Privacy & Product Counsel

This role can be office-based in Freiburg, Germany/ San Francisco, USA or remote-first, with a requirement to be in the office one full week per month. About Black Forest Labs We’re the team building the foundational layer for visual intelligence: multimodal models trained jointly on images, video, audio, and action to see, generate, and understand the world. Our founding team pioneered latent diffusion and Stable Diffusion, the breakthroughs that made generative AI accessible to millions. With FLUX, we're pushing into generative media at scale, machines that act in the physical world, and emerging applications in computer use. Our FLUX models top public benchmarks and run in production in some of the world's biggest platforms. We're a small, fast growing research lab competing with the largest companies in the world. From our labs in Freiburg to San Francisco, we're building what comes next. Why This Role Every FLUX release, API feature and enterprise offering requires legal oversight. Black Forest Labs’ (BFL) frontier technologies raise questions where there is no established precedent – especially as we push further into video, perception and physical AI. We’re hiring a Privacy & Product Counsel to find solutions and help drive our product teams forward. You’ll sit in our Legal, Policy & Assurance (LPA) team and be embedded with research, product and engineering, shaping how BFL builds and ships. This is a hands-on role for someone who wants to build a privacy function at the frontier of AI and robotics. What You’ll Work On • Product counselling. Be the go-to lawyer for product teams on new models, API features and innovative products, from first spec to launch, giving clear, risk-calibrated advice that keeps us shipping. • Marketing. Partner with our Growth, Marketing and DevRel teams to review launch announcements, model cards and campaign copy so that our claims about FLUX are accurate. Advise on privacy matters relating to product marketing, analytics, commercial and creator partnerships, and advertising claims. • Privacy by design. Own BFL’s GDPR programme across the model lifecycle: training data, fine-tuning, inference, logging and retention. Run point on DPIAs and privacy documentation as required. • Customer commitments. Partner with GTM on DPAs, zero-data-retention and no-training terms, security questionnaires and enterprise negotiations – and work with the team to ensure that what we promise matches what we do. • International transfers and vendors. Manage EU–US transfer mechanisms (SCCs, the EU–US Data Privacy Framework and TIAs), and run privacy diligence on sub-processors and AI tooling. • US privacy. Track and implement obligations under US state privacy laws (CCPA/CPRA and peers) and emerging AI-specific state legislation. • Regulatory interface. Prepare BFL for engagement with data protection authorities, and handle data subject requests, complaints and incidents, including breach assessment and notification. • Policy and documentation. Draft and maintain privacy notices, internal policies, records of processing and the privacy elements of compliance documentation. • Scale the function. Build playbooks, templates and training so the rest of BFL can handle routine privacy questions without you. What We’re Looking For • 5–8 years’ PQE as a qualified lawyer in an EU/EEA jurisdiction or the UK, with a substantial focus on data protection and product counselling • Experience at a technology company, in a top-tier law firm’s privacy or tech practice, or both – ideally including time in-house advising product teams directly • Deep, practical command of the GDPR (and the German BDSG), the ePrivacy framework and international transfer rules, plus a working knowledge of how other relevant EU regulations,