never share personal data at any deal stage without an executed data protection agreement in place
  • Keep due diligence and integration strictly separate, a signed agreement is not an all access pass
  • Default to aggregated or de identified data early, most buyer requests can be satisfied without individual records
  • Back every pre closing transfer with a documented legitimate interest assessment and a signed deletion clause in case the deal does not close
  • Know where your data is before the deal sheet arrives, data mapping and records of processing are the foundation of a defensible sale


Connect with the Guest
LinkedIn: https://www.linkedin.com/in/erin-e-mccurdy-11040017/
Website: https://www.synopsys.com


Sponsor
Brought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it.

Learn more about your website here

]]> Thu, 06 Aug 2026 10:35:38 -0600 ObservePoint ObservePoint 2548 Summary
What does it take to share personal data during a merger or acquisition without creating regulatory liability before the deal even closes? Host Ethan Prete sits down with Erin McCurdy, Chief Privacy Officer and Data Protection Officer at Synopsys, who has managed privacy through three to five acquisitions a year at Ansys and then lived the sell side of the $32 billion Synopsys acquisition of Ansys. Erin breaks down the three non negotiables that must be in place before a single row of personal data moves, why aggregated data satisfies most buyer requests at the NDA stage, the difference between due diligence and integration after signing, and why a Legitimate Interest Assessment is the lawful basis that gets you to Day One. A must listen for privacy professionals, in house counsel, and anyone whose company might one day be on either side of a deal sheet.

Chapters
00:00 Introduction
02:15 Erin's path to chief privacy officer
05:30 Inside the Synopsys privacy team
08:45 Why a privacy notice is not a blanket pass
09:45 The three non negotiables before sharing data
12:45 Personal data under the NDA
14:45 The power of aggregated data
19:00 Diligence versus integration after signing
21:30 Day one readiness and the legitimate interest assessment
24:45 Web privacy audits and marketing consent
37:00 Preparing before the deal sheet hits
41:15 Know where your data is

Takeaways

  • Never share personal data at any deal stage without an executed data protection agreement in place
  • Keep due diligence and integration strictly separate, a signed agreement is not an all access pass
  • Default to aggregated or de identified data early, most buyer requests can be satisfied without individual records
  • Back every pre closing transfer with a documented legitimate interest assessment and a signed deletion clause in case the deal does not close
  • Know where your data is before the deal sheet arrives, data mapping and records of processing are the foundation of a defensible sale


Connect with the Guest
LinkedIn: https://www.linkedin.com/in/erin-e-mccurdy-11040017/
Website: https://www.synopsys.com


Sponsor
Brought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it.

Learn more about your website here

]]> m&a data privacy,personal data in mergers and acquisitions,data protection agreement,m&a due diligence,chief privacy officer,privacy in m&a deals,gdpr m&a compliance,legitimate interest assessment,day one readiness,data sharing in acquisitions,privacy due diligence checklist,marketing consent transfer,consent management platform,m&a integration privacy,data mapping,records of processing activities,privacy notice m&a clause,sell side data protection,aggregated data due diligence,web privacy compliance No