Goli Mahdavi

Golareh Mahdavi
  1. People /

Goli Mahdavi

Goli Mahdavi

Counsel


San Francisco
Golareh Mahdavi
  1. People /

Goli Mahdavi

Goli Mahdavi

Counsel


San Francisco

Goli Mahdavi

Counsel

San Francisco

T: +1 415 675 3448

VcardVcard
Download PDFDownload PDF
Print
Share

Biography

Goli practices at the leading edge of artificial intelligence, data privacy, cyber security, and technology transactions. She counsels a diverse range of clients, from innovative start-ups to Fortune 100 companies, navigating both local and global markets.

As a founding member of the Firm’s Artificial Intelligence (AI) working group and co-leader of the AI Service Line, Goli leverages her experience as a certified AI Governance Professional to guide clients through the evolving technical and legal landscape surrounding AI development and deployment.

In addition to her work in AI, Goli advises on comprehensive data privacy and security compliance programs. She is well-versed in local and international regulations, including the California Consumer Privacy Act (CCPA), California Privacy Rights Act (CPRA), EU and UK General Data Protection Regulation (GDPR), as well as COPPA, CAN-SPAM, and emerging laws. Her specific focus encompasses the US, UK, and Europe.

Goli’s full-service offerings include strategic advice on data retention and minimization, privacy by design, data inventories, cross-border transfer agreements, privacy impact assessments, and negotiating third-party agreements related to digital marketing, software licensing, SaaS, and other commercial contracts.

As a strategic business partner, Goli enhances commercial efficiency and adds value for her clients while helping them bring products to market in complex regulatory environments. Her unique perspective is shaped by her experience as product counsel for a leading global VR/AR company, where she provided frontline legal support for products across multiple jurisdictions.

An active speaker and writer on these topics, Goli keeps her clients informed about the latest developments in the ever-evolving landscape of data privacy and AI. She holds certifications as an Information Privacy Professional for the United States (CIPP/US) and Europe (CIPP/E), as well as in AI Governance (AIG), and is an engaged member of the Lawyers of Color Affinity Group.

Civic Involvement & Honors

Ms. Mahdavi is an advocate for adults and children with developmental disabilities. In addition to pro bono representation of families with children who have special needs, Ms. Mahdavi previously served on the Board of Directors for the San Francisco based non-profit Support for Families of Children with Disabilities.

Professional Affiliations

  • International Association of Privacy Professionals (“IAPP”), member

AI Legislation Snapshot

To help companies achieve their business goals while minimizing regulatory risk, our team actively tracks proposed and enacted AI regulatory bills from across the Unites States to enable our clients to stay informed in this rapidly-changing regulatory landscape.

AI Legislation Snapshot

To help companies achieve their business goals while minimizing regulatory risk, our team actively tracks proposed and enacted AI regulatory bills from across the Unites States to enable our clients to stay informed in this rapidly-changing regulatory landscape.

Admissions

  • California, 2006

  • United States Court of Appeals for the Ninth Circuit
    United States Bankruptcy Court, Northern District of California
    United States District Courts for the Eastern and Northern Districts of California

Education

Santa Clara University, J.D., 2006

University of Oregon, B.S., 2002

Related Practice Areas

  • ESG Governance, Compliance & Reporting

  • Business & Commercial Disputes

  • Media & First Amendment

  • Business Speech

  • Healthcare & Life Sciences

  • Marketing & Advertising

  • Litigation & Dispute Resolution

  • California Consumer Privacy Act

  • Data Privacy & Security

  • Corporate

  • Investigations

  • Regulation, Compliance & Advisory

Resources

Publications

"International: Comparing California's Age-Appropriate Design Code Act with its UK counterpart" - One Trust Data Guidance, March, 2023

"Connecticut takes a first stab at regulating government use of AI" - The Privacy Advisor, July 5, 2023

Speaking Engagements

Speaker, "Artificial Intelligence: A Blueprint for Legal-Tech Conversations," ACC SoCal, July 12, 2023

Related Insights

Insights
Oct 01, 2024

From Code to Compliance: Essential Steps to Adapt to Colorado’s New AI Law

On May 17, 2024, Colorado’s Governor Jared Polis signed into law The Colorado AI Act (SB205).  SB205 will take effect on February 1, 2026, and regulates the use of certain high-risk artificial intelligence (AI) systems. While the 2026 effective date could lull companies into thinking that preparing for the law can wait, its complex requirements will demand timing and planning to address. Additionally, Colorado is not the only US state to step into the ring of AI regulation and enforcement, and many of the steps needed to prepare for the SB205 will help build a compliance foundation for meeting other emerging laws. To help companies begin this process, we have prepared an overview of the law and identified essential compliance steps businesses should take now.
Insights
May 30, 2024

New HHS Guidance on Cookies

Insights
Feb 14, 2024

Washington My Health My Data Act FAQS: data subject rights

On April 27, 2023, the Washington State governor signed into law the My Health My Data Act or the MHMDA. In spite of the onerous and at times confusing requirements of the MHMDA, the Washington Attorney General (AG) has only published a short set of Frequently Asked Questions to help address some of this uncertainty.  Nevertheless, most of the law’s provisions take effect on March 31, 2024, meaning that, at this point, companies have a very short runway to meet their obligations and brace for the private right of action allowed for under the act.  Like so many other features of the MHMDA, data subject rights are deceptively complicated and have the potential to create significant administrative hurdles to getting it right.  As promised in our recent summary of the MHMDA (MHMDA: Time to Comply), we are examining in more detail these tricky issues in our MHMDA FAQs and have done a deep dive into data subject rights in this FAQ. 
Insights
Feb 02, 2024

Reviewing SaaS agreements in the age of AI

The development and implementation of AI-powered tools, including in SaaS platforms, have experienced a meteoric rise over the course of the last year. Businesses are understandably looking to realize competitive advantages from leveraging these new AI technologies, but adding AI to a tech stack can present serious risks related to bias, data ownership, privacy, accuracy and cybersecurity. As with many new tools, an organization’s procurement team is its first line of defense in de-risking AI, and AI literacy is essential in this process. Fortunately, while AI presents unique issues and considerations, the incorporation of AI into SaaS does not require a wholly novel SaaS agreement. Nevertheless, there are key provisions that must be considered carefully to meaningfully address the new risks and issues triggered by the incorporation of AI and the nascent state of the law and contract norms in this space. With this in mind, we have addressed below a number of key provisions that should be front and center in this analysis.
Insights
Jan 29, 2024

Time to Comply: Washington My Health My Data Act

On April 27, 2023, the Washington State governor signed into law the My Health My Data Act or the MHMDA. In spite of the onerous and at times confusing requirements of the MHMDA, the Washington Attorney General (AG) has only published a short set of Frequently Asked Questions to help address some of this uncertainty.  Nevertheless, most of the law’s provisions take effect on March 31, 2024, meaning that, at this point, companies have a very short runway to meet their obligations and brace for the private right of action allowed for under the act.   With this in mind, we have prepared this brief recap of the law and the steps companies should consider as they gear up for compliance. Our more detailed summary of the MHMDA is available in our original insight, and we will also be releasing a series of short FAQs over the coming weeks to help companies prepare.

Related Insights

Insights
Dec 02, 2024
Navigating Consumer Opt-Outs in Corporate Transactions: Insights on California’s AB 1824
Insights
Oct 01, 2024
From Code to Compliance: Essential Steps to Adapt to Colorado’s New AI Law
On May 17, 2024, Colorado’s Governor Jared Polis signed into law The Colorado AI Act (SB205).  SB205 will take effect on February 1, 2026, and regulates the use of certain high-risk artificial intelligence (AI) systems. While the 2026 effective date could lull companies into thinking that preparing for the law can wait, its complex requirements will demand timing and planning to address. Additionally, Colorado is not the only US state to step into the ring of AI regulation and enforcement, and many of the steps needed to prepare for the SB205 will help build a compliance foundation for meeting other emerging laws. To help companies begin this process, we have prepared an overview of the law and identified essential compliance steps businesses should take now.
Insights
May 30, 2024
New HHS Guidance on Cookies
News
Apr 15, 2024
US AI legal landscape: patchwork state laws pose challenges for businesses amid congressional inaction
Insights
Apr 08, 2024
New York May Lead the Pack Through Imposition of Data Excise Taxes
News
Mar 18, 2024
BCLP’s AI Bill Tracker highlighted in Legal Tech Rundown
Insights
Feb 14, 2024
Washington My Health My Data Act FAQS: data subject rights
On April 27, 2023, the Washington State governor signed into law the My Health My Data Act or the MHMDA. In spite of the onerous and at times confusing requirements of the MHMDA, the Washington Attorney General (AG) has only published a short set of Frequently Asked Questions to help address some of this uncertainty.  Nevertheless, most of the law’s provisions take effect on March 31, 2024, meaning that, at this point, companies have a very short runway to meet their obligations and brace for the private right of action allowed for under the act.  Like so many other features of the MHMDA, data subject rights are deceptively complicated and have the potential to create significant administrative hurdles to getting it right.  As promised in our recent summary of the MHMDA (MHMDA: Time to Comply), we are examining in more detail these tricky issues in our MHMDA FAQs and have done a deep dive into data subject rights in this FAQ. 
Insights
Feb 02, 2024
Reviewing SaaS agreements in the age of AI
The development and implementation of AI-powered tools, including in SaaS platforms, have experienced a meteoric rise over the course of the last year. Businesses are understandably looking to realize competitive advantages from leveraging these new AI technologies, but adding AI to a tech stack can present serious risks related to bias, data ownership, privacy, accuracy and cybersecurity. As with many new tools, an organization’s procurement team is its first line of defense in de-risking AI, and AI literacy is essential in this process. Fortunately, while AI presents unique issues and considerations, the incorporation of AI into SaaS does not require a wholly novel SaaS agreement. Nevertheless, there are key provisions that must be considered carefully to meaningfully address the new risks and issues triggered by the incorporation of AI and the nascent state of the law and contract norms in this space. With this in mind, we have addressed below a number of key provisions that should be front and center in this analysis.
Insights
Jan 29, 2024
Time to Comply: Washington My Health My Data Act
On April 27, 2023, the Washington State governor signed into law the My Health My Data Act or the MHMDA. In spite of the onerous and at times confusing requirements of the MHMDA, the Washington Attorney General (AG) has only published a short set of Frequently Asked Questions to help address some of this uncertainty.  Nevertheless, most of the law’s provisions take effect on March 31, 2024, meaning that, at this point, companies have a very short runway to meet their obligations and brace for the private right of action allowed for under the act.   With this in mind, we have prepared this brief recap of the law and the steps companies should consider as they gear up for compliance. Our more detailed summary of the MHMDA is available in our original insight, and we will also be releasing a series of short FAQs over the coming weeks to help companies prepare.