The 14% lift that was training your competitors' AI
From The Web Privacy Podcast · 27:52
Show by ObservePoint
SummaryA B2B team rolls out a shiny new AI conversion modeling tool and attribution jumps 14%. Marketing is buying champagne. Then legal finds section 8.3 of the DPA: the vendor may use "aggregated pseudonymized event data" to improve its general platform models, which means hashed emails and buying patterns from named enterprise accounts are now training a model that helps competitors target those same accounts. Emelie Kogut, Associate General Counsel, Privacy and Compliance at Zeta Global, joins host Ethan Prete on The Web Privacy Podcast to work the scenario from the platform side.Emelie explains why "pseudonymized and aggregated" is a contradiction that should never survive a legal review, why hashed emails are still personal data under the US state privacy laws, why this kind of leak can be worse than a security breach, what she does in the first 48 hours before anyone calls the vendor, and how to read an AI addendum for the one clause that matters. Essential listening for privacy, legal, procurement and marketing leaders who sign vendor DPAs. Chapters00:00 Cold open: a culture of understanding data00:43 Welcome and the 14% lift that sounds too good to be true01:47 Meet Emelie: commercial privacy at Zeta Global03:39 One privacy engineer and California's Delete Act05:02 The scenario: section 8.3 of the DPA06:20 Can privacy push back on a 14% lift?08:03 Where procurement broke down09:02 "Pseudonymized and aggregated" is a contradiction11:04 Why hashing does not equal anonymization12:35 Explaining pseudonymization to a CMO14:58 Why this can be worse than a data breach16:55 The first 48 hours after you find the clause19:21 AI addendums and the clause to look for22:33 Keeping the vendor conversation productive24:29 Transparency is the business model Takeaways- "Pseudonymized and aggregated" is a contradiction: pseudonymized data is still personal data, so a DPA with that phrase almost certainly never had a real legal review.- Hashed or de-identified data that can be re-identified is still in scope of the US state privacy laws; anonymization is a very high bar that targeted advertising rarely meets.- Privacy should come in twice: a vendor privacy review before contracting, and again at the contract stage.- A security breach has a clear beginning and end; data ingested into a vendor's shared AI model may never come back, so the damage can last for years.- Gather the facts first (amendments, SOWs, data maps), then meet the vendor, and keep the conversation non-combative; transparency, not data use itself, is what makes a vendor model acceptable. Connect with the GuestEmelie Kogut LinkedIn: https://www.linkedin.com/in/emelie-kogut-7551b033Company Website: https://zetaglobal.comEmelie attends the IAPP privacy conference in Washington, DC each spring. SponsorBrought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it.Learn more about your website here: https://www.observepoint.com/
More episodes of The Web Privacy Podcast
More episodes
- Public Data Isn't Free Data: Fabia Cairoli on AI Scraping and Web Privacy
- An 18-month tag leak behind a login screen. Is it a breach?
- How Luiz Santos handles a sub-brand or domain that goes rogue
- A privacy leader’s playbook for when the regulator comes calling
- From compliance to strategy with Fenwick & West
- The M&A Playbook from the Chief Privacy Officer at Synopsys Inc, Erin McCurdy
- Why Privacy Lawyers Are Becoming AI Lawyers: Mark Sanders at Tekion
- Privacy Checks Are Trust Builders, Not Roadblocks with Uche Orji
- Customer Relationships That Last Decades: Will Clayton at Marriott Vacations
- Privacy Is a Team Sport: Pari Sarnot, Privacy, Risk & Governance Leader
PodSearch is a free, independent podcast search engine. Read about PodSearch, the privacy policy or contact us.