veBINAR: Unlock Client Value: Why Compliance is Crucial for the Startups You Serve

Welcome everybody. Welcome to this edition of the Vendax webinar. We are very happy to have Shane and Michael Adler with us and they'll be introducing themselves shortly. The topic for today is compliance and particularly compliance for small and medium sized businesses who are typically falling short in that department and who aren't ready yet to hire a full time chief compliance officer. A few housekeeping notes. We are recording this webinar and we'll make it available afterwards. We will be doing about a 25, 30 minute interview or I will be doing that interview with the two of them and after that we'll open the mics for Q and A and you will have an opportunity to ask questions. And if anything comes up in the meantime, please feel free to use the chat or the comment function on LinkedIn Live to leave comments there and I'll ask those questions to the two of them. Shane, Michael, welcome to this webinar. Why don't you introduce yourselves first so that we have an idea of who you are and how you're connected to the compliance topic.

Absolutely. So I'm Shane Adler and this is Michael and we co founded HOS Data Consulting which is a fractional compliance officer firm and we offer fractional chief privacy Chief compliance Officer services to startups and SMBs. We each have a background in law, we both have our JDs and we went on to then apply those in the business world. So I graduated from University of Michigan Ross two years ago and was just taken with the world of entrepreneurship and the startup world and SMBs. And that dovetailed nicely with your dissertation.

Yeah, I did the, the cheaper route and I went to Europe for my, my business degree. So I did that in, in England for a fraction of the price. A great experience. And you have had a lot of experience Prior to my current career in the intelligence community and then presently, you know, after that with top law firms and then multiple technology companies. I was the global Gift Card Council for Amazon. I had a great email address. It was mad Amazon.com, which is you probably you don't even need a business card with that was a global e commerce and marketing council for Autodesk. I created their privacy program and then I've helped other startups build their privacy programs, also negotiate different transactions. It could be raising different rounds of financing, could be liquidity events and I've consulted on a lot of different occasions like those.

But your dissertation was focused on leveraging compliance with data privacy regulations specifically to gain a competitive advantage for startups and SMBs. And we realized that there was a really a gap in the market in that space while he was doing his research. And we built ATOs on that concept.

Yeah, it's a kind of a synthesis of the legal and business foundation that really tries to target the appropriate return on investment that you could both overspend and underspend on compliance. And it really depends on the nature of the company and the expectations are different depending on the size of the company and the nature of the data that the company processes. But for every company there are investments they can make that would maximize value. And we kind of talk about that across three different types of audiences, who that value is for. And we help kind of calibrate, you know, what is the right approach for them to achieve that.

Yeah, you're a great example for the, the fact that every executive function can be fractionalized. So what does a typical engagement with a client look like for you in terms of the sort of, is it more project work, is it ongoing work? You know, how many hours or how much time in a, in a week or in a month do you spend with a typical client? Can you talk a little bit about that?

Well, the ideal engagement would be longer term because compliance is not a one time, check the box exercise. It really needs to be an ongoing process because the landscape of regulations are changing, the business needs, the products change, et cetera. So ideally it is a longer term relationship. That being said, there are opportunities for project based work or finite engagements for for example, consulting on a liquidity event or just doing an initial analysis and helping a smaller startup get a grip on where they are and where they should be targeting. But with, with the landscape of regulations evolving so rapidly, especially with AI regulations which are, it's kind of the wild wild west in terms of compliance, you need to continuously have touch points to check where you're at as far as where, as far as compliance and how your product, how your organization fits.

Yeah, I would just echo that. It's very much more of like a, like health, you know, it's a journey. And any company that says they're GDPR compliant is lying to some extent. Right. And every company's gonna be lying to a different extent because it's a practical impossibility. And even if it was true for a single snapshot one or two months later, it's likely to not be true. And especially with small companies, I think this is where we have, we approach it often from a consulting rather than from a purely doctrinal legal lens. A lot of it is looking at the significant amount of regulation that they may have to comply with at some point. And effectively saying 80% of this you should ignore for now, here's the 20% of it that would really maximize your investment. And we can talk later on about what that investment looks like in the why but but it's not about peanut butter and kind of that compliance across and then again where it would be best as a relationship a year or two later, you know, they can build on that foundation as the expectations grow, as the company has the price of success and kind of flesh out their program from regulatory standpoint over time.

And I think that to your question regarding how much time on a weekly monthly basis, it's going to depend which is everyone's favorite answer on what the business's core product is. Because if you are dealing with children's data, other sensitive data, financial information, health information in the US Employment like AI and employment contexts, for example in Europe, those are complex. They're sensitive, they need they require a higher degree of scrutiny and oversight. Somebody running a standard retail business and just collecting marketing information for a limited purpose, you're not going to need nearly.

As much when even where the needs are high.

Right.

Part of the benefit and the intention of it being fractional is for someone to do what I do full time, probably fully landed easily around half a million a year. And even if the company wanted to spend it, as fun as I think I am to talk to and as interesting as I find all of these subjects, they probably need to run the business and don't want to talk to me that often every day. So some of it is kind of meeting them where they are. And you know, almost like if you're building a small campfire, you don't want to drop a giant log on it. So even when there's a lot to do, it still has to be balanced not against just the cost, the actual cost, but the opportunity cost of their time.

Are you typically brought in when some event has happened that created an awareness that there is a gap, or are you more brought in on a proactive basis by founders, owners, CEOs that say, I understand the importance of the problem, let's tackle it before it becomes a. Before there is an event?

I think ideally it's the latter. Always. I think when a product is being built in an industry that is somewhat aware of that, they need to follow certain rules or they want to be GDPR compliant or HIPAA compliant, they tend to be more proactive in other situations, which has been rare. It's going to it's we would be brought in after the fact to Band Aid the situation, but.

Or it's during like again, like we're a lot where they're often proactive. It's, it's like Shane suggested, they know they're in a heavily regulated industry, which in the US tends to be, you know, finances, kids stuff and healthcare. In Europe, their definitions of sensitive data are different. But in the us companies in those fields know that they're, they are going to be under additional scrutiny. So they are a little bit more proactive. Otherwise it's often, I wouldn't say fully reactive, but like you were saying it, when something is happening on the best case scenario, it's they're trying to raise, you know, a Series C and they want help putting some things together in advance of that because that's going to help determine their valuation. I've been brought in actually in a liquidity event on the buy side. And this is from a company that didn't really think it was in a heavily regulated area. And I was helping the assisting consulting with the buyer, not the seller. And based on their practices or their lack of practices, we were able to reduce their valuation. And so these privacy and other regulatory practices tend to be fairly important to companies. Valuations. Their initial asking price was in eight figures and we brought them down to about mid six figures ultimately. And much like if you're selling a house and you have a buyer come in and they bring a really good inspector, you know, widowmaker inspector, and they find that there's a bad foundation or mold or other issues, you have to disclose that to other buyers, otherwise it's fraud. So once I had identified those issues, the seller had to then disclose them to future, future potential buyers. And it really destroyed a lot of the value that those two founders had created in the company.

It was really tragic. It didn't feel great.

That's where it's a surprise. Like these weren't bad people. Right. They just hadn't done some of the things they needed to do which really eroded the value of their product.

They didn't know what they didn't know.

Yeah, yeah.

You mentioned earlier, Michael, that there are three audiences. I would imagine the investor is one of the audience. Who are the other two?

I would say the. The third audience. Right. The least important, the distant third, believe it or not, is a regulator. And I've dealt with them in the us, Canada, Germany, even South Korea. They're a distant third. Especially for SMBs and startups, the number one audience that companies tend to run into. And this is also a one of the calls for action, right? When they might reach out for help, especially if they're B2B, they're looking to sell to an enterprise company.

It's customers, right?

It's customers, especially in the B2B space. Those are the first kind of form of diligence where the procurement group within the company is going to ask them, they're going to send an rfp, they're going to ask them all these questions about how do you comply with the EU AI act, how do you comply with California privacy law, how do you comply with hipaa? And they want to sell. And so there's money on the table. They get these forms in and they don't know how to answer the questions. And they certainly don't want to commit fraud. Right in answering the questions. So the audience that I think comes up kind of first and most often by far are going to be customers. And then you're exactly right, it's going to be investors. And that could be investors as you're raising money, or it could be liquidity events like an ipo, or it could be again, an M and a type of transaction. It's kind of the secondary audience because when you go through those, you're going to be subjected to diligence by people like me on the other side. And then again, last but not least, our regulators and I think a lot of smaller companies who aren't in what they believe to be heavily regulated industries, they focus too much on the regulatory aspect, the regulators, and that tends to be the least likely harm for their business in the short to medium term.

Regulators don't have infinite bandwidth for monitoring every company out there. And that's honestly why the penalties are so high, because they want to make an impact with the ones that are levied.

There's a connection there too, right? When I've dealt with those regulators, if you have not been perfect, because again, it's the old expression, find me the man and I'll show you the crime. Any regular has enough discretion to find something you've done wrong. But if you have, with the first audience, customers and the second audience, investors in mind, put together good faith, a program that you can demonstrate. Here's what I've thought about, here's what we're doing, here's what's our roadmap to do those conversations become ones of remediation and working with them on milestones. And you tend to be able to resolve them fairly amicably with it with a shared plan. However, if you do, you know, in the unlikely event a smaller company does get an inquiry from a regulator and they haven't done anything where they can demonstrate good faith, that's typically where you hear conversations around either things like fines or requirements to stop data processing, different types of injunctions. Again, that's often what lawyers use to scare companies. And they do happen. But I find that typically if you can show good faith and also if you know how to talk to regulators and you're polite and you're agreeable and cooperative, it usually doesn't result in the type of draconian penalties in those situations.

As you know, we're in the business of placing fractional sales leaders and we have our own arguments and our own comparisons to the alternatives. So in the case of you as a fractional chief compliance officer, what are the alternatives that you see SMBs embrace and why is the fractional solution the better solution?

Well, the classic alternatives would be to hire counsel, privacy counsel or compliance counsel, or a full time CPO or cco. But honestly, those are very expensive alternatives. Like Michael said, a full time chief compliance or chief privacy officer, base salary alone, not counting benefits, is somewhere in the 3 to $500,000 a year range. And then an attorney in the field who would be at the level you would want to really do the job. Right. I mean, you're looking at what, 1200 to $2,000 an hour. But honestly, the alternative that most businesses unfortunately choose is doing nothing, which ends up being the most expensive in the.

Long term because we get M and A target, right?

Yeah.

They end up going from eight figures to six figures.

It was a fairly expensive 96% decrease in valuation. So that ends up being the, our competitor for the most part.

Yeah, yeah. And I think the other point to really emphasize again is the opportunity cost. Right. Most of these companies, even if they, you know, I decided to do it for free and I was on board full time as a cpo, they wouldn't have the throughput. The bottleneck wouldn't be me. The bottleneck would be their ability to spend, devote the time to operationalizing the things that they need to do that I advise them on. So the full time approach for a smaller company, that really tends to be a bad allocation of resource, high opportunity costs. Similarly with outside counsel, and I've worked with, and I speak with, and I just spoke in Washington D.C. with, with some of these folks and I've spoken in California with them, they're really fantastic. But if you ask them a question, you're going to get a 20 to 40 page legal memo that is going to tell you and do a great job of telling you all the things you need to do. What they're not going to do is an attorney is tell you, Here are the 80% of things to ignore this year. Not that they're not something you should do eventually, but in plain English, here's what you should focus on based on your business, based on your model, based on your geography. Here's what makes sense for this. First click stop, and then let's build on this and then we can see what makes sense for year two.

Compliance is important, but it's typically, except for people like us, not your core business. You want to be putting your energy into product development or whatever is at the center of your business.

And last thing I'd say is outside counsel. It's a little bit like a subcontractor. And often larger companies like Amazon, they'll have in house counsel who then work with outside counsel. And then you have the general specialist that's kind of reaching out for some nuanced questions. Or maybe another analogy, it's like your friend that's a car expert taking them with you to the mechanic.

Right?

You're going to get a much better return on your investment when you need to do that. If a smaller company reaches out to outside counsel, they're not going to know what, what they don't know. And they're not going to know how to use that person's time efficiently either.

So you, you definitely place yourself on the side of the small business owner and are their advisor, as you are their fractional executive, helping them implement the right changes, the right programs, and not just follow that. What did you say? 40 page legal memo and do all the things that are listed there. So that's sort of a fair summary.

I got once from a German law firm. They sent it to me in an Excel spreadsheet. So you can imagine how fun that was to digest.

It's about sort of translating that list of things you should be doing into a prioritized weighted list that makes sense because I'm sure everybody starts the day with, you know, all the things they should get done that day. And you triage and you allocate your time and your resources in the best way possible. And providing that guidance for that best ROI possible is not something that most other business executives who aren't in this space are going to know how to do.

Yeah, so you mentioned earlier the company whose valuation folded by 96% from the vantage point of the buyer that was a good scenario from the vantage point of the founders, not so much. Do you have another example where maybe being compliant turned into a competitive advantage for a company?

I mean, absolutely. With sales, to speak to your audience, being in compliance can expedite sales contracts being closed. Like Michael said a lot in B2B, when you're selling to an enterprise customer, we have seen that being able to affirmatively state that you are compliant with regulations will expedite that. Put you on the top tier.

Yeah. And there again, there's going to be for every company a certain degree of puffery in that statement. But everybody has to make it. But then there are other things that you can help with. Right. Like ISO 27701. Right. That's the privacy version of the ISO. Being able to achieve that is something that really helps with the go to market cycle for these companies. Whereas if you're trying to negotiate with an enterprise like Siemens, they're seeing something like that is going to add additional legitimacy. A lot of these enterprise companies, when you're, you know, it's like the, the flip of the old expression, nobody gets fired for buying IBM. Right. So occasionally when you're the SMB company and you're the startup and you're trying to sell to an enterprise, you may be going up against incumbents and the, the benefit that those incumbents have is they've been vetted.

Right.

There's more trust there. So a lot of what the small company needs to try and do is earn the trust of the procurement team, the security team and that company's internal privacy team. Why, even if you have maybe a more interesting product, why are you not going to introduce bad risk into that company's ecosystem? And people think about for example, the target data breach, but it ultimately wasn't. Target is one of Target's vendors, but at the end of the day it was Target's brand that suffered the hit because of one of their vendors. So a lot of these vendors are concerned about that.

So you mentioned earlier sort of the three obvious areas in the US where compliance is important. Health, finance and anything concerning children. From a topic perspective, you talked a little bit about privacy, you talked GDPR laws, you talked about AI. What are the heavy hitter topics that you encounter in your work with SMBs?

I think the most common is the most mundane. It's around marketing and E commerce and website policies and the day to day. But then you get into everyone's aware of cookies that ties into the data privacy issues and people tend to be more aware these days. Because of headlines of gdpr. That's the data privacy laws in Europe and the eu. And then the one that's kind of the most splashy these days would be AI and the EU AI act is being rolled out. There are bills in many US states around AI and it's rapidly evolving. So that's one that a lot of companies are, they're jumping on the bandwagon to develop using AI or implement AI in their processes. But I said earlier it's like the wild, wild west. It's, it's evolving so fast that it's like privacy was 10 years ago. Yeah.

And if I'm thinking about what I prioritize some of what Shane mentioned, even though it might seem like these are not the most exciting things, I one of the ways I bifurcate risk is between patent versus latent risk. Now every company may have some stuff behind the scenes that no one, unless you're being audited or really subjected to intense diligence, knows that you've done it wrong potentially. But if I go to your website and you disclose cookies, I can use a tool very easily to tell and so can regulators. So can in California private, you know, firms, plaintiffs firms, is it true or not true? If you're in Germany and you don't get the double opt in for your emails, it's a patent violation versus a latent one. So I can think about based on their geography, what are ways that they could obviously get caught and that would make them lose credibility with companies and investors and potentially how you get caught by a regulator then I think about based on their business model, is there anything that's sensitive that other than you mentioned the three sectors in the US it's kind of determined sectorally but biometrics is also very large that's growing in the US Both in California there's a know a law in Illinois that allows for private rights of action over it and it's also a focus of the AI laws. And then European has European sensitive data definitions include that. But then you have to think about some other contexts like in Europe the employment context is also one which is. And education and education are very heavily regulated. And when you think about AI and privacy, it's almost helpful to think about them as a Venn diagram where there's probably a 2/3 overlap between the two. A lot of the same architects are responsible for both. They're enforced in most of the European countries by the exact same regulators and even to comply with the EU AI act for example, if you're a Deployer of a high risk AI system, you have to do a dpia and that's a data privacy impact assessment that's described by, defined by gdpr.

And you have to build on that to do a conformity assessment. But, and I think of it slightly differently, I actually think of all the AI regulations as being built on a foundation of data privacy because AI is built on data. You need data to build a model, you need data to build your product using AI. And so the way I think of it is that's the foundation of the house and then you've got your AI built on top of that.

So obviously if you are, if you are operating or operating an AI platform or using AI heavily, if you're in Fintech or Medtech or otherwise using data, need to be HIPAA compliant. It feels those are obvious places of biz or obvious businesses where you engage a compliant somebody who knows compliance early on. You know, most other businesses who like you said, operate, you know, a website, have marketing activities, you know at what, and I know the answer is as early as possible, but at what point do you tell a client that they should really have you have a fractional chief compliance officer work with them?

I think you anticipate it. It's at the ground floor. Because once you are building a product, any product using data, it's really hard to get the cat back in the bag if you haven't handle that data appropriately. Reverse engineering takes a lot of work in order to make sure that you are, you haven't built your product on non compliant, on data that was handled in a non compliant manner. And companies can be subject to something called algorithmic disgorgement if their product is not, is built on data that was not handled appropriately.

With Amazon.

Right?

With Ring, yes. Ring's algorithm was built on data that was not collected in compliance with regulations and they had to delete the program, basically. And so Amazon had spent all this money on Ring and now they had nothing to show for it.

Well, they had less to show for it. Right. So they definitely would have paid less for Ring had they known what they knew. Unfortunately, later on. Yeah, I, I see. The other thing I'd note for especially this audience. Right. Is where there are places that can be surprising.

Right.

For example, in sales, if you're thinking about AI, as Shane mentioned, right. In the educational workplace, things that would seem relatively innocuous. Like if we for example, were recording this call and then AI was going to give everyone feedback from a sales perspective on their performance, that is likely regulated as High risk AI in the eu, even though it's not something that we intuitively would think necessarily in this country of that being high risk, we would imagine other types of applications of high risk AI. But in that context it could be considered that it's both. To Shane's point, if you're building something that's foundational to your product, the earlier the better because it's harder to reverse engineer it and then you could really damage your evaluation even later on though it can be expensive. I had another client who had launched something in the EU market. This is before AI, this is just under privacy. They ultimately had to pull it back off the market and add in additional privacy components, right options. Right for their customers to use because nobody would buy it without those features. So they take basically off the market for two quarters, go back and fix those things, add in features options and then basically re release the same product. But now it had different features that would make their customers feel more comfortable that they could use that product in a compliant fashion.

And it also needs to all compliance needs to be handled with a forward looking approach to the geographies you want to target. Often we'll hear, well I only do business in like my local area. Do you want to sell to somebody who does business internationally? Do you want to eventually grow and you have to then think about the markets you want to grow into geographically.

Yeah, makes sense. I'll we'll open the. We're at the 30 minute mark, so we'll open the microphone shortly for audience questions. So one final question from my side is around those third parties you mentioned. The target data breach wasn't really target, it was a third party in the SMB space. A lot of companies, including us, we use a lot of providers of software, of services. What do I do as a small business owner to scrutinize vendors that I'm looking at to make sure that they are compliant?

That's a really good question. In fact one of them. People talk about GDPR as being a brand new law. I shouldn't Say brand this 2016, active 2018, but it still feels new. But it actually just updated a law from the 90s and they were 80 became, if you're familiar with the European law, went from a directive to regulation. And one of the most important changes, aside from the introduction of those draconian fines that got everyone's attention, which the EU AI act decided forgets 4% isn't scary. They made it 7% of global turnovers. The maximum fine under the EU AI act was the fact that when you hire a vendor, if you don't diligence them and they do something wrong, you are liable in addition to that vendor regardless of what the contract says. So it really requires two approaches. You do have to engage in. Of course they don't helpfully tell you how much diligence. Right. You have to be able to demonstrate good faith diligence and have the right terms in your contract to rebut that presumption that you are equally liable under gdpr, for example. There could be similar things under, especially under California law.

Okay, so call us.

That's part of what we can do is like help with the good faith diligence and also contract terms, right. Both in terms of hiring key vendors, right. Later on, for example to your own customers. If those vendors process personal data, you have to disclose them as sub processors and if you change them, you have to get your customers usually not their consent, you have to give them an opt out, right? So if you have a vendor helping you with part of your business and then you change it in the future, you may have customers that get to have control, have opt out rights over that vendor, saying you either can't change this vendor or I get to be let out of my contract like a termination for convenience.

Okay, well, good to remember, good to keep in mind and if there are, and good to have asked those questions and negotiate accordingly. Put it in the contract as a safeguard. It might not, as you say, it might not shield you from responsibility, but you can demonstrate that you've taken all the steps reasonable in order to protect yourself and hire the right vendor and.

Be able to track that internally. If you try to sell to an enterprise, they will ask you to show them your vendor stack that's related to processing data like customer data. And you'll need to be able to articulate which vendors use and what data they process and where they're located. So even those types of data flows would ultimately be scrutinized by that customer audience.

Yeah, great. Let's get the audience involved here. Are there any questions? Just unmute yourself and ask the question if you're ready.

Great. Let me ask a question. Shane. Michael, thanks very much. Interesting topic. Certainly eye opening for many small early stage companies. I think this would be something that a CEO and a business owner would rarely think about in the day to day running of their business. And Henning alluded to this question. But in general for an early stage company, what's nice to have versus need to have? Is there an easy way to know what I, as an early stage business owner needed, need to be aware of and need to be compliant to. Is there a. Is there a cutoff from a revenue or a business size point of view? Is there is. Is it determined by the sector and the industry that we operate, whether it's consumer versus serving businesses, et cetera, et cetera?

What.

What's an easy way to know, oh, I need to do this as opposed to. It's a nice to have.

It's a really good question. I think like you said, the sector is going to invite a certain degree of scrutiny. Ed Tech, fintech, Health care in the US like we've talked about things around higher risk categories in Europe, you're going to just invite that scrutiny. Also, B2B is going to have a more sophisticated customer. We talked about customers being sort of the primary audience when you are selling to other businesses. They tend to be more savvy than a general consumer. Not to say you shouldn't value customers in the B2C context, but they're not going to be looking at as intensely at your policies in like a procurement contract context.

Yeah, I'd say Similarly if it's B2C a lot of it's going to be heat mapped based on what are you doing, like what is the risk of harm to this?

Right.

And a lot of that does tend to map to sectors. But if you step back and look at the business model and what services they're providing or the products that they're selling, what is the risk of harm and the less naturally harmful it will look, at least from that audience perspective. If we're thinking B2C probably you have a little bit more Runway and then you can focus on some of the optics. Right, the paint risks, having the right policies in place, having the right cookie things in place to kind of keep yourself off the radar.

Mailing list, opt in versus opt out, all of those customer facing.

Yeah, there's a lot of prophylactic things that you can do. But again it's going to be heat map based on really simple. If I'm doing a social media site for kids that uses biometrics, what is the, I mean the risk of something of a bad use of that is pretty high.

Nobody should make that.

So step back and look at the business model from just an intuitive perspective. The higher the probable risk of harm of a bad actor, like if they were doing this business, you know, I think the higher risk that is for B2C because otherwise is, you know, a lot of the B2C people, they don't read those privacy policies. Right. They want to actually read those, except for attorneys and regulators. But that's when I think I would focus on those prophylactic measures. If it's relatively low risk. And then to Shane's point, B2B, the maturity curve is just sharper because you're going to be trying to, there's a degree of fake it before you make it and there probably it's going to be dealing with a larger enterprise. If you want to sell small and stay small, then you probably have more time. The bigger the whales you're trying to hunt, the the more those whales are going to ask you tough questions that are going to expose, you know, maybe if you don't have good answers, it's going to make it hard for you in the deal cycle. So for a B2B company, if it's really small and it's spelling to other SNBs or maybe even medium sized companies, you probably have more time and can get away with more for longer than if you're trying to actually sell into enterprise companies.

And if you're looking for investors, then that also accelerates the timeline versus if you're looking to bootstrap and stay private.

So again, and the way to think about it again is really helpful. I know I don't. There's a lot of talk for a simple answer, Andrew, to your question. But it's think about that audience. What is the audience and what are your risks of harm? Right. Think about who is your audience as customers who are like what kind of customers are you looking for. Think about what sort of if and when you want to attract investors. If you want to stay private all the way until you sell, that's a different maturity curve too than if you're going to want to raise series A, series B, Series C financing. So.

Yeah, thank you. Just to flip the script for a second where you say and we all acknowledge that users don't read privacy policies in order to use any service on the web these days. You know, you're forced, accept, accept in terms of service cookies, accept, otherwise you can't use the service. So given that companies know that very, very few people pay attention to that stuff, can't they be, can't businesses be getting away with more by having highly liberal flexible privacy policies that are worded so vaguely that they reduce their own risk because they can do anything with your data and the vast majority of people are just going to be accepting the terms of use.

And I think that again depends on the audience. In Europe, for example, that's not valid. So to get consent, it has to be separate and popped out from that privacy policy. So they've caught on to that in the U.S. for example, for children's data, most of the things that companies might want to do with that data to monetize it, they can't do that unless they separately get parental consent. And then they have to demonstrate what hoops they've jumped through to obtain that parental consent. So again, as you think about again, geography is the other facet of it. Right. But if you're thinking about it from an American perspective, it's almost back to the audience and the risk of harm. And so in those more regulated sectors, there have been additional requirements put in that you can't satisfy by just hiding the items within a privacy policy. The other factor that you have is the you have states like California which are European esque, and they make you have specific things in your privacy policy. And you have to not only put those in, but if they can demonstrate that you are doing something different than what you put in their privacy policy, not only can you be in trouble for a privacy violation, but they call it UDAP or Unfair Deceptive Acts and Practices. The FTC has a similar remedy. So the short answer to your question is a lot of companies can and do exactly what you're suggesting, but there are additional contours around that, again based on your geography and the risk of harm. And I think some of that is shifting like with California and other states where they're trying to be. So if you're doing a privacy policy now, you have to have a number of state specific things. How many state privacy laws are there now, Shane?

Roughly, I think it's 35 that are comprehensive, something around there.

Right. So that omnibus policy, you have to then think about how you're addressing this is the challenge in the US of not having a federal privacy law. It's now that it doesn't go unregulated. Instead you have a patchwork of laws of all these other states. So then you still have to map that against all of those requirements. And that's still without going into if you're in the financial health care kids sector or again biometrics, that's another one where companies that's probably one of the riskiest ones. Because of all of those, there's a very powerful class action law based out of Illinois for biometrics.

I have a question.

So it's a good solve, but it's not a panacea. I guess it's part of the answer. Go ahead, Lisa.

I think this is all super interesting. So I'm actually based in Canada, so all of our apps, I guess I get through the Canadian App Store and I also have two young kids. But what you were just saying is very interesting to me. So like if a child clicks on something and says I am 13 or I am whatever the minimum age is, but they're not, does that make the entire agreement void or is it then the parents responsibility? I'm curious what happens in those cases. Because if kids have access to an iPad, for example, and they download an app and it's a math question that is basically like prove to us that you're 13 and it's five times seven, a first grader could know that. What happens in those instances when someone who isn't actually of age says they consent.

So I'm not familiar with the Canadian laws on the topic.

So either Pepita or like Copper, it's generally you have. It's a balancing between how obviously was this targeted or could have been perceived as targeted to kids. Right, right. And so the more obviously something that could be targeted. It's kind of like that weird Supreme Court opinion. They define pornography as they know it when they see it. Right. So there's no rule. If it's something that either clearly appealed to kids or should appeal to kids, then you know, you're probably not going to be able to stand behind something that just says I agree that I'm 13 or a math screening question. You're going to have the requirement in those jurisdictions as well as the EU to go through additional validation. Sometimes that's doing a microtransaction like there are. It's not one prescriptive things, but there are a handful of recommended ways. They don't have to be perfect and there are going to be gaps in the system, but there are additional steps that those companies that are offering things that are clearly or arguably clearly targeted or appealing to kids would have to take in order for those consents to be valid.

Super interesting. Thank you. I have a million other questions but I know that we Henning's looking like we don't have any more time, but thank you, that was great.

Oh, feel free to reach out. Happy to answer more.

Yes, Shane, to that point, since we're coming to the end here, people, especially those watching the recording later, how can they get in touch with you?

So our website is ATOS data.com so a e t o s-data.com and you can reach out to us to hellotos-data.com and you'll get through to one of us. There's also a contact form on our site and we're happy to have a chat with whomever is interested in reaching out and connecting. We're also on LinkedIn.

I think we should be able to add the URL and the email to the LinkedIn for this.

Right?

Just as a. Yeah, well we can comment with it as well.

Yeah, good. Yes we can do that. Thank you Shane. Thank you Michael for joining us here. Very interesting, very important topic for every small business owner. A lot of food for thought for myself and for I'm sure everyone who's listening. So thank you for joining us. Thank you to those on the call and those listening in later. Thank you and have a wonderful rest of your Wednesday. Bye bye.

Thank you and thank you for the questions and thank you for keeping us on time because Ashe knows I could go on about this for the next two hours if no one stopped me.

Thank you. Bye bye. Thank you.