Product Counsel, Data & Privacy

Imprint • New York, NY

2d • $200,000 - $250,000

About The Position

Imprint is seeking a Product Counsel, Data & Privacy to join its legal team as the first-line owner of data, privacy, and information-security legal work. The role advises on partner data sharing, privacy opt-outs, FCRA and credit data, GLBA/Regulation P, data retention, and information security, supporting fast-moving product development while ensuring regulatory obligations are taken seriously.

This is a high-ownership individual-contributor position with responsibility for day-to-day data-sharing and privacy questions across existing and launching programs. The attorney will have direct access to senior leadership and will report to the Associate General Counsel, working with a small legal team and partnering closely with Product Counsel, Data, Security, Engineering, and Compliance teams. The role is suited to a self-driven attorney who builds cross-functional relationships and owns work end-to-end.

During the first 90 days, the successful candidate is expected to build relationships with Data, Engineering, Security, and Compliance stakeholders; take ownership of data-sharing and privacy opt-out reviews requiring legal sign-off; provide practical FCRA and GLBA/Regulation P guidance and help maintain internal guides; advise on data retention and a partner information-security or incident-response matter; and track and close legal requests with clear timelines and proactive communication.

Requirements

• J.D. from an accredited law school and active membership in good standing with at least one U.S. state bar.
• Four to eight years of experience in data privacy law, with demonstrated expertise in GLBA/Regulation P, FCRA, state privacy laws including CCPA, and consumer financial regulation.
• Experience in financial services, fintech, or a high-growth startup environment.
• Working knowledge of FCRA and GLBA/Regulation P, and familiarity with state privacy laws, including CCPA/CPRA and newer state regimes, and their practical application to data sharing and products.
• Experience advising on data-sharing arrangements, privacy notices and opt-outs, and data retention.
• Strong contract-review skills, including data-sharing agreements, DPAs, and regulatory-facing documentation.
• Comfort partnering with security and information-security teams on vendor risk assessments, data protection, and incident response.
• Ability to work autonomously, own work end-to-end, manage competing priorities, and deliver clear legal guidance under tight timelines.
• Strong communication skills, including the ability to explain legal risks and regulatory requirements clearly to engineers, analysts, business leaders, and other cross-functional partners.
• Willingness to research independently and verify findings with senior team members.

Nice To Haves

• Privacy certification, such as CIPP/US.
• Experience with FCRA in a lending or credit context, ECOA/Regulation B adverse action, and automated decision-making or AI governance, such as state ADMT laws.
• Familiarity with data-security frameworks such as PCI DSS, SOC 2, and NIST, and breach or incident-response processes.
• Familiarity with additional consumer finance regulations, including TILA/Regulation Z, EFTA/Regulation E, UDAAP, CAN-SPAM, and TCPA, and their intersection with data and product.
• Experience in sponsor bank, banking-as-a-service, or fintech partnership environments.
• Experience with GDPR applicability and ROPA obligations.
• Experience working in a ticketing or project-management system such as Linear, Jira, or Asana.
• Comfort with legal technology, AI-assisted workflows, and process automation.
• Experience with consumer credit products, such as credit cards or buy-now-pay-later.
• Experience building or standardizing privacy frameworks across multiple product lines or partner programs.

Responsibilities

• Advise on partner data sharing, including which customer, account, and application data may be shared through integrations and offline feeds, on what legal basis, and document the guidance for Data and business teams.
• Advise on privacy opt-outs and suppression obligations, including processing partner privacy files and honoring opt-outs across data sets and downstream third parties; maintain business-facing data-sharing and opt-out guides.
• Provide practical FCRA guidance on permissible purpose, use and reuse of credit reports, and sharing application and credit-decision outcomes.
• Advise on GLBA/Regulation P and consumer privacy notices, and draft, review, and maintain privacy notices and cardholder information-sharing notices.
• Interpret state privacy laws, including CCPA/CPRA and emerging state regimes, and automated-decision-making and AI requirements; advise on effects on data use, credit scoring, and product design.
• Own data-retention and deletion guidance, including mapping regulatory retention obligations and destruction requirements and supporting the record-retention policy.
• Partner with Security and GRC on partner and vendor information-security risk assessments, testing constraints, and incident response, including forensics, chain of custody, and breach or authority notification.
• Provide product counseling to Product and Engineering on new features and builds affecting data sharing, privacy, or customer experience, and draft needed consents and data-related terms.
• Coordinate with Compliance on regulatory interpretation, monitoring, and exam preparation; support the Associate General Counsel on escalated complaints, regulatory inquiries, and bank-partner matters.
• Translate complex data, privacy, and security requirements into clear, actionable guidance for cross-functional partners.
• Build working relationships with Data, Engineering, Security, and Compliance stakeholders and proactively communicate timelines and status on legal requests.

Benefits

• Competitive compensation and equity packages.
• Configured work computers of the employee's choice.
• Flexible paid time off.
• Fully covered, high-quality healthcare, including fully covered dependent coverage.
• Access to One Medical and the option to enroll in a flexible spending account.
• 20 weeks of paid parental leave for the primary caregiver and 8 weeks for all new parents.
• Access to industry-leading technology across business units, with investment in resources intended to foster innovation, optimization, and productivity.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: Ph.D. or professional degree