Masters of Privacy

“You trust your chatbot with everything. Should you?” is the title of Theodore Christakis’ comprehensive research project on the privacy of our conversations with AI. Part two of this project (“Governments, Courts and the Battle Over Your Chatbot Conversations”) was published on June 8th, and we have taken the opportunity to ask the author for a high-level overview of his findings. On top of this, we have also discussed his separate piece on the rise of AI-powered health assistants against the backdrop of the new European Health Data Space, discussed last week in our Spanish-language channel.(Our previous conversation with Mr. Christakis focused on the use of personal data in LLM training datasets.)Theodore Christakis is Professor of International, European and Digital Law at University Grenoble Alpes (France). He holds, since 2019, the Chair on the Legal and Regulatory Implications of Artificial Intelligence at the Multidisciplinary Institute on AI (AI-Regulation.com). He is Director of Research for Europe at the Cross-Border Data Forum, a member of the Board of Directors of the Future of Privacy Forum, and a former Distinguished Visiting Fellow at the New York University Cybersecurity Centre.His work focuses on the questions at the centre of today’s debates on digital sovereignty: government access to data held by private companies, international data transfers, the security and operational resilience of digital infrastructure, and the regulation of artificial intelligence. He served as an expert for the OECD in the process that led to the adoption, in December 2022, of the OECD Declaration on Government Access to Personal Data Held by Private Sector Entities. He was a member of the International Data Transfers Experts Council of the United Kingdom Government, and an expert for the High-Level Expert Group on Access to Data for Effective Law Enforcement established by the European Commission and the Council of the European Union. He has also served as a member of the French National Digital Council and of the French National Committee on Digital Ethics.He has published or co-edited twelve books and is the author or co-author of more than 120 academic articles and book chapters. He has been invited to lecture and present his work at conferences, workshops and seminars on more than two hundred occasions, in over 38 countries.As an independent expert, he advises governments, international organisations and private companies on questions of international and European law, cybersecurity, artificial intelligence, digital sovereignty and data protection.References:* Theodore Christakis’ SSRN Author Page* Theodore Christakis on LinkedIn* You Trust Your Chatbot With Everything. Should You? Part I: How The Controller Uses Your Chat Data (March 3, 2026)* You Trust Your Chatbot With Everything. Should You? Part II: Governments, Courts and the Battle Over Your Chatbot Conversations (June 8th, 2026)* The Health AI Agent Rush: Five Companies, Your Health Data, and the Governance Questions Nobody Is Asking (March 25th, 2026)* Mikel Recuero: a deep dive into the European Health Data Space (ES, Masters of Privacy, June 2026)* Multidisciplinary Institute on AI* Université Grenoble Alpes: Centre d’études sur la sécurité internationale et les coopérations européennes. This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit www.mastersofprivacy.com/subscribe

It is time for a seasonal update at the intersection of Marketing, Data, Privacy and Technology. We will stick to our usual five blocks: ePrivacy & regulatory updates; MarTech & AdTech; AI, Competition and Digital Markets; PETs, Zero-Party Data and Customer Centricity; Future of Media.This season’s update includes:* EU, UK, and California fines (Free, Reddit, Disney, PlayOn)* Progress on the Digital Omnibus* Important CJEU cases (WhatsApp vs. EDPB)* AI capabilities spreading fast through MarTech and AdTech* OpenClaw, Moltbook, Manus, WebMCP* Fresh DSA and DMA enforcement in the EU (Google, TikTok)All references and links can be found in a separate blog post available to paid Masters of Privacy subscribers on our website’s Newsroom section (Newsroom Notes: Winter 2026).Our usual disclaimer: the voice that joins Sergio today is a text-to-speech output generated with Eleven Labs. This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit www.mastersofprivacy.com/subscribe

How does Google Consent Mode affect ePrivacy compliance, opt-in signals, traffic sampling, marketing performance, and CIPA claims? What are the most common technical mistakes in the configuration of Tag Managers, tracking rules, and consent banners? Where is “do not train” (LLMs) going? Does agentic traffic ruin analytics or the premises of consent?We have gone through all of this with a true Google Analytics, Google Tag Manager, and website auditing expert.Phil Pearce is founder of MeasureMinds and creator of ConsentModeMonitor. He started in paid search for CreditCards.com managing a multi-million dollar PPC account, before shifting to Privacy & Analytics about 8 years ago, when he did a series of talks about Black Hat Analytics. More recently, he has been helping brands with technical defence against CIPA & ePrivacy/PECR and GDPR claims. Prior to building his business, Phil worked for ConversionWorks, Jellyfish & Sitemakers as a Google Analytics and Search Specialist. He is a top authority in Google Analytics and Google Tag Manager and is the author of the GTM developer guide as well as host of the GA4ward, GTM4ward and Privacy4Marketers conferences.References:* Phil Pearce on LinkedIn* Consent Mode Monitor (Masters of Privacy Toolbox), free website scans for three months* Compliance Briefs (Masters of Privacy Toolbox), $500 discount for our listeners* Lineberry v. AddShopper, Inc. (3:23-cv-01996), May 29, 2025* MCP Manager by Usercentrics* Introducing DPO Central: AI-powered privacy program management* Sealmetrics: cookieless, consentless analytics This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit www.mastersofprivacy.com/subscribe

The business purposes of digital data collection are not so obvious to all, and things will get even more complicated in an internet dominated by AI agents. We will today revisit the history of Digital Analytics and its evolution from Marketing-centric Analytics to Product Analytics and, eventually, Customer Experience Management (CXM). From there we will address the origins and current state of the composable MarTech stack and the activation, personalization, or demand generation possibilities it unlocks, with a new generation of Customer Data Platforms and Data Warehouses at its core.We do this with the best possible guest. Adam Greco is one of the leaders of the data industry. As one of Omniture’s earliest customers and employees and a data consultant, he has helped thousands of organizations improve their digital properties through data. Adam has blogged extensively about data and authored the preeminent book on Adobe Analytics. He has held strategic roles at Salesforce, Amplitude, and several other leading organizations, having also served as a board member of several data technology providers and winning several awards from the Digital Analytics Association. Adam is a product evangelist at Hightouch, where he helps leading organizations strategize around using data to accelerate growth.References:* Adam Greco at Hightouch* Adam Greco on LinkedIn* Tejas Manohar: Data activation and composable CDPs in a privacy-first world (Masters of Privacy, January 2024)* What is Customer Experience Management? (Harvard Business Review, April 2025)* A deeper look at AI crawlers: breaking down traffic by purpose and industry (Cloudflare, August 2025)* Learning more about Digital Analytics: Marketing Analytics Summit (Santa Barbara, April 2026). This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit www.mastersofprivacy.com/subscribe

Dr. Gabriela Zanfir-Fortuna is a globally recognized data protection law expert, with 15 years of experience in the field split between Europe and the U.S., spanning academia, public service, consulting and policy. She currently is Vice President for Global Privacy at the Future of Privacy Forum, a global non-profit headquartered in Washington DC, coordinating FPF’s offices and partners in Brussels, Tel Aviv, Singapore, Nairobi, and New Delhi, and leading the work on global privacy and data protection developments related to new technologies, including AI. She is also a founding Advisory Board Member of Women in AI Governance, and an affiliated researcher to the LSTS Center of Vrije Universiteit Brussel.Dr. Zanfir-Fortuna worked for the European Data Protection Supervisor and is a member of the Reference Panel of the Global Privacy Assembly – the international organization reuniting data protection authorities around the world, as well as a member of the T20 engagement group of the G20 under Brazil’s Presidency in 2024.She was elected to be part of the Executive Committee of ACM’s Fairness, Accountability and Transparency (FaccT) Conference (2021-2022). Her scholarship on the GDPR is referenced by the Court of Justice of the EU, and in 2023 she won the Stefano Rodota Award of the Council of Europe for the paper “The Thin Red Line: Refocusing Data Protection Law on Automated-Decision-Making“, alongside her co-authors. Dr. Zanfir-Fortuna holds a PhD in Law with a thesis on the rights of the data subject under EU Data Protection Law, and an LLM in Human Rights (University of Craiova).With our guest, here for a third time, we have gone through the logic of the Digital Omnibus package aiming to reform a cluster of important EU regulations, the “birth defects” of the AI Act, the importance of South Korea in the global data protection panorama, and the potential consequences of the recent CJEU case, Russmedia.References:* Gabriela Zanfir-Fortuna at the Future of Privacy Forum* Gabriela Zanfir-Fortuna on LinkedIn* Gabriela Zanfir-Fortuna: A world tour of data protection laws (Masters of Privacy, April 2021)* Data Protection vs. Privacy and Data Privacy: a January 28th conundrum (with Gabriela Zanfir-Fortuna, Masters of Privacy - 2025)* X v Russmedia Digital SRL (CJEU, December 2, 2025). This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit www.mastersofprivacy.com/subscribe

Can AI agents be deployed for enhanced protection? What is a “triple extortion”? How is ransomware evolving? Is there hope for SMEs?Sam Kaplan is a policy, legal, and national security professional with over eighteen years of experience across the public and private sectors. He is currently the Assistant General Counsel for Public Policy & Government Affairs at Palo Alto Networks, providing legal guidance on domestic and international legislative, regulatory, and policy matters, with a focus on cybersecurity, AI governance, privacy, data security, international data flows, and public-private capacity building.Before Palo Alto Networks, Sam led the global product policy team for Facebook’s News Feed and News Tab at Meta Platforms, addressing issues like AI/ML fairness, algorithmic transparency, platform integrity, election security, misinformation, and harmful content.Prior to his private sector roles, Sam spent over thirteen years in the Federal Government. He held senior leadership positions at the U.S. Department of Homeland Security, including Assistant Secretary for Cyber, Infrastructure, Risk and Resilience Policy and Chief Privacy Officer. Earlier government roles included work at the U.S. Department of Justice (Office of Legal Policy, Bureau of Alcohol, Tobacco, Firearms and Explosives, and U.S. Attorney’s Office for the Eastern District of Virginia) and as Counselor to a member of the Privacy and Civil Liberties Oversight Board, focusing on the U.S. Intelligence Community.References:* Sam Kaplan on LinkedIn* Palo Alto Networks* Unit 42 Research (Palo Alto Networks)* Cyber Information Sharing and Collaboration Program (CISCP) at CISA (Cybersecurity and Infrastructure Security Agency) This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit www.mastersofprivacy.com/subscribe

It is time for a seasonal update at the intersection of Marketing, Data, Privacy and Technology. We will stick to our usual five blocks: ePrivacy & regulatory updates; MarTech & AdTech; AI, Competition and Digital Markets; PETs, Zero-Party Data and Customer Centricity; Future of Media.This season’s update includes:* CJEU Russmedia decision (“mere conduit” safe harbour overridden by a marketplace’s role as a data controller)* EU/UK DPA fines (LastPass-ICO, Infobel-APDB, AMEX-CNIL, AENA-AEPD)* California: Public enforcement (by both the AG -JamCity, SlingTV- and the CPPA) and status of CIPA lawsuits* Texas’ AG vs. TV manufacturers* New legislation: EU Digital Omnibus, California’s spree, US Executive Order on AI* Most recent adventures and daring moves of Meta, OpenAI, Google, Apple and X in the face of MarTech/AdTech constraints, market dynamics, antitrust actions and other enforcement initiatives.(Our referenced monographic episode on CIPA/VPPA litigation is available here.)All references and links can be found in a separate blog post available to Masters of Privacy Connect subscribers on our website’s Newsroom section (Newsroom Notes: Fall 2025).Our usual disclaimer: the voice that joins Sergio today is a text-to-speech output generated with Eleven Labs.Happy Holidays to all of you :) This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit www.mastersofprivacy.com/subscribe