Principal Counsel, Regulatory & Privacy

Eight Sleep’s legal team is one person today: our first in-house legal counsel, who handles everything from IP and litigation to privacy, regulatory, and commercial matters. You’d be the second lawyer, reporting to her, and for a while the team is the two of you. Your home-base is privacy and regulatory, and there’s a lot of it: the privacy program, FTC and consumer protection, advertising and subscription compliance, product and market-entry questions, and the healthcare-regulatory work that comes with our newer product lines. But this isn’t a role for someone who only wants to live in that lane. What matters most is that you’re willing to take on whatever lands on the department, and that you’re a genuine generalist, just as comfortable picking up a commercial contract, a litigation question, or a product counseling call when that’s what the week calls for. This is a build role. The company has grown quickly and the legal function is still taking shape, so you’ll be creating programs and processes rather than inheriting them, with a lot of room to own your work. It’s a good fit for someone who’s a self-starter, works hard, and is comfortable making decisions on their own without a lot of process.

Responsibilities

Build and run our global privacy program across the frameworks that apply to us (CCPA/CPRA, GDPR, and others): disclosures, consent, records of processing, and data subject requests; Own data processing agreements across our vendors, cross-border transfer and localization compliance, and our breach response playbook; Handle compliance for the biometric and health data at the center of our product, and run privacy reviews for new features, integrations, and AI models; Own FTC and consumer protection: health and wellness claims, advertising review, and subscription and auto-renewal compliance across our markets; Keep a practical read on what each market requires (product registration, import, labeling, disclosures) so we clear the way before we launch somewhere new; Track medical device and healthcare-regulatory questions as our health features grow, and help scope the legal path for new product categories (FDA classification, corporate practice of medicine, anti-kickback, HIPAA); Take on whatever the department needs outside your core area: commercial contracts, litigation support, product counseling, and the rest of the in-house docket; Act as embedded counsel to product and engineering, and help build out the function and legal operations alongside our in-house counsel

Requirements

JD and active bar membership in at least one US state; 8 to 12 years of relevant experience, including meaningful time in-house; solid working knowledge of the privacy and regulatory areas: US privacy (CCPA/CPRA), GDPR, and FTC and consumer protection; versatile generalist with experience across more than one area in-house; self-starter who works hard, makes decisions independently, and advises the business directly; comfortable in a fast-moving environment where you build rather than maintain

Nice to have

In-house experience at a consumer technology, healthtech, wearable, or DTC subscription company; Experience as a first or early regulatory or privacy hire; Biometric or health data experience; Cross-border transfer or data localization experience; Advertising, health-claims, or healthcare-regulatory experience (HIPAA, corporate practice of medicine, FDA/FTC intersection); Familiarity with AI governance and emerging AI regulation; CIPP/US or CIPP/E is a plus

Benefits

Pod of your own; Full access to health, vision, and dental insurance for you and your dependents; Supplemental life insurance; Flexible PTO; Commuter benefits; Paid parental leave; Equity participation and periodic equity refreshments