SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Eight Sleep is seeking a Principal Counsel for Regulatory & Privacy to join its legal team as the second in-house lawyer, reporting to the company's first general counsel. This is a build role at a fast-growing sleep fitness company that combines hardware, software, and AI to optimize human recovery through personalized sleep experiences.
The role centers on privacy and regulatory compliance but requires genuine versatility across the full legal function. You'll own the global privacy program across CCPA/CPRA, GDPR, and other frameworks—including disclosures, consent management, records of processing, and data subject requests. You'll manage data processing agreements, cross-border transfer and localization compliance, and breach response protocols. A significant focus is compliance for the biometric and health data central to the product, including privacy reviews for new features, integrations, and AI models.
On the regulatory side, you'll lead FTC and consumer protection compliance, including health and wellness claims review, advertising compliance, and subscription/auto-renewal compliance across markets. You'll assess market-specific requirements (product registration, import, labeling, disclosures) before new market launches and track medical device and healthcare-regulatory questions as health features expand. This includes scoping legal paths for new product categories under FDA classification, corporate practice of medicine, anti-kickback, and HIPAA frameworks.
Beyond privacy and regulatory, you'll handle commercial contracts, litigation support, product counseling, and other in-house matters as needed. You'll serve as embedded counsel to product and engineering teams and help build out the legal function and operations alongside the general counsel.
Required: JD with active bar membership in at least one US state; 8–12 years of relevant experience with meaningful in-house time; solid working knowledge of US privacy law (CCPA/CPRA), GDPR, and FTC/consumer protection; demonstrated versatility as a generalist across multiple legal areas; self-starter mentality with independent decision-making; comfort in fast-moving, build-oriented environments.
Preferred: In-house experience at consumer tech, healthtech, wearable, or DTC subscription companies; first or early regulatory/privacy hire experience; biometric or health data expertise; cross-border transfer or data localization experience; advertising, health-claims, or healthcare-regulatory background; AI governance familiarity; CIPP/US or CIPP/E certification (experience weighted over credentials).
