Associate General Counsel, Privacy
Job description
Shopify's Regulatory and Privacy Legal team is the front line for every regulatory, privacy, and data protection issue that touches the platform. We advise product and engineering teams on how to build things that work for merchants and comply with the law — often in jurisdictions where the law is still being written. We handle regulator inquiries, manage privacy incidents, negotiate with partners on data practices, and build the internal frameworks that make all of it scale. The team sits within Legal and works closely with, well, just about every other team in the company.
What you'll do:
• Provide privacy counsel on complex product launches, new features, and strategic partnerships — particularly where Shopify is handling merchant and buyer data in new ways.
• Partner on managing regulatory relationships and responses for privacy-specific inquiries, including from DPAs and US state enforcement agencies.
• Drive cross-functional privacy initiatives that move the program forward — not just maintain it. Build the resources, frameworks, and playbooks that let the privacy function scale with the business.
• Advise on data protection aspects of commercial agreements with merchants, vendors, and partners.
• Partner with Privacy Engineering and Trust on incident response, data governance, and compliance infrastructure.
• Maintain subject matter expertise in evolving global privacy law — GDPR, CCPA and other state laws, UK data protection, EU AI Act privacy implications, and emerging frameworks.
Qualifications:
• You have a qualifying law degree and license to practice in the US or Canada
• 4+ years of relevant legal experience — ideally a mix of law firm, government, and/or in-house.
• Experience advising on privacy and data protection matters, including both GDPR and CCPA.
• Technical literacy — you need to be able to understand how data flows through systems and why that matters for compliance.
You'll ramp up faster if you have:
• Experience engaging with regulators or enforcement agencies on privacy matters.
• Experience advising on AI and data governance issues.
• Experience building or shipping something using AI tools.
