[Hiring] Associate General Counsel, Privacy @Shopify

Role Description

Shopify's Regulatory and Privacy Legal team is the front line for every regulatory, privacy, and data protection issue that touches the platform. We advise product and engineering teams on how to build things that work for merchants and comply with the law — often in jurisdictions where the law is still being written. We handle regulator inquiries, manage privacy incidents, negotiate with partners on data practices, and build the internal frameworks that make all of it scale.

You're a privacy lawyer who actually likes the hard parts:

• The ambiguous product question where GDPR and CCPA point in different directions.
• The data flow that doesn't map cleanly onto any regulatory framework.
• The partner negotiation where the data rights in the DPA are hotly contested.

You should be a generalist with depth, able to triage a broad range of global privacy issues:

• Cookies in the UK.
• Ads consent in the EU.
• CCPA enforcement in California.
• Data localization in India.

You use AI tools reflexively, not as a novelty, but as a baseline for how you work. If you're not already using AI to draft, research, and build, this probably isn't the right fit.

This role reports to the Director, Privacy Legal.

Qualifications

• You have a qualifying law degree and license to practice in the US or Canada.
• 8+ years of relevant legal experience — ideally a mix of law firm, government, and/or in-house.
• Substantial experience advising on privacy and data protection matters, including both GDPR and CCPA.
• Technical curiosity — you need to be able to understand how data flows through systems and why that matters for compliance.
• Experience managing outside counsel.
• A privacy certification (CIPP/US, CIPP/E, CIPM) is a plus but not required.

Requirements

• You communicate complex privacy concepts in plain language.
• You have strong judgment about risk.
• You build trust across teams.
• You're pragmatic about regulatory risk.

What you'll do

• Provide privacy counsel on complex product launches, new features, and strategic partnerships.
• Partner on managing regulatory relationships and responses for privacy-specific inquiries.
• Drive cross-functional privacy initiatives that move the program forward.
• Advise on data protection aspects of commercial agreements.
• Partner with Privacy Engineering and Trust on incident response, data governance, and compliance infrastructure.
• Maintain subject matter expertise in evolving global privacy law.

Company Description