Associate General Counsel, Privacy (Americas)

About the role

The Regulatory and Privacy Legal team at Shopify is the front line for every regulatory, privacy, and data protection issue that touches the platform. We advise product and engineering teams on how to build compliant solutions—often in jurisdictions where the law is still evolving. The team handles regulator inquiries, manages privacy incidents, negotiates data practices with partners, and builds internal frameworks to scale these efforts. We sit within Legal and collaborate closely with nearly every other team in the company.

Responsibilities

• Provide privacy counsel on complex product launches, new features, and strategic partnerships, especially where Shopify handles merchant and buyer data in new ways.
• Partner on managing regulatory relationships and responses for privacy-specific inquiries, including from Data Protection Authorities (DPAs) and US state enforcement agencies.
• Drive cross-functional privacy initiatives that advance the program, building resources, frameworks, and playbooks to scale the privacy function with the business.
• Advise on data protection aspects of commercial agreements with merchants, vendors, and partners.
• Collaborate with Privacy Engineering and Trust teams on incident response, data governance, and compliance infrastructure.
• Maintain subject matter expertise in evolving global privacy laws, including GDPR, CCPA and other state laws, UK data protection, EU AI Act privacy implications, and emerging frameworks.

Requirements

• You communicate complex privacy concepts in plain language, tailoring explanations for engineers, regulators, and other stakeholders without oversimplifying.
• You exercise strong judgment about risk, comfortable making calls under uncertainty in a role that goes beyond compliance checkboxes.
• You build trust across teams—product, engineering, legal, trust & safety, finance—so colleagues actively seek your input rather than avoid it.
• You’re pragmatic about regulatory risk, distinguishing between legal requirements and areas where regulators *might* focus.
• You use AI tools as a baseline for drafting, research, and workflow efficiency—not as a novelty.

Qualifications

• Qualifying law degree and license to practice in the US or Canada.
• 8+ years of relevant legal experience, ideally blending law firm, government, and/or in-house roles.
• Substantial experience advising on privacy and data protection, including GDPR and CCPA.
• Technical curiosity to understand how data flows through systems and its compliance implications.
• Experience managing outside counsel.
• Privacy certification (CIPP/US, CIPP/E, CIPM) is a plus but not required.

You’ll ramp up faster with experience in:

• Engaging with regulators or enforcement agencies on privacy matters.
• Advising on AI and data governance issues.
• Building or shipping solutions using AI tools.

About Shopify

Shopify puts independence within reach for entrepreneurs and enterprises, powering over $1 trillion in sales for millions of merchants across 175 countries since 2006. Our work directly impacts lives—both for the merchants we serve and for ourselves. We thrive in environments with change, complexity, and ambiguity, embracing discomfort as part of growth. If you excel in fast-paced settings, seek hypergrowth, and prioritize critical thinking over routine tasks, Shopify may be the right fit.