Principal Counsel, Regulatory & Privacy

Overview

This role involves serving as the organization’s second in-house legal counsel, reporting to the team’s existing in-house counsel. For a period, the legal function will consist of two lawyers.

The role is heavily focused on privacy and regulatory matters, including building and running the privacy program, handling privacy reviews for new features and AI models, managing cross-border and breach response compliance, and owning consumer protection and advertising compliance. While privacy and regulatory are the home base, the position also requires comfort taking on commercial contracting, litigation support, product counseling, and other in-house docket needs as they arise.

Responsibilities

Privacy and data protection

• Build and run the global privacy program across applicable frameworks (CCPA/CPRA, GDPR, and others), including disclosures, consent, records of processing, and data subject requests.
• Own data processing agreements across vendors, cross-border transfer and localization compliance, and the breach response playbook.
• Handle compliance for biometric and health data central to the product, and run privacy reviews for new features, integrations, and AI models.

Regulatory and consumer protection

• Own FTC and consumer protection work, including health and wellness claims, advertising review, and subscription and auto-renewal compliance across markets.
• Maintain a practical understanding of market requirements (product registration, import, labeling, disclosures) to support launches into new markets.
• Track medical device and healthcare-regulatory questions as health features grow, and help scope legal paths for new product categories (FDA classification, corporate practice of medicine, anti-kickback, HIPAA).

Beyond privacy and regulatory

• Take on whatever the department needs outside core area, including commercial contracts, litigation support, product counseling, and other in-house matters.
• Act as embedded counsel to product and engineering, and help build out legal operations and the function alongside in-house counsel.

Required Qualifications

• JD and active bar membership in at least one US state.
• 8 to 12 years of relevant experience, including meaningful time in-house. This role moves quickly, and is not intended for someone coming straight from private practice.
• Solid working knowledge of privacy and regulatory areas relevant to this role: US privacy (CCPA/CPRA), GDPR, and FTC and consumer protection.
• Strong generalist capability: experience across more than one in-house area and comfort taking on unfamiliar matters independently.
• Self-starter who works hard, makes decisions independently, and advises the business directly rather than routing everything to outside counsel.
• Comfortable in a fast-moving environment where building is expected rather than maintaining.

Preferred Qualifications

• In-house experience at a consumer technology, healthtech, wearable, or DTC subscription company.
• Experience as a first or early regulatory or privacy hire.
• Biometric or health data experience, and cross-border transfer or data localization experience.
• Advertising, health-claims, or healthcare-regulatory experience (HIPAA, corporate practice of medicine, the FDA/FTC intersection).
• Familiarity with AI governance and emerging AI regulation.
• CIPP/US or CIPP/E is a plus, not a requirement; experience is prioritized over credentials.

Compensation & Benefits

• Equity participation is available to every full-time team member, with periodic equity refreshes based on performance.
• Product benefit: every full-time employee receives the company product (Pod).
• Full access to health, vision, and dental insurance for you and your dependents.
• Supplemental life insurance.
• Flexible PTO.
• Commuter benefits.
• Paid parental leave.
• Note: benefits may vary depending on location.

Location

List of benefits may vary depending on your location.