The Web Privacy Podcast

SummaryDoes public access to information mean you are free to scrape it for AI training? Fabia Cairoli, Director of Privacy and AI Governance at ESL FACEIT Group, joins Ethan Prete on The Web Privacy Podcast to explain why technical accessibility is not the same as permission to reuse data.They discuss the legal and operational questions around web scraping, from data inventories and appropriate safeguards to cross-functional incident response. Fabia shares how clear ownership across legal, privacy and security helps teams act decisively, why restrictions should be understandable to automated systems, and how scalable governance can free small privacy teams to focus on strategic work.The conversation also explores the potential of synthetic data for AI development, while recognizing that its privacy implications depend on how the data is generated and used.Chapters00:00 Meet Fabia Cairoli01:37 From External Counsel to Privacy Leadership04:25 Why Public Data Isn't Free Data07:14 GDPR Article 32 and Website Responsibility11:30 Shared Governance and Incident Response16:18 Domain Inventories and Scraping Safeguards21:09 Scraping Restrictions and AI Training Risks25:44 Cambridge Analytica and Accountability28:14 Building Scalable Privacy Operations30:12 Synthetic Data and the Future of AI TrainingTakeaways-What Article 32 of the GDPR means for assessing website security measures-Why organizations need a domain inventory, records of processing activities (ROPA), clear policies and proportionate technical safeguards-How privacy, legal and security can work together when suspicious automated access is detected-Why public availability, terms of use, copyright and data protection require case-specific review-How synthetic data could support AI projects without removing the need for privacy assessmentConnect with the GuestLinkedin: https://www.linkedin.com/in/fabia-cairoli-248b749a/ Company: https://eslfaceitgroup.com/Discussion is for general information and is not legal advice.SponsorBrought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it.Learn more about your website here: https://www.observepoint.com/

SummaryA B2B team rolls out a shiny new AI conversion modeling tool and attribution jumps 14%. Marketing is buying champagne. Then legal finds section 8.3 of the DPA: the vendor may use "aggregated pseudonymized event data" to improve its general platform models, which means hashed emails and buying patterns from named enterprise accounts are now training a model that helps competitors target those same accounts. Emelie Kogut, Associate General Counsel, Privacy and Compliance at Zeta Global, joins host Ethan Prete on The Web Privacy Podcast to work the scenario from the platform side.Emelie explains why "pseudonymized and aggregated" is a contradiction that should never survive a legal review, why hashed emails are still personal data under the US state privacy laws, why this kind of leak can be worse than a security breach, what she does in the first 48 hours before anyone calls the vendor, and how to read an AI addendum for the one clause that matters. Essential listening for privacy, legal, procurement and marketing leaders who sign vendor DPAs.  Chapters00:00 Cold open: a culture of understanding data00:43 Welcome and the 14% lift that sounds too good to be true01:47 Meet Emelie: commercial privacy at Zeta Global03:39 One privacy engineer and California's Delete Act05:02 The scenario: section 8.3 of the DPA06:20 Can privacy push back on a 14% lift?08:03 Where procurement broke down09:02 "Pseudonymized and aggregated" is a contradiction11:04 Why hashing does not equal anonymization12:35 Explaining pseudonymization to a CMO14:58 Why this can be worse than a data breach16:55 The first 48 hours after you find the clause19:21 AI addendums and the clause to look for22:33 Keeping the vendor conversation productive24:29 Transparency is the business model  Takeaways- "Pseudonymized and aggregated" is a contradiction: pseudonymized data is still personal data, so a DPA with that phrase almost certainly never had a real legal review.- Hashed or de-identified data that can be re-identified is still in scope of the US state privacy laws; anonymization is a very high bar that targeted advertising rarely meets.- Privacy should come in twice: a vendor privacy review before contracting, and again at the contract stage.- A security breach has a clear beginning and end; data ingested into a vendor's shared AI model may never come back, so the damage can last for years.- Gather the facts first (amendments, SOWs, data maps), then meet the vendor, and keep the conversation non-combative; transparency, not data use itself, is what makes a vendor model acceptable.  Connect with the GuestEmelie Kogut LinkedIn: https://www.linkedin.com/in/emelie-kogut-7551b033Company Website: https://zetaglobal.comEmelie attends the IAPP privacy conference in Washington, DC each spring.  SponsorBrought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it.Learn more about your website here: https://www.observepoint.com/

SummaryA rule in the tag manager was written to fire an ad network tag on public signup pages. A loose URL match meant it also fired on the authenticated billing dashboard, so for 18 months every logged-in customer's account ID and plan tier went to a third-party ad vendor, and nobody saw it because QA only ever ran anonymous scripts. Indulekshmi Rajeswari, Data Privacy Leader, joins host Ethan Prete on The Web Privacy Podcast to work the scenario the way a GDPR lawyer actually would.Indu explains why "behind a login screen" is not the same as secure, why a customer ID is still personal data, where a privacy team should sit and why the DPO needs a measure of independence, why the first move on a Friday afternoon is the legal definition and not the kill switch, the two gates an incident has to pass before it is a reportable breach, when the 72-hour clock really starts, what a useful vendor breach notice looks like, and why the business, not privacy, owns the risk. Essential listening for privacy, legal, marketing and analytics leaders who share a tag manager.  Chapters00:00 Cold open: an 18 month leak behind a login screen01:06 Intro01:50 Meet Indu: Singapore, Zooplus and Uniper04:16 Why marketing tags escape the scrutiny core code gets06:11 A login screen is not security10:42 Where privacy sits and why the DPO needs independence15:02 Incognito audits and the Friday scenario23:23 Is it a reportable breach? The 2 gates29:20 The 72 hour clock and what a good breach notice looks like33:52 Who's to blame? The business, and the privacy champions who help  Takeaways- Marketing and analytics tags are deployed by people who never touch the core application, which is why they get a fraction of the scrutiny and cause a disproportionate share of the leaks.- A login screen is a gate, not security; test every user flow authenticated as well as anonymous, because incognito-only QA misses half the site.- On the Friday the incident lands, the first job is the legal definition of personal data and the contract with the counterparty, not the kill switch; after 18 months, two more hours changes nothing.- An incident is only a reportable breach if it passes two gates, a breach of security and unauthorized disclosure or access, and the 72-hour clock starts when you ascertain a breach, not when the ticket arrives.- The business owns the risk and the decision; privacy advises, trains and builds a network of champions in the teams that actually deploy the tags.  Connect with the GuestIndulekshmi Rajeswari LinkedIn: https://www.linkedin.com/in/indulekshmi-rajeswariCompany Website: https://www.uniper.energyIndu speaks at the IAPP European Privacy KnowledgeNet 2026 in Munich and at the IAPP conference in Brussels in November: https://www.linkedin.com/pulse/european-privacy-knowledgenet-2026-programme-kai-traubinger-vauxe/  SponsorBrought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it.Learn more about your website here: https://www.observepoint.com/

SummaryAn acquired site keeps firing undocumented analytics and ad tech tags for a year, still sells user data under the old company's privacy policy, and drops third-party cookies on a domain CNAMEd to the parent. Then a regulator's letter arrives, addressed to the parent. Luiz Santos, privacy professional, joins host Ethan Prete to walk through what to do when a sub-brand or domain goes rogue.Luiz explains why ownership doesn't mean control, why shared responsibility so often becomes no responsibility, how one standard across every domain keeps sub-brands in line, what regulators expect when you get it wrong, and how he fixed a broken Global Privacy Control setup with marketing in under a month on zero budget. He also covers his role as Brazil DPO and how LGPD compares with GDPR. Essential listening for privacy, legal and marketing leaders responsible for more than one website.The views and opinions expressed belong to Luiz and do not necessarily reflect the views, positions, or policies of NCR Voyix, nor do they constitute legal advice.   Chapters00:00 Cold open: why every domain needs a framework00:47 Intro01:31 Meet Luiz Santos03:39 How the privacy team is structured05:10 LGPD and Brazil's copy of GDPR07:37 How regulators pick their targets10:15 The scenario: an acquired domain goes rogue14:40 Whose responsibility is it?18:27 One standard across sub-brands and domains20:19 Mapping your true risk tolerance21:37 Personalization vs privacy23:33 Do regulators have empathy?26:21 Remediation as a partnership31:43 Where to find Luiz  Takeaways- Acquiring a company or launching a sub-brand means owning everything its domains do, for better or for worse; ownership doesn't mean control.- Privacy due diligence starts with a complete list of domains and an owner for each, and most companies cannot produce one.- Shared responsibility often becomes no responsibility unless one standard and one framework apply to every domain and sub-brand.- Regulators show empathy to companies that can tell a good story with evidence, and public-facing gaps are the easiest to prove.- Privacy fixes move fastest when legal partners with marketing; Luiz fixed a broken GPC setup in under a month with zero budget.  Connect with the GuestLuiz Santos LinkedIn: https://www.linkedin.com/in/luiz-santos-143796205Company Website: https://www.ncrvoyix.comLuiz is a speaker at the GA BAR 2026 Privacy and Technology Law Forum and at Consero's 2026 Chief Privacy Officer Forum.  SponsorBrought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it.Learn more about your website here: https://www.observepoint.com/

SummaryA privacy regulator's letter lands at 9am, naming a specific webpage and a third-party ad tag that fires before consent is logged. What do you do first? Gemma Witham, Chief Privacy Officer at Skyscanner, walks host Ethan Prete through her playbook in the new segment The Regulator Who Asked First: stay calm, scope the request precisely, find out where it came from, run it as an incident, brief the C-suite early, and approach the regulator as a collaborator rather than a defendant.Gemma also explains why Skyscanner's PrivTech team, engineers embedded in the privacy function and trained on the why through IAPP courses, has transformed how fast her team executes, why a no-blame culture is how you get to the truth, how regulators like the ICO now ask technical, harm-focused questions that a cookie banner alone cannot answer, and why a CMP is the start of compliance, not the end of it. She closes with advice for the next generation of privacy leaders: stay curious and keep asking until the engineers explain it plainly. Essential listening for privacy, legal and marketing leaders responsible for what their websites actually do.  Chapters00:00 Intro01:41 Twenty years in privacy, from afterthought to the table05:05 First reaction to a regulator's inquiry09:04 The 9am scenario10:59 Do regulators understand the tech?14:05 PrivTech: engineers inside the privacy team18:44 Paper exercises, litigation and real harm21:59 No blame game23:24 How regulators evaluate tracking now27:08 CMP myths and advice for the next generation  Takeaways- First reaction to a regulator's letter is to stay calm, then scope it exactly: which page, which app, which market, and whether it came from an annual plan or customer complaints.- Run the response as an incident with an audit team, the PrivTech/marketing owners and early, transparent C-suite updates.- Downstream tags are hard to control, so continuous auditing and remediation is the only real defence against surprises.- Engineers embedded in the privacy team (PrivTech) transformed speed and quality; give them the legal why (IAPP courses) and they design better controls.- Regulators now ask technical, harm-focused questions; a cookie banner is only compliance if its firing is verified upstream and downstream.  Connect with the GuestGemma Witham LinkedIn: https://www.linkedin.com/in/gemma-witham-09442237Company Website: https://www.skyscanner.net  SponsorBrought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it.Learn more about your website here: https://www.observepoint.com/

SummaryWhat happens to a privacy program after it declares itself ready for GDPR? According to Marcus Morissette, a privacy lawyer at Fenwick & West who was a CIPP before there were slashes, most of them stop evolving. Host Ethan Prete sits down with Marcus to unpack privacy 2.0, where compliance is table stakes and the real job is getting the business to its goals inside the company's risk appetite. Marcus explains why he told his eBay team never to say no and never to say yes, why the enforcement everyone feared turned out to be security's problem, and why the next generation of privacy lawyers has to understand the technology, from hashing versus encryption to the fact that no US law contains the word cookie. He also walks through Maslow's hierarchy of data, the four-layer pyramid he built with Aaron Weller at Concise Consulting, and why a company still worried about the CIA of its data isn't ready for AI governance. Along the way: the CIPA consent banner trap, an AI drone use case that sounds like science fiction, hiring for business acumen over law degrees, and how to make a company regulator-proof. Essential listening for privacy professionals, marketers, and anyone deciding where privacy should sit in the org.Chapters00:00 Introduction02:35 Doing privacy before privacy existed05:45 Why marketers should own privacy08:10 How GDPR built programs that stalled10:45 Privacy 2.0 is business enablement12:30 The hashing versus encryption test13:15 No US law regulates cookies14:30 The CIPA consent banner trap19:50 Maslow's hierarchy of data24:15 What AI governance actually means28:15 Building and funding a privacy team34:15 Predictions for the next three years37:30 Making your program regulator-proofTakeaways- Compliance is table stakes, not the finish line. Privacy 2.0 is business enablement: getting the business to its outcome inside the company's chosen risk appetite.- Privacy teams are guidance, not decision-makers. Never say no and never say yes; act as a risk Sherpa who presents the upside and downside so the business can decide.- The renaissance privacy lawyer has to know the technology. If you can't explain hashing versus encryption or follow the ad tech spaghetti diagram, you can't advise your business through it.- No US law regulates cookies by name; they are regulated as a sale because regulators didn't understand the tech, and consent banners deployed where they weren't required have become CIPA litigation bait.- Maslow's hierarchy of data runs security, privacy, information governance, then AI governance. A company still worried about the confidentiality, integrity, and availability of its data is not ready for an AI governance conversation.Connect with the GuestMarcus Morissette LinkedIn: https://www.linkedin.com/in/mmorissette/Company Website: https://www.fenwick.comSponsorBrought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it.Learn more about your website here

SummaryWhat do you do when privacy rights create a challenge your existing process was never designed to handle? Host Ethan Prete sits down with Pari Sarnot, a Privacy, Risk & Governance Leader with experience across organizations including Meta, Grant Thornton, eBay, and Microsoft, as well as an IAPP instructor and mentor. Pari shares an example from her broader professional experience involving a growing volume of GDPR access requests for customer service call recordings, and the privacy, operational, employee, and governance considerations that followed. She walks through how a cross-functional team evaluated multiple options and ultimately aligned the retention period more closely with the underlying business needs. Pari also discusses her approach to structured decision-making, why privacy is a team sport, the importance of cross-functional relationships, using metrics to anticipate operational challenges, and considerations around AI transparency and governance.Chapters00:00 Introduction02:15 A pragmatic, risk based approach to privacy04:30 Falling into privacy at Microsoft06:15 Navigating call recording access requests09:45 Responding to growing request volumes12:30 Five options on the table14:45 Rethinking the retention period17:15 Privacy is a team sport22:15 Metrics that spot the crisis early29:00 AI transparency and model drift31:45 Outcomes and final adviceTakeaways- Retaining data without a continuing business need can introduce additional privacy, security, operational, and governance risk; aligning retention with legitimate business needs can help reduce that burden.- When navigating a complex privacy issue, start by understanding the underlying business objective, then evaluate potential approaches against factors such as risk, applicable requirements, resources, operational impact, and customer expectations.- Privacy is a team sport, and strong cross-functional relationships require continuous investment, not only engagement when an issue arises.- Track privacy metrics and request-volume trends to identify emerging capacity and operational challenges early.- Document key decisions, including the options considered, associated risks, rationale, and relevant sign-offs, so the reasoning remains clear over time.Connect with the GuestPari Sarnot LinkedIn: https://www.linkedin.com/in/pari-sarnot/SponsorBrought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it.Learn more about your website here

SummaryWhat does it take to run privacy for a brand where the customer relationship lasts decades? Host Ethan Prete sits down with Will Clayton, Data Privacy Director at Marriott Vacations Worldwide, whose privacy career stretches back to 2000 and the early days of ad tech. Will explains why day one of a new privacy law actually starts at day minus 200, what happens to consent architecture when a customer moves from an opt-out jurisdiction to an opt-in one, and why the smartest compliance strategy is a single ethical policy that satisfies every jurisdiction at once. Along the way: who belongs in the privacy war room, who should own the consent and preference center, the real cost of negative marketing events like bounces and complaints, CIPA demand letters, AI governance, and how to spot privacy laws being weaponized. Essential listening for privacy professionals, marketers, and anyone building the infrastructure that sits between the two.Chapters00:00 Introduction02:45 From ad tech to privacy, a 26 year career04:30 The line between caring and creepy06:45 When customers move, preferences explode09:00 Day one starts at day minus 20011:00 Who sits in the privacy war room13:45 One policy for every jurisdiction20:45 Who owns the consent and preference center23:00 Measuring the cost of negative events28:45 AI governance and final predictionsTakeaways- Day one of a new privacy law is a monitoring exercise, not a scramble: the program should be written, implemented, and tested 200 days before the effective date.- When a customer moves from an opt-out jurisdiction to an opt-in one, a binary consent switch becomes a matrix of flags, so preference architecture must be designed for people who move.- The strongest compliance strategy is finding the commonality: one ethical policy that satisfies every jurisdiction and extends rights even where no statute requires them.- Privacy earns executive buy-in by accurately describing consequences, because a lack of respect for consumer privacy is an existential threat to the mission, not just a compliance gap.- Marketers should measure negative events, including bounces, complaints, and opt-outs, with the same rigor as conversions, because creepy marketing is bad marketing.Connect with the GuestWill Clayton LinkedIn: https://www.linkedin.com/in/willclayton/Company Website: https://www.marriottvacationsworldwide.comSponsorBrought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it.Learn more about your website here

SummaryWhat can a single pre-checked checkbox teach an entire company about consent? In this episode of The Web Privacy Podcast, host Ethan Prete talks with Uche Orji, Lawyer and Compliance officer, about the marketing signup form she flagged during an internal audit, and why "customers can always unsubscribe" is the mindset that leads to GDPR fines. Uche explains what the law actually requires of consent, how she replaced a lucky catch with a routine privacy workflow, why privacy checks are trust builders rather than roadblocks, and how legal teams can operationalize the law with process documents, education, and internal audits. The conversation closes with her advice to CMOs: focus on quality leads, because only a consenting customer converts. For privacy professionals, marketers, and anyone who owns a web form.Chapters00:45 Introduction01:58 How Uche got into privacy04:02 Where privacy should sit in the organization05:31 A checkbox that took consent07:14 The fix: double opt in and a paper trail09:37 Finding the problem before the fine11:42 Trust builders, not roadblocks14:42 Think like an internal auditor17:44 Cookies, resource downloads, and DSARs20:49 No universal consent framework23:15 Quality leads over lead volumeTakeaways- Consent must be unambiguous, unbundled, and actively given: a pre-checked box means the company took consent the customer never gave- Privacy checks are trust builders, not roadblocks: every check passed is a signal to customers that their data is safe- Operationalize the law: replace institutional knowledge with step-by-step process documents sent to every stakeholder- Think like an internal auditor: schedule walkthroughs of each department's processes and make teams show you, not tell you- Focus on quality leads over lead volume: only a consenting subscriber converts into a paying customerConnect with the GuestUche Orji LinkedIn: https://www.linkedin.com/in/orjiuchechukwu/SponsorBrought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it.Learn more about your website here

SummaryWhat happens to privacy lawyers when AI takes over the spotlight? In this episode of The Web Privacy Podcast, host Ethan Prete sits down with Mark Sanders, Sr Product AI & Data Privacy Counsel at Tekion, an AI native platform for car dealerships, and a 30 year veteran of in-house roles at Adobe, eBay, and Airbnb. Mark explains why the lawyers who mastered America's fragmented privacy patchwork are the best prepared to navigate AI regulation, what it looks like to work as embedded product counsel reviewing Figmas and data flows alongside engineers, and the three lens framework he uses to review every consumer facing AI agent: AI regulation, privacy, and channel specific consumer laws like TCPA and CAN-SPAM. This conversation is for privacy professionals, in-house counsel, and the analytics and marketing teams who work beside them.Chapters00:45 Meet Mark Sanders01:45 From digital signatures to data privacy04:45 The shift from privacy law to AI law06:30 Inside Tekion and the DMS space09:00 The end of review and approve legal13:00 Bridging the lawyer engineer language gap18:05 Privacy through a B2B lens20:00 The FTC and the California CARS Act22:55 AI agents as the new privacy frontier27:05 What keeps Mark up at nightTakeaways- Embedded product counsel reviews designs and data flows before anything ships, which is cheaper and faster than the review and approve model where legal is always running behind.- Privacy lawyers who learned to navigate the fragmented US state patchwork are the best positioned professionals to handle AI regulation, which is developing the same way.- AI and privacy are concentric circles with a constantly moving overlap: you cannot have AI without data, and personal data in AI always raises privacy questions.- Every consumer facing AI agent needs a three lens review covering AI regulation, privacy, and channel laws like TCPA and CAN-SPAM that apply regardless of the technology.- AI is only as good as the data it can reach, which makes database access for AI tools the most practical privacy risk companies face right now.Connect with the GuestMark Sanders LinkedIn: https://www.linkedin.com/in/msanderslaw/Company Website: https://tekion.comSponsorBrought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it.Learn more about your website here