Leading Privado.ai as Founder and CTO, our mission is to embed privacy into the DNA of software engineering. Overseeing the development of Privado, our open-source tool, we enable engineers to manage sensitive data with unmatched precision. This endeavor reflects our core value of making privacy a fundamental aspect of technology.

Prashant Mahajan

Privacy teams should be worried. This is exactly how the same mistake happens twice.

Crunchyroll already paid $16M over privacy allegations tied to user viewing data.

Now it is being sued again. Different vendor, same underlying problem: a company allegedly let third-party tooling access what people were watching, tied to who they were.

That is not a policy failure first.
It is a systems failure.

From the outside, this looks like “data sharing.”
Inside the product, it usually looks routine.

An SDK gets added for engagement.
Events start flowing. User identifiers get attached.
Viewing activity becomes a usable signal for someone outside your system.

That is how legal risk gets created quietly.

This is the part many privacy programs still miss:
- The contract can look clean
- The policy can sound right
- The consent language can be reviewed

But if the system is still sending user-level viewing events to a third party, none of that matters much.

Legal teams need to ask harder questions:
1. What events are actually leaving the app?
2. What identifiers go with them?
3. Can a vendor tie content consumption back to a person?
4. Who verified the live data flow after the tool was implemented?

This is why privacy work cannot stop at notices, reviews, and vendor paperwork.

Policies describe intent.
Systems reveal reality.

If your privacy team cannot see what product telemetry is doing in production, you are relying on assumptions, not controls.

How many companies that settled privacy claims have actually fixed the underlying data flow?

#Privacy #DataPrivacy #Compliance #Legal #Law

Privacy Engineering Infrastructure Leader | Founder & CTO, Privado.ai | Built $100M+ Scale Systems | Defining AI-Driven Privacy Automation

This week California regulators fined a company most people wouldn’t expect in a privacy case.

A high school sports ticketing platform.

Students used it to buy tickets for football games, prom, and school events.

But behind the scenes, the platform was running tracking technologies for targeted advertising.

And here was the catch.

You couldn’t view your ticket without clicking “agree” to tracking.

No real opt-out or alternative path.

So attending a school event effectively meant agreeing to ad-tech tracking.

Regulators fined the company $1.1M and forced changes to its practices.

What stands out to me is the architecture behind this.

A ticketing system quietly became part of an advertising infrastructure.

The core product and the tracking stack were intertwined.

This happens more often than teams realize.

A simple product integrates analytics, marketing tools, or ad-tech.

Over time those integrations start shaping how the product works.

And suddenly core functionality depends on tracking.

That’s where privacy usually breaks... in the system design.

If someone can’t use your product without being tracked, it’s worth asking:
Was tracking ever meant to be part of the product experience?

#Privacy #Engineering #DataPrivacy #CCPA #Legal

Over the last few months, I kept walking out of customer conversations with the same feeling in my head.

Privacy teams are carrying way too much.

Not because they are not good at what they do. Not because they are not working hard. Actually the opposite. The people I speak with are thoughtful, sharp, and deeply serious about the work. But the day to day of privacy work still feels heavier than it should.

One customer told us their setup was still very manual and dependent on annual refreshes.

Another said something that really stayed with me: 
“I don’t need a person to fill out a spreadsheet anymore.”

Another put it even more plainly:
“We need the result. We need the answer.”

And another said what I think a lot of teams feel, even if they do not always say it out loud: “We don’t know what we don’t know.”

That is the part I kept coming back to.

None of these people were asking for something flashy. Nobody was asking for another dashboard, another workflow, or another pile of features to learn.

They were asking for something much simpler.

Clarity.

A better way to understand what is happening across their digital environment. What changed. What matters. What needs attention. What they can trust.

That is why we announced Wren today.

Wren did not begin as a vague idea about AI. It came from a much more practical place. We kept hearing the same pain, from different companies, in different words, and it became hard to ignore.

Privacy teams are working in environments that keep moving. Websites change. Apps change. Cookies change. Configurations drift. New tools show up. Old assumptions stop being true. But too much of the work still depends on manual effort, fragmented visibility, and tools that make you dig for the answer instead of helping you get there.

So even when teams have scans, inventories, workflows, and documentation, the real questions are still there:
- What changed?
- Why was this flagged?
- Is this actually a risk?
- Can I trust this result?
- What do I take to legal?
- What do I do next?

That gap is exactly what led us to build Wren.

We want it to take on the investigative work privacy teams should not have to do manually anymore. 

To spot when something new needs review. 
To help trigger the right assessment. 
To pull in the right docs, scans, contracts, and context. 
To help generate the assessment with evidence, not guesswork. 
And to help teams track the risks that actually need action.

For us, this announcement is not about launching something new just because we can. It is about taking a problem we kept hearing again and again and deciding to build for it properly.

We want privacy teams to investigate faster. 
We want them to get to the “so what” without all the chasing. 
We want them to feel more clear, more confident, and a little less buried in manual work.

A part of why we are building Wren is very simple: 
We want privacy pros to smile more

Check the announcement link in the comment.

When the Meta AI glasses lawsuit came out, I did not just see a product story.
I saw a privacy operations story.

Because this is what keeps happening. Legal teams document one version of data use. The system quietly evolves into another.

A feature gets shipped. A vendor gets added. A review workflow appears.

Data starts moving in ways no one properly mapped. And by the time anyone notices, the documentation is already out of date.

That is why manual privacy processes are struggling in 2026.

They depend on people explaining what they think the system does. But privacy risk does not live in what people think.

It lives in what the system is actually doing. That is the gap.

Spreadsheets, policy reviews, screenshots, and questionnaires still have a role.  

But they are not enough for environments where products change constantly and AI introduces new data flows faster than governance teams can keep up.

Automation matters because it gives privacy teams something manual processes cannot.

Actual visibility. Not more opinions or better wording.

Evidence.

For legal and compliance teams, that changes the conversation from:
what was approved
what was documented
what teams said

to:
what is running
where data is going
which vendors are involved
what changed since the last review

That is a much stronger foundation for privacy accountability.

In 2026, the problem is not that teams do not have privacy processes. The problem is that most of those processes still cannot keep up with the systems they are supposed to govern.

How are you handling that gap today between documented privacy controls and actual system behavior?

#privacy #data #AI #automation

40 million Americans are asking AI about their health.

Most assume HIPAA follows that conversation.

It doesn’t.

When a hospital uses an AI tool, there’s a Business Associate Agreement. That creates shared legal responsibility. Access is scoped. Logs exist. Controls are negotiated. OCR can enforce.

When a consumer opens ChatGPT Health or Claude and uploads lab results, that structure disappears.

There is no covered entity. No BAA. No HIPAA enforcement mechanism.

The protection comes from product design and terms of service. Not healthcare regulation.

From a systems perspective, this is a completely different environment.

Enterprise deployments sit inside defined trust boundaries. Identity controls. Access segmentation. Audit logs. Contractual limits.

Consumer tools are multi-tenant platforms. Even with encryption and isolation, governance is standardized. Not negotiated.

Legal assumption. Health data equals HIPAA.

System reality. Regulation attaches to relationships, not data types.

That gap is where risk lives.

If you lead privacy, consider this:
- Are employees pasting patient data into consumer AI tools?
- Do your policies clearly separate enterprise AI from personal experimentation?
- Can you technically detect where health data is flowing?

If regulators asked, could you evidence the difference?

None of this makes consumer AI unsafe.

But it does mean the regulatory posture is different. And most organisations are not modelling that difference clearly.

AI in healthcare now operates in two silos.

If your governance framework doesn’t reflect that, you’re relying on assumption.

Can you actually prove which environment your data is in?

#dataprivacy #HIPAA #law #AI

GDPR fines have now crossed €5.6B in publicly known enforcement.

Most people will read that as a regulator story. I think it is really an evidence story.

The hard part is no longer writing the policy. The hard part is proving what actually happened inside the system.

That is where most privacy programs break.

On paper, the company has a notice, a retention policy, a RoPA, DPAs, and internal controls.

In production, the reality is usually different.

Data fields get reused. Events change names. New SDKs get pushed live.
Vendors receive data nobody reviewed.

AI features get added on top of existing systems without anyone fully mapping the downstream flow.

Legal teams are still expected to stand behind disclosures and controls.

But those claims are often based on interviews, screenshots, and documentation created at a point in time.

Systems do not work that way. They change every week. Sometimes every day.

So when enforcement happens, the real question is not, “Do you have a policy?”

It is, “Can you show evidence of what your systems actually did with personal data?”

That changes a lot.

Documentation shows intent... system evidence shows reality... privacy reviews without engineering visibility create blind spots and accountability without technical proof is mostly trust

This is the gap legal and privacy teams need to pay attention to.

The risk is not just non-compliance. The risk is defending a position that was true when it was written, but false in the live system.

Privacy programs need to move closer to engineering reality.

Not because lawyers need to become engineers. Because legal accountability now depends on technical evidence.

How is your team validating what production systems are actually doing with personal data today, beyond documentation?

#privacy #GDPR

I’ve built systems at scale. That’s exactly why I don’t believe manual data mapping works.

I was talking recently with a data governance leader at a large media publisher.

Their process still depended on manual updates, annual check-ins with system owners, and lineage they didn’t really trust.

Honestly, that’s not surprising.

The problem is bigger than process.

Most privacy teams are still being asked to understand data flow through surveys, spreadsheets, and interviews.

But production systems do not wait for annual refreshes.

Tags change. Vendors change. Pipelines change. New use cases appear. Data starts moving in ways nobody captures fast enough.

So the map gets updated.

The system has already moved on.

That’s the gap privacy teams are dealing with now.

Not a policy gap. A visibility gap.

My view is simple:

Policies describe intent. Systems reveal reality.

If your data map depends on manual refreshes, it’s probably already outdated.

How are teams closing that gap today?

#privacy #legal #law #data

Debra Farber JD, CISSP, FIP

Wicked6 Cyber Games Advisory Board

Debra J. Farber is a seasoned privacy executive and leader with over 20 years of experience operationalizing privacy across complex, data-driven environments. She spent the bulk of her career operationalizing privacy programs at companies large and small before shifting left into privacy engineering. She currently serves as Privacy Engineering Manager at Lumin Digital, where her team embeds privacy early into a cloud-native digital banking platform. Debra has led privacy and security programs at Amazon Prime Video, AWS, BigID, Visa, TrustArc, and IBM, and serves as Advisory Board member to several privacy tech startups, guiding them on product strategy, go-to-market messaging, and responsible data practices. In addition, with a strong interest and focus on responsible AI, she advocates for organizations to embed privacy and ethical guardrails throughout the AI lifecycle.

Debra is an active member of the privacy engineering community. A passionate advocate for shifting privacy left in the software development lifecycle to address privacy issues early, she created and hosted The Shifting Privacy Left Podcast, which published 63 episodes spotlighting how privacy engineers can integrate privacy early and effectively into the software development lifecycle before code is shipped and PII is ever collected. She's also a Member of the USENIX PEPR Conference's Programming Committee and is an Advisor to the Institute of Operational Privacy Design (IOPD). She holds a BA from Binghamton University, a JD from Brooklyn Law School, and a Certificate in Designing and Building AI Systems from Cornell University. She also holds multiple certifications, including the CISSP, CIPP/E, CIPP/EU, CIPT, and CIPM, among others. Her work sits at the intersection of privacy, security, engineering, and trust where she aims to consistently drive scalable, privacy-respecting outcomes.

Startup Mentor

Debra Farber

I am so tired of big tech’s surveillance capitalism and corporate privacy lip service. Dystopian literature was a warning not a guide book!

https://lnkd.in/ghGA6Qas

Seasoned Privacy & Data Protection Advisor

Global CEO at Renaissance | Positioning and story-telling for global B2B brands | Stanford GSB | IMD Alum | Where stories of brands & empires collide: jatinmodi10.substack.com

A $1.5T company just turned 7 million bedrooms into training data.

Last week, Swedish newspapers Svenska Dagbladet and Göteborgs-Posten published a joint investigation. 

Meta contractors in Nairobi arrive at their workstations each morning at a company called Sama. Video footage from Ray-Ban AI glasses, captured in bedrooms, bathrooms, kitchens, arrives on their screens for labeling.

A man places his glasses on a bedside table and leaves the room. His wife walks in and undresses. A worker in Kenya watches, draws annotation boxes, labels body parts for the algorithm.

Meta's marketing shows people at concerts, hiking trails, dinner parties. Lifestyle content for the main character era. 

The ToS tell a different story. You agree to share data with Meta's servers. Buried deeper, humans may manually review your footage.

Anonymization tools are supposed to blur faces. Workers say they fail regularly. Difficult lighting, bad angles, the algorithms miss. 

Seven million pairs sold in 2025. Meta and EssilorLuxottica are discussing doubling production to 20 million by year's end.

The workers feel uncomfortable but continue. 'You are not supposed to question it. If you start asking questions, you are gone.'

Meta's spokesperson responded with corporate boilerplate about 'privacy safeguards' and 'refining our efforts.' The same grammar Zuckerberg has deployed for two decades running.

2018: Cambridge Analytica harvested 87 million profiles to manipulate elections. 'We didn't take a broad enough view of our responsibility.'

2021: 2021: Internal research proved Instagram pushed self-harm content to teenage girls. Meta buried it and kept testifying 'no' to Congress.

2024: Senate hearing on children exploited via Instagram. 'I'm sorry for everything you've been through.' Then back to corporate mode within the same breath.

2026: Workers in Kenya watch you undress. 'We take the protection of people's data very seriously.'

The same apology rewritten for each era's scandal, while the internal plumbing that produces the scandal keeps scaling.

We tell ourselves surveillance requires malice. Secret police. Hidden cameras. Authoritarian intent.

The truth is gentler and worse. It only requires a product cool enough to wear, terms long enough to ignore, and workers poor enough to stay silent.

Every previous surveillance state required force.

Ours only required a product launch, a terms update, and a species too comfortable to read either.

taplio

The Battle

Prashant Mahajan

Debra Farber

Followers

Posts

Engagements

Likes

Performance ScorePrashant Mahajan's LinkedIn Performance

Performance ScoreDebra Farber's LinkedIn Performance

Ready to grow your LinkedIn presence?

taplio

The Battle

Prashant Mahajan

Debra Farber

Followers

Posts

Engagements

Likes

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}Prashant Mahajan's LinkedIn Performance

Performance ScoreDebra Farber's LinkedIn Performance

Ready to grow your LinkedIn presence?

Performance ScorePrashant Mahajan's LinkedIn Performance