In this episode:

(00:00) Intro

(01:07) Google fined €403M over location data. Data Protection Commission (DPC) of Ireland found transparency failures across Google's Web & App Activity, Location History, and Location Accuracy, as well as over-retention of location data, between 2018 and 2020. The podcast discusses why transparency has to work at each interface setting, why retention schedules have to be enforced, and why today's product decisions become tomorrow's enforcement cases.

(03:48) Oakland's drone-as-first-responder plan. Sixrooftop-docked drones, launched remotely to 911 calls. The city's Privacy Advisory Commission approved it with civil liberties amendments, and it now heads to City Council. This episode discusses what privacy-by-design looks like for public safety tech: purpose limits and short retention periods.

(06:27) Meta Muse and the consent problem with AI agents.Muse connects to email, calendars, and payments to act on your behalf. We cover training defaults, prompt-injection risk, and the unsolved question: who consents on behalf of the other people in your Inbox? Plus four steps companies shouldtake now as employees connect personal agents to work accounts.

(09:48) What the midterms mean for tech and AI oversight.New committee leadership in 2027 likely means more hearings on AI, federal privacy, kids' online safety, surveillance and the FTC, plus renewed activity in the states. Why AI regulation is now bipartisan, and why your documentationshould be ready for scrutiny.

(12:38) The AMA's governance framework for agentic AI. Four questions: function, evidence and risk, authority and oversight, and accountability. We discuss why "authority earned through evidence" is a better model for any agentic AI policy, in health care or outside of it.

(15:23) The common thread: autonomy without accountability is a liability.

Try this: Take your highest-risk AI use case and answer theAMA's four questions in writing. If you can't name who's accountable or what evidence would make you pull back the tool's authority, you've found your gap.

About the host: Nitin is the Principal at Aethicor, a data privacy and AI governance consultancy. He has led privacy and AI governance programs in-house and holds the IAPP AIGP, CIPP/E, CIPP/US, CIPM, CIPT, and FIP certifications.

Work with Aethicor: https://www.aethicor.com

Connect on LinkedIn: https://www.linkedin.com/in/nitgupta/

Episode 1: Five Privacy Stories, One Lesson

Privacy risk rarely starts with a breach. More often, it starts with a promise a company made and didn't keep.

In the first episode of Aethicor Brief, Nitin walks through five recent privacy and AI governance stories, from a carmaker selling driving data to a record penalty against Meta, and shows the one lesson that ties them together: what you say about data and what you actually do with it have to match. Regulators, courts and juries are getting very good at spotting the gap.

In this episode

• 00:00 – Introduction: five stories, one lesson
• 01:18 – GM's $220 million driver-data settlement. Thirty-six state attorneys general say GM collected driving behavior through its Smart Driver program and sold it to data brokers for insurance use, often after dealership staff accepted the terms on customers' behalf.
• 03:57 – Meta's $25 billion New Mexico penalty. A judge ordered the payment after a jury found 26 of 29 public statements misleading, many made on earnings calls and in TV interviews. Meta plans to appeal.
• 06:37 – SeatGeek's tracking-pixel win. A federal court dismissed a class action over TikTok and Meta trackers on standing grounds, and why that isn't a green light for your tags.
• 08:43 – India's publishers vs. the DPDP Act. Twenty-one news publishers have asked the Supreme Court to strike down parts of the law, while most core duties take effect on May 13, 2027.
• 10:44 – The EU AI Act's draft high-risk guidelines. Why a system's intended purpose, including how you market it, decides its risk level, and what that means for agentic AI, biometrics and workplace tools.
• 13:10 – The common thread and five actions for this quarter

Key takeaways

• Consent is only as good as the last person who collects it. Check who actually presses "accept" for your customers, and whether any incentive rewards volume over accuracy.
• Every public statement is a privacy statement. Executive talking points, investor materials and marketing need privacy review, not just the privacy policy.
• One court win isn't a compliance strategy. Know which pixels fire on which pages, and make sure your cookie banner and your tags agree.
• Don't wait for legal certainty to build. If you process personal data of people in India, plan your DPDP program around May 13, 2027.
• Your marketing helps define your AI's risk level. Build an AI inventory with a clear intended-purpose statement for each system.

Five actions for this quarter

1. Map who collects consent on your behalf, including partners, dealers and agents.
2. Bring public statements into privacy review.
3. Audit tracking tags against your cookie banner, starting after login and checkout.
4. Start your DPDP program if India is in scope.
5. Align each AI system's documentation and marketing on one intended purpose.

About the show

Aethicor Brief is a weekly podcast on privacy and AI governance as it plays out inside real organizations. Host Nitin holds the IAPP's AIGP, CIPP/E, CIPP/US, CIPM, CIPT and FIP certifications.

Need help closing the gap between what your organization says and what it does with data? Visit aethicor.com.

This episode is for general information only and isn't legal advice.