Privacy & Product Counsel

Black Forest Labs

3d•Hybrid

About The Position

Black Forest Labs is hiring a Privacy & Product Counsel to join its Legal, Policy & Assurance team and work closely with research, product, and engineering. The role provides legal oversight for FLUX model releases, API features, and enterprise offerings, and helps product teams move forward with practical, risk-calibrated advice in areas where frontier AI and robotics technologies may have no established legal precedent. The counsel will advise on products from initial specification through launch; review marketing materials and claims; own the GDPR privacy program across the model lifecycle; manage privacy documentation, customer commitments, international data transfers, vendor diligence, and US privacy-law obligations; and prepare for regulatory engagement. The role will also establish playbooks, templates, and training to help the wider organization handle routine privacy matters. The role is based in Europe or the US and can be office-based in Freiburg, Germany, or San Francisco, USA, or remote-first from a home location. It requires spending one full week per month in the office in Freiburg or San Francisco. Compensation is €150,000–€200,000 plus equity in the EU, or US$200,000–$250,000 in the US.

Requirements

5–8 years’ post-qualification experience as a qualified lawyer in an EU/EEA jurisdiction or the UK, with a substantial focus on data protection and product counselling.
Experience at a technology company, in a top-tier law firm privacy or technology practice, or both; ideally including in-house work advising product teams directly.
Deep, practical command of the GDPR, German BDSG, ePrivacy framework, and international transfer rules, plus working knowledge of how relevant EU regulations such as the EU AI Act interact with them.
Familiarity with US privacy and AI law, including CCPA/CPRA, BIPA, and state AI and deepfake statutes.
Track record advising on AI, machine learning, or data-intensive products, with enough understanding of training pipelines, inference, and feature releases to ask engineers relevant questions.
Ability to give direct, pragmatic advice under uncertainty and turn novel legal questions into clear recommendations and workable product guidance.
Strong drafting skills across DPAs, privacy notices, DPIAs, and commercial privacy terms.
Excellent written and spoken English, including the ability to explain complex issues to researchers, executives, and regulators.
Ownership mindset and low ego; comfort working in a fast-moving, high-growth environment and building processes.

Nice To Haves

Experience with generative AI, computer vision, or media products, particularly involving biometric data, likeness rights, or synthetic media.
Direct experience engaging with data protection authorities or the EU AI Office.
CIPP/E, CIPT, or equivalent certification.
German language skills.
Interest in adjacent areas such as security and trust and safety.

Responsibilities

Advise product teams on new models, API features, and products from initial specification through launch, providing clear, risk-calibrated legal guidance.
Review launch announcements, model cards, campaign copy, and FLUX-related claims in partnership with Growth, Marketing, and DevRel.
Advise on privacy issues relating to product marketing, analytics, commercial and creator partnerships, and advertising claims.
Own the GDPR program across training data, fine-tuning, inference, logging, and retention; lead DPIAs and required privacy documentation.
Partner with go-to-market teams on DPAs, zero-data-retention and no-training terms, security questionnaires, and enterprise negotiations, and help ensure commitments match actual practices.
Manage EU–US transfer mechanisms, including SCCs, the EU–US Data Privacy Framework, and transfer impact assessments; conduct privacy diligence on subprocessors and AI tools.
Track and implement obligations under US state privacy laws, including CCPA/CPRA, and emerging AI-specific state legislation.
Prepare for engagement with data protection authorities and handle data subject requests, complaints, and incidents, including breach assessment and notification.
Draft and maintain privacy notices, internal policies, records of processing, and privacy-related compliance documentation.
Build playbooks, templates, and training so colleagues can address routine privacy questions.