“Privacy by design” sounds nice, but many organizations still only consult legal as an afterthought, once they’re nearly done designing a new product or feature.
But taking privacy seriously means inviting lawyers to the party early on in the process – and they promise not to be party poopers.
“Compliance doesn’t have to be a chore, and legal can be a strategic partner,” said Jamie Lieberman, chief legal officer at ad management and monetization platform Mediavine. “We’re not just there to say ‘no’ – we can add value.”
Lieberman joined the company in late 2022 after six years of running her own legal consultancy for online businesses. (In fact, she was Mediavine’s outside counsel for several years.)
When Lieberman came in-house, one of her top priorities was to embed her team throughout the company, from product and engineering to marketing and communications. “We spend a lot of time exposing ourselves to every department so we have the context to make good recommendations,” Lieberman said.
And when legal, which is now invited to every product development meeting, does raise a red flag, people listen, she said, because they know there’s a good reason for their concerns.
“We’re not just looking at things from a black-and-white compliance perspective,” Lieberman said, “and we can do that because we also have an understanding of the business.”
Mediavine’s legal department is now 10 people, having doubled its headcount over the past year.
Lieberman spoke with AdExchanger.
AdExchanger: Considering the complexity of the online advertising ecosystem, do lawyers also essentially need to be technologists?
JAMIE LIEBERMAN: Yes, they do. I don’t find this to be the case at most big law firms, although it’s one of the main criteria I have in mind when I hire. We want technical people. I don’t know how an attorney can provide collaborative counsel without having a deep understanding of what a product does.
AdExchanger Daily
Get our editors’ roundup delivered to your inbox every weekday.
Daily Roundup
I’d say it’s just as important, though, to have engineers who also have an understanding of privacy.
I’ve heard from multiple sources on the tech side that the conversations they have with their lawyers aren’t always productive because legal folks often talk about what companies need to do to comply but not how to actually do it.
That is a major frustration. Our job as lawyers should be to help businesses assess risk and to balance that risk against potential benefits.
Because everything is a risk, right? Sometimes the risk is high and the alarms are ringing, and sometimes the risk is low, but it’s never zero. That’s why compliance is a conversation. At the end of every meeting, we make a point of coming up with solutions. We don’t want people to feel like, if they call their lawyer, then nothing gets finished. Like, “Oh, they’re just going to throw up roadblocks and make things harder for me.”
Is perfect compliance even possible?
I mean, perfection is not possible with anything. Our goal is to always try to do the right thing and come to the right decision.
Part of the reason perfection is impossible is because we have so many new laws that have never been looked at by a court. There are a lot of gray areas, so you end up with a bunch of lawyers making their own interpretations. At the same time, different organizations have different risk tolerance levels, so what feels “perfect” for one org might not work for another.
The best approach is to bring on people with good instincts, to devote the necessary resources, to stop looking at compliance as a burden and to generally make a truly good faith effort.
How far does good faith go with regulators?
Early in my career, I worked for a federal district judge writing opinions, so I’ve actually been on the other side as a legal decision-maker. And so I can tell you from personal experience that good faith matters a lot.
Look at the FTC. When they make an example of a company, it’s typically because that company willfully did something they knew they shouldn’t be doing.
We haven’t seen much enforcement of the CCPA and CPRA. Will there be another Sephora sometime soon?
If I say “yes,” I’m afraid I’ll jinx it, but … yes. Regulators are getting more and more sophisticated, and they’re going to be active. California, for instance, takes its laws very, very seriously. Anyone who thinks otherwise is fooling themselves.
This interview has been lightly edited and condensed.
🙏 Thanks for reading! And here’s to the hope that product and legal teams can have a beautiful relationship, like the cat and pit bull in this heart-meltingly adorable Pixar short film. (Get out your Kleenex. You’ll be crying and smiling or I’m not a dyed-in-the-fur cat lady.)
As always, feel free to drop me a line at allison@adexchanger.com with any comments or feedback.
For more articles featuring Jamie Lieberman, click here.
