Senior Legal Counsel – Director, Privacy, Digital Products & AI Governance

At Credit Acceptance, we are building on the foundation of a successful business while investing in the future through technology, data, AI, and continuous improvement. As we continue to evolve, our Team Members play an active role in improving experiences, driving meaningful change, and shaping the future of our business. We foster an environment where people are empowered to contribute ideas, develop their careers, make an impact, and help lead our continued transformation.

Our Enterprise teams provide the expertise, insights, and partnership that help our business and people succeed. Team Members collaborate across the organization to solve challenges, support informed decision-making, and enable the strategies and initiatives that move our business forward. We value curiosity, continuous learning, and diverse perspectives from people who are passionate about making a meaningful impact on our customers, Team Members, and business.

Digital Engagement 

• Serve as lead legal counsel for the privacy and consumer-information aspects of the Company’s digital consumer journey, from prequalification through contract origination. 

• Advise on the acquisition, use, and sharing of consumer information, including FCRA permissible purpose, consumer-report authorizations, fraud prevention, and related consumer notices and consents. 

• Partner with the business in evaluating and selecting vendor products and data solutions that use consumer-report or other FCRA-governed information for identity and income verification, fraud prevention, and other consumer-engagement purposes. 

• Provide legal guidance for consumer-facing digital communications and credit advertising, including TILA and Regulation Z advertising requirements, digital disclosures, adverse-action communications, and other consumer-protection requirements affecting the digital experience. 

• Partner with Product, Engineering, Marketing, Compliance and origination counsel on the design and launch of marketplace capabilities, with this role owning the privacy, consumer-information, FCRA, digital consumer-engagement and consumer-facing credit-advertising framework. 

Privacy & Security 

• Serve as the primary privacy and information security counsel to Marketing, Engineering, and business teams on new features, products, and initiatives, from design through launch. 

• Interpret developments in federal and state privacy laws, including GLBA and FCRA, and turn them into practical, risk-based guidance. 

• Support the privacy program with Information Security, Data Engineering, and Compliance, including risk and impact assessments, privacy rights requests, and data retention and minimization. 

• Draft and negotiate data protection agreements, data-use restrictions, audit rights, and security schedules structured to protect the Company’s interests.  

• Lead legal strategy for any data breach or cyber incidents, including privilege, notification, and regulator engagement. 

• Keep legal and business leadership informed about the privacy and security program and emerging risks. 

AI Governance  

• Support the enterprise AI governance framework, including drafting policies, standards, risk classification, and the enterprise AI inventory.  

• Design and maintain the intake and assessment process used to enable the review and approval of AI tools and systems by Corporate Legal.  

• Draft and negotiate privacy and acceptable AI-use terms in dealer, technology, and vendor agreements, including permitted use, data rights, training restrictions, output ownership, and allocation of responsibility. 

• Partner with consumer finance counsel to advise on dealer and consumer disclosures when our AI tools shape what shoppers see or how dealers engage them. 

• Own the legal framework around AI training data, model documentation, and data retention, using the NIST AI Risk Management Framework as the standard. 

• Track AI regulation and agency guidance with Government Relations. 

• Interpret developments in Federal and state AI-related laws, and direct the business with compliant, practical, risk-based guidance. 

• Partner with other attorneys to support the business when developing and using AI that touches credit, fraud, or funding decisions, including ECOA/Regulation B, fair lending, model governance, explainability, and adverse-action considerations. 

Knowledge and Skills: 

• Deep knowledge of U.S. federal and state privacy, data protection, and cybersecurity requirements, including GLBA and FCRA. 

• Ability to interpret statutes, regulations, case law, regulatory guidance, and industry standards and translate them into practical, risk-based advice, tailored to the Company’s business practices. 

• Knowledge of operational privacy and data governance programs, including risk and impact assessments, privacy rights requests, data retention, data minimization, and incident response. 

• Expertise in drafting and negotiating data protection agreements, privacy exhibits, data-use restrictions, audit rights, security schedules, and related technology agreements. 

• Ability to structure and advise on the legal architecture of marketplaces, including consumer terms of use and shopper accounts, dealer participation terms, lead-sharing and data-sharing arrangements, and technology, licensing, and partnership agreements. 

• Strong product-counseling skills, with the ability to advise Marketing, Engineering, Information Security, Compliance, and business teams throughout product development and launch. 

• Expertise in artificial intelligence products, responsible data use, AI governance, risk assessments, inventories, policies, and impact analyses. 

• Strong issue-spotting, legal judgment, problem-solving, negotiation, and decision-making skills in complex and rapidly changing areas. 

• Excellent written and verbal communication skills. 

• Ability to lead cross-functional initiatives, influence stakeholders, manage competing priorities, and collaborate effectively with internal and external legal and technical experts. 

Requirements: 

• J.D. and active membership in good standing in at least one U.S. state bar, with the ability to register as in-house counsel where required. 

• 8+ years of U.S. legal practice.  

• Demonstrated experience as product counsel for a consumer-facing digital platform or marketplace, including launching new products, categories, or marketplaces. 

• Deep working knowledge of U.S. federal and state privacy and data protection law, and significant experience operating and/or building a privacy program. 

• Strong knowledge of the NIST AI Risk Management Framework and emerging U.S. federal and state AI laws. 

• Hands-on experience advising on AI products and building AI governance (for example, AI risk assessments, inventories, policies, or impact analyses). 

• A track record of drafting consumer notices, consents, and terms of use, and of negotiating data protection agreements. 

• Demonstrated ability to use AI-enabled legal tools responsibly and effectively, with examples of improved quality, speed, or risk identification. 

Preferred: 

• Experience in online automotive retail, an automotive marketplace, or auto finance. 

• Knowledge of consumer financial services law, including ECOA/Regulation B, TCPA, UDAAP, TILA/Regulation Z, and FCRA. 

• Demonstrated technical fluency in software development, data architecture, cybersecurity, or machine-learning systems; a technical degree is helpful but not required. 

• Significant in-house experience at a technology, marketplace, e-commerce, or consumer financial services company.  

• ISO/IEC 42001 training. 

• Experience engaging with regulators, industry groups, or standards bodies.  

• CIPP/US, CIPM, or AIGP certification. 

To be successful in this role, Team Members need to be:

• Positive by maintaining resiliency and focusing on solutions
• Respectful by collaborating and actively listening
• Insightful by cultivating innovation, accumulating business and role specific knowledge, demonstrating self-awareness and making quality decisions
• Direct by effectively communicating and conveying courage
• Earnest by taking accountability, applying feedback and effectively planning and priority setting

• Remain compliant with our policies processes and legal guidelines
• All other duties as assigned
• Attendance as required by department