Privacy & Product Counsel

About the role

Black Forest Labs, a research lab behind FLUX multimodal models, is hiring a Privacy & Product Counsel to join its Legal, Policy & Assurance team. The role sits close to research, product and engineering teams and helps shape how the company builds and ships its products. It is office-based in Freiburg, Germany or San Francisco, USA, or remote-first, with one full week per month in the office.

Key responsibilities

• Product counsel: advise product teams on new models, API features and products from first spec to launch, giving clear, risk-calibrated advice.
• Marketing: partner with Growth, Marketing and DevRel on launch announcements, model cards and campaign copy, and advise on privacy in product marketing, analytics, commercial and creator partnerships and advertising claims.
• Privacy by design: own the GDPR programme across the model lifecycle (training data, fine-tuning, inference, logging and retention), run DPIAs and privacy documentation.
• Customer commitments: support GTM on DPAs, zero-data-retention and no-training terms, security questionnaires and enterprise negotiations.
• International transfers and vendors: manage EU-US transfer mechanisms (SCCs, EU-US Data Privacy Framework, TIAs) and run privacy diligence on sub-processors and AI tooling.
• US privacy: track and implement CCPA/CPRA and other state privacy obligations and emerging AI-specific state legislation.
• Regulatory interface: prepare for engagement with data protection authorities, handle data subject requests, complaints and incidents, including breach assessment and notification.
• Policy and documentation: draft and maintain privacy notices, internal policies, records of processing and compliance documentation.
• Scale the function: build playbooks, templates and training so others can handle routine privacy questions.

Required profile

• 5-8 years' PQE as a qualified lawyer in an EU/EEA jurisdiction or the UK, with a strong focus on data protection and product counsel.
• Experience at a technology company, a top-tier law firm's privacy or tech practice, or both, ideally including in-house product advice.
• Track record advising on AI, ML or data-intensive products.
• Comfort giving direct, pragmatic advice under uncertainty, with strong drafting skills for DPAs, privacy notices, DPIAs and commercial privacy terms.
• Excellent written and spoken English; ownership mindset suited to a fast-moving, high-growth environment.

Required skills

• Deep practical command of the GDPR (and German BDSG), ePrivacy and international transfer rules, plus knowledge of how the EU AI Act interacts with them.
• Familiarity with US privacy and AI law (CCPA/CPRA, BIPA, state AI and deepfake statutes).
• Plus: experience with generative AI, computer vision or media products, data protection authority engagement, CIPP/E or CIPT certification, German, security and trust & safety interests.

What we offer

• Compensation of EUR 150,000-200,000 plus equity in Europe, or USD 200,000-250,000 in the US.
• Distributed team with real offices, working from home with one week per month in Freiburg or San Francisco.