The 14% lift that was training your competitors' AI

Summary A B2B team rolls out a shiny new AI conversion modeling tool and attribution jumps 14%. Marketing is buying champagne. Then legal finds section 8.3 of the DPA: the vendor may use "aggregated pseudonymized event data" to improve its general platform models, which means hashed emails and buying patterns from named enterprise accounts are now training a model that helps competitors target those same accounts. Emelie Kogut, Associate General Counsel, Privacy and Compliance at Zeta Global, joins host Ethan Prete on The Web Privacy Podcast to work the scenario from the platform side. Emelie explains why "pseudonymized and aggregated" is a contradiction that should never survive a legal review, why hashed emails are still personal data under the US state privacy laws, why this kind of leak can be worse than a security breach, what she does in the first 48 hours before anyone calls the vendor, and how to read an AI addendum for the one clause that matters. Essential listening for privacy, legal, procurement and marketing leaders who sign vendor DPAs. Chapters 00:00 Cold open: a culture of understanding data 00:43 Welcome and the 14% lift that sounds too good to be true 01:47 Meet Emelie: commercial privacy at Zeta Global 03:39 One privacy engineer and California's Delete Act 05:02 The scenario: section 8.3 of the DPA 06:20 Can privacy push back on a 14% lift? 08:03 Where procurement broke down 09:02 "Pseudonymized and aggregated" is a contradiction 11:04 Why hashing does not equal anonymization 12:35 Explaining pseudonymization to a CMO 14:58 Why this can be worse than a data breach 16:55 The first 48 hours after you find the clause 19:21 AI addendums and the clause to look for 22:33 Keeping the vendor conversation productive 24:29 Transparency is the business model Takeaways - "Pseudonymized and aggregated" is a contradiction: pseudonymized data is still personal data, so a DPA with that phrase almost certainly never had a real legal review. - Hashed or de-identified data that can be re-identified is still in scope of the US state privacy laws; anonymization is a very high bar that targeted advertising rarely meets. - Privacy should come in twice: a vendor privacy review before contracting, and again at the contract stage. - A security breach has a clear beginning and end; data ingested into a vendor's shared AI model may never come back, so the damage can last for years. - Gather the facts first (amendments, SOWs, data maps), then meet the vendor, and keep the conversation non-combative; transparency, not data use itself, is what makes a vendor model acceptable. Connect with the Guest Emelie Kogut LinkedIn: https://www.linkedin.com/in/emelie-kogut-7551b033 Company Website: https://zetaglobal.com Emelie attends the IAPP privacy conference in Washington, DC each spring. Sponsor Brought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it. Learn more about your website here: https://www.observepoint.com/