**Colleen:** Hi, Paul. How are you doing?
**Paul:** Great. Thanks for having me on.
**Colleen:** So great to welcome you back to the Ketch privacy huddle. In case our audience hasn't seen your friendly face in a while, can you share just a little bit about yourself and the work that you do?
**Paul:** Sure. I'm Paul Singer. I'm a partner at Kelly Dry, and I chair our state attorney's general practice here at the firm. Essentially, I do everything, all things state related. Right? So anything that deals with, emerging legislative topics, or really enforcement, by state attorneys general, that's really my area of expertise. My whole background and experience is all related to broadly consumer protection issues. I spent twenty one years at the Texas AG's office in a variety of consumer protection roles. I spent a few years in the front office helping to develop policy, and now I've been with the firm for the last three years.
**Colleen:** Well, you joined at a busy time, Paul.
**Paul:** Yeah. Exactly. Yes. It was a it was a good time to to join the firm for sure. They needed you.
**Colleen:** Right. I love it. Well, I'm so excited to chat with you. When we speak with our customers, what the attorneys general are up to and what they're talking about is always a point of curiosity. I'd love to dive into a few topics. As we started chatting just in prep for this, one phrase you said caught my attention. You said more activity doesn't mean more enforcement. What does that mean?
**Paul:** You know, I should back up and make sure everybody knows that AGs talk to each other a lot a lot. I mean, a ridiculous amount. And they talk not just to each other, but also to the business community. Every month, I can tell you there are various meetings that are happening of different attorney general organizations. One of the recurring themes that you hear, no matter what organization, no matter what political party, is this concept that AGs really want to engage with the business community and understand as new laws are rolled out, how they are implementing them, what kind of hurdles they're having to complete implementation, and really engage in a proactive dialogue on the front end so that if there are issues on the back end, they've already built up relationship and trust between the enforcement community and the targets. And the reason I give that background is because when we talk about activity in the AG space, a lot of it is really policy development and trying to understand and get their arms around particular emerging technologies and emerging issues rather than taking a more targeted focused enforcement approach. So it's very different than, for example, dealing, like, with the Federal Trade Commission, who is purely this enforcement agency. You've got state attorneys general who are, for the most part, elected officials who are all responsive to their constituents. The their constituents means the business community as well. And so it it creates just a very different kind of policy conversation and dynamic than I think you see from just a pure enforcement standpoint.
**Colleen:** That makes a lot of sense. And I think, as you say, that speaks to just how interested they are in the actual applicability and usefulness of the guidelines they're putting in place. Right? It's not just about crossing t's dotting i's. It's about, are these laws actually helping consumers? Are they understandable to businesses? Do I have that right?
**Paul:** Yeah. That's exactly right. The practical implementation of any guidance or any law out of a state is, like, right in the wheelhouse of what AGs are focused on. And so they wanna make sure that everybody from consumer to business alike really understands what the rules of the road are and what they should be doing going forward. In particular, from a consumer protection standpoint, every couple months, we've got new technologies, new developments, new things that are just getting rolled out in everyday offerings and goods or services that consumers deal with. It's just a matter of making sure consumers are caught up and really understand what's happening. I think as a brand, that's really tricky to balance because you're trying to follow the letter of the law, but then also trying to just be practical. If you're in the attorney general's seat, what's the advice to the brand to balance between those things?
**Paul:** They've been pretty clear about that, quite frankly. When they've talked about especially sort of developments in privacy legislation and new products and offerings, they typically are really focused on this idea that, like, they will show some grace. They understand the complexities of technical compliance with their various laws. But that's why what I was saying before is so important. Right? Engaging early and having that relationship and really being part of the conversation with the enforcers, which they are welcoming, is what sets you up then to be able to come back later and explain why there may have been gaps or issues or hiccups that happened when it came to technical compliance. So I really do think the enforcer community is really taking to heart the idea that this is challenging. They just wanna see that you are a good corporate citizen and acting in good faith in their state. And that's where that big picture view becomes so important. If you can go in and you can explain to them, we put our customers first. Here is our culture of compliance within the company. Here's all the strides we take to make sure consumers understand and are accepting the type of data collection and use that we're doing. All of that goes a long way to I think negating the need to really talk about the very specific technical compliance that occurs. The last thing I'll say on this is that this is something I've advised clients many, many times is don't get too caught up in the nuances of the state law without looking at the state enforcer. Right? When you're thinking about compliance in any particular state, it is of equal importance to understand who actually enforces it in the state. What does that team look like? Is this a statute that is in a consumer protection division to enforce that doesn't have any particular privacy experts, doesn't have a dedicated unit to deal with privacy enforcement? Maybe just as confused about how to implement some of this stuff as the business community is versus a state like California that has a dedicated agency that is enforcing their privacy laws. Right? You have the whole spectrum of enforcer that you have to think about as you're approaching any particular state for compliance.
**Colleen:** From the software standpoint, it's been so interesting to watch over the last few years, both on the brand side and also the regulator side, leaders getting more and more adept at how technology fits into this conversation and has gradually turned from talking about policy and processes to, okay, actually, how does this translate to how I track pixels, tags, cookies? It's it's just been very interesting to see the increased sophistication.
**Paul:** Right. I mean, look, these lawyers and everybody in the enforcement side, they're all learning too. Right? This is all like an ongoing education, and it's part of why, there is sort of a unique opportunity in this space to help be the ones educating the enforcement community and the AGs themselves as well. I'd love to, talk about this importance of making the laws and regulations practical with an example. Can you talk a little bit about what we've seen in the auto sector? What can we take away from these examples of auto sector enforcement?
**Paul:** Yeah. I think there's a couple of things that I think are important to note and maybe why you've seen AG's focus in this area. One, I've been this is really hard for me to say, but I've been working in this space now for twenty five years. And, since I started as a baby lawyer, one of the things we used to always message and one of our constant refrains is, you know, as new technology is developed, the old laws still apply. And one of the key pieces when you think about things from a consumer protection standpoint is, are consumers and your customers up to speed with all of the new technology that you've rolled out? I say that because twenty five years ago, your car did not collect all sorts of information about you. Today, there's a a ton of information that your vehicle collects about you. That is just a huge drastic shift in a product that consumers use on a regular basis and think they're familiar with. And it's a question, like, how are you getting your customers up to speed with those changes and ensuring that they understand all of the different data points that are collected about them and then giving appropriate consent and acknowledgment that, yes, you're gonna collect and use this information in these following ways. Texas' most recent suit against Allstate and the litany of tease in Arity that were collecting information allegedly to then not just set sort of their own insurance rates, but sell it also to other insurance companies. That's kind of the perfect example where when you read the lawsuit, the emphasis is really on what the consumer is experiencing. And the fact that a consumer didn't fully understand the ways in which this information is being collected in a variety of apps on your phone and then utilized by this company and by other insurers potentially down the road. Right? It's just making sure consumers have that basic understanding to be able to give informed consent that I think drives it. So I really think one of the reasons you're seeing the emphasis in this sector is because this is an area that has seen rapid increase in the use of technology, a drastic shift in the way in which personal information is collected about you when you're using their products, and then just an effort across the board to make sure that customers really do understand all of these developments and that they've consented to to their use.
**Colleen:** You're right. The transformation in auto industry is wild, and it's gone pretty quickly from, oh, that's really helpful to, how did you know that? That creeps me out. Do enforcers look at at creepiness fast?
**Paul:** Yeah. I mean, I think it it's a I I I don't necessarily like using that phrase because I don't wanna imply that anything is necessarily creepy in particular data collection practices. But, yes, I mean, there are, you know, basic practices that your reaction is exactly, you know, what a customer might say is, wait. I didn't know this was happening. How are you even getting this information? And that happens in a lot of industries. Right? And it is something that's kind of like this creepy element that it's not necessarily an illegal activity, but it's something that just is unexpected or gives sort of pause to the customer. Like, I didn't know that was happening. Those are kinda red flags, I think, from an enforcer. And it's the kind of conduct that while in and of itself might not be illegal, it may cause an enforcer to take a deeper look at your data collection practices, how you're obtaining consent, what consumers really understand about your data collection practices. Like, all of that, I think, now becomes part of the conversation simply because you had this weird reaction to something that was unexpected or unknown from the customer. And so it it is something that, you know, just from a an operational standpoint, you should be thinking about how do I best make sure that that's not gonna happen for my product or my service because consumers aren't gonna be surprised at what they learn.
**Colleen:** Well, speaking of things that can seem or be creepy, let's talk about AI. Few years ago, it was GenAI. Now it's Agentic AI. It continues to evolve from an attorney's general perspective. What are their realistic expectations of businesses when it comes to AI governance right now?
**Paul:** I think that they are equally learning and trying to develop their own position these days. The handful of states that have actually started to put out some guidance and some some protocols for people, It it really does have more at this point to do with disclosure and ensuring that customers understand how you're using AI and what sort of critical decisions are being made by artificial intelligence versus a human, than it is about putting really tight constraints around the use of AI. And I think that's because the ultimate objective is to encourage this innovation and continue to see the technology grow and find other uses for it. But everything we've been talking about comes into play now. Right? This is really the next wave of making sure your customers understand how this technology is changing the product or service that they're used to using and from you.
**Colleen:** Yeah. Absolutely. Disclosure, I think that focuses it maybe on the requirement or burden that's on the brand right now. I, frankly, it's still challenging when I think about the sprawling ways in which AI is starting to be used in the business from the privacy leaders seat. Disclosure is not an easy task.
**Paul:** Right. No. I think that's right. And that that's where I see, like, a lot of this policy discussion turning over the next year, right, at the state level. It's really gonna be like, okay. Now, like, we're using it in so many different ways and so many capacities internally and externally and, like, how are we gonna get our hands around this? This is why engaging with that community now and making sure that, you know, this dialogue is being shaped by the actual users of the technology is gonna be so important in, really, I think, the next twelve months.
**Colleen:** Yeah. Absolutely. Well, Paul, it's been a pleasure chatting with you. Is there anything you would leave our audience with? Any practical takeaways?
**Paul:** I would just say you you really do, especially these days, need to keep the state AGs front of mind because I think that in many ways, they are gonna be stepping up enforcement across the board on a variety of consumer protection issues. And privacy as a whole is one of the few remaining areas where I think there is just large bipartisan support for continued regulation and enforcement. And so I really do think this is an area that AGs are gonna get increasingly active over the next three plus years. I really would say you need to keep them front of mind and ensure that you've got a cohesive strategy to be both proactive and reactive to what they're pushing forward.
**Colleen:** Good advice. Well, thanks, Paul.
