Privacy in Practice

The episode contains numerous actionable insights for privacy practitioners: misconfigurations as the primary violation source, vendor evaluation criteria, contract language requirements, opt-out mechanics across ecosystems, data broker registration ambiguity, and practical risk assessment frameworks. However, some sections repeat established concepts (GDPR vs. CCPA differences, settlement trajectory) and include filler transitions that reduce density.

“a lot of them stem from misconfigurations. A lot of them stem from situations where the company didn't fully understand what the expectations and what the law required”

“you need to be really careful about the vendor you choose. Some vendors are sent up more to address GDPR than they are to address California privacy law”

The episode offers useful practitioner perspective on enforcement trends and vendor liability, but largely reinforces existing regulatory guidance and publicly available settlements. The data broker definition ambiguity discussion is timely but acknowledges uncertainty rather than proposing novel frameworks. The framing around misconfigurations vs. malice is useful but not groundbreaking.

“most of these are not situations where the company completely neglected the law and said I'm not going to do anything”

“the difference between having like a really good lawyer and an AI is that you're going to have somebody who's going to say, look, this is technically what's required. But let me tell you about what the practical implications are going to be”

Daniel Goldberg is a highly credentialed, practicing privacy attorney with direct involvement in major California enforcement actions (Jam City, Tilting Point settlements) and named 2025 California Privacy Lawyer of the Year. He demonstrates deep regulatory knowledge from multiple enforcement mechanisms (AG office, CPPA, FTC), recent industry involvement, and willingness to acknowledge uncertainty. This is a genuinely strong operator guest.

“chair of the Data Strategy, Privacy and Security Group at Frankfurt, Kernit, Klein and Salz and was named the 2025 California Privacy Lawyer of the Year”

“my team has been involved in two of these. We were involved in the public settlement with Tilting Point Media and with Jam City”

The episode cites specific enforcement cases (Sephora, Doordash, Tilting Point, Jam City, Healthline, Tractor Supply, Disney), named settlements with figures ($1.35M Tractor Supply, $2.75M Disney), and technical examples (GPC, OOPS, Liveramp, Trade Desk, Sephora opt-out mechanism). However, many allegations and settlement details are discussed at medium level of abstraction rather than with full granular breakdown of violations or remediation specifics.

“Sephora and I believe that was at the end of 2022. And then there was Doordash”

“Tractor Supply had that, you know, 1.35 million settlement”

The hosts ask substantive follow-up questions (opt-out matching, data broker definition boundaries, emerging AI issues) and occasionally push back ('why do other sites not follow suit?'). However, several questions are softball or allow long declarative answers without sharp challenges. The Disney settlement segment at the end feels rushed and adds hosts' summarization rather than challenging the guest further. There's insufficient productive disagreement.

“You've mentioned that a lot of the settlements obviously happen behind closed doors. What is the attitude of the regulators?”

“how much effort are we supposed to go to, to, to find people in all of our platforms?”