Customer Relationships That Last Decades: Will Clayton at Marriott Vacations

Summary What does it take to run privacy for a brand where the customer relationship lasts decades? Host Ethan Prete sits down with Will Clayton, Data Privacy Director at Marriott Vacations Worldwide, whose privacy career stretches back to 2000 and the early days of ad tech. Will explains why day one of a new privacy law actually starts at day minus 200, what happens to consent architecture when a customer moves from an opt-out jurisdiction to an opt-in one, and why the smartest compliance strategy is a single ethical policy that satisfies every jurisdiction at once. Along the way: who belongs in the privacy war room, who should own the consent and preference center, the real cost of negative marketing events like bounces and complaints, CIPA demand letters, AI governance, and how to spot privacy laws being weaponized. Essential listening for privacy professionals, marketers, and anyone building the infrastructure that sits between the two. Chapters 00:00 Introduction 02:45 From ad tech to privacy, a 26 year career 04:30 The line between caring and creepy 06:45 When customers move, preferences explode 09:00 Day one starts at day minus 200 11:00 Who sits in the privacy war room 13:45 One policy for every jurisdiction 20:45 Who owns the consent and preference center 23:00 Measuring the cost of negative events 28:45 AI governance and final predictions Takeaways - Day one of a new privacy law is a monitoring exercise, not a scramble: the program should be written, implemented, and tested 200 days before the effective date. - When a customer moves from an opt-out jurisdiction to an opt-in one, a binary consent switch becomes a matrix of flags, so preference architecture must be designed for people who move. - The strongest compliance strategy is finding the commonality: one ethical policy that satisfies every jurisdiction and extends rights even where no statute requires them. - Privacy earns executive buy-in by accurately describing consequences, because a lack of respect for consumer privacy is an existential threat to the mission, not just a compliance gap. - Marketers should measure negative events, including bounces, complaints, and opt-outs, with the same rigor as conversions, because creepy marketing is bad marketing. Connect with the Guest Will Clayton LinkedIn: https://www.linkedin.com/in/willclayton/ Company Website: https://www.marriottvacationsworldwide.com Sponsor Brought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it. Learn more about ObservePoint: https://www.observepoint.com/