Privacy Counsel

Instacart

8d•$193,000 - $244,000•Remote

About The Position

Instacart's global privacy program is scaling rapidly alongside the growth of its e-commerce, advertising, health, and AI-driven product lines, and the regulatory landscape is evolving faster than ever. This role exists to embed privacy into how Instacart builds and operates, ensuring product, engineering, data science, advertising, health, and business development teams have clear, practical guidance as they move quickly. Without this partnership, cross-functional teams lack the legal support needed to navigate complex data governance decisions, from adtech and retail data sharing to AI product development. A year from now, Instacart's privacy program is stronger, more scalable, and recognized as a trusted partner embedded across every part of the business.

Requirements

J.D. from a top-tier law school; membership in at least one U.S. state bar (California required or ability to register as in-house counsel)
6+ years of experience focused on privacy and data protection, at a leading law firm, in-house, or both
Deep working knowledge of CCPA, GDPR, HIPAA, and the evolving landscape of U.S. state privacy and health data laws
Experience advising on adtech, data sharing, and consumer data use in a retail, e-commerce, or platform environment
Strong ability to translate complex legal requirements into practical, business-oriented guidance for non-legal stakeholders

Nice To Haves

Experience with AI governance and privacy-by-design in ML/AI product development
Experience in AdTech

Responsibilities

Global privacy and data protection developments are actively monitored, with enforcement trends translated into clear, actionable guidance that business stakeholders can act on.
New products and business initiatives across e-commerce, advertising, health, and AI-driven product lines are reviewed and counseled through privacy requirements, with compliant design embedded from the start.
Instacart's advertising business operates with clear frameworks for data use, audience targeting, measurement, and consent, including well-governed restrictions on sensitive data in advertising contexts.
Data sharing arrangements with retail partners, advertisers, vendors, and subsidiaries are assessed and governed, with DPA, BAA, and cross-border transfer mechanisms (SCCs, DPF) in place.
Privacy program operations are strengthened: PRAs and DPIAs are supported, intake and documentation processes run effectively, and standard guidance, templates, playbooks, and training materials make privacy requirements accessible and scalable across the organization.