Governance and Privacy in DC: A recap of Ethyca House at IAPP GPS 2026
For two days at the end of March, a quiet space two blocks off the IAPP Global Summit expo floor became the room a lot of people didn't know they were looking for. Here's what happened inside Ethyca House.
An Intro to Ethyca House
For two days at the end of March, a quiet space at 901 K St NW — four minutes from the Marriott Marquis lobby — became the room a lot of people at IAPP GPS didn't know they were looking for.
Ethyca House was not a booth. It was not a lounge with branded napkins. It was a working space, built deliberately, for the conversations that don't happen on an expo floor.
We took over a café two blocks from the conference. We brought in better espresso than anything inside the convention center, warm food throughout the day, and a small team whose only job was to make sure the people in the room had what they needed to think clearly. We turned off the sales pitch. We turned up the hospitality.
Over three hundred people came through over the two days. Heads of Privacy from financial services, pharma, media, and platform companies. General Counsels. Chief Privacy Officers. Engineers responsible for the systems underneath every privacy commitment their organization has ever made. Academics. Regulators. Reporters.
Some came for fifteen minutes between sessions to take a call somewhere quiet. Some came at 8am for the private industry breakfasts — pharma on Monday, financial services on Tuesday — and stayed for hours. Some came back on the second day because the first day worked.
The space did what we hoped it would do. It gave people a place to step out of the noise of GPS and have the kinds of conversations that the conference format itself rarely allows: longer, slower, more honest, off the record.
Inside the Activation
The closed-door roundtables were one piece of it. Julie Brill moderated the Monday afternoon session. Daniel Weitzner moderated Tuesday. Both rooms were full — fifteen senior leaders apiece, Chatham House rules, no recording, no slides.
What came out of those rooms — paraphrased here, with no attribution — was sharper than anything on the main stage.
Weitzner pressed on the technical reality underneath modern privacy programs. A DSAR on paper touches dozens of systems, databases, and third-party integrations, and most organizations have no reliable mechanism to execute it end to end. AI is making it worse. Every AI workflow that ingests personal data is another place where a promise gets made that the underlying architecture may not be able to keep. The enforcement bar, he argued, is no longer set at good-faith effort. Regulators are asking a harder question: can your systems actually do what your privacy policy says? Increasingly, the honest answer is no.
Brill brought the strategic dimension into focus. With deregulation shifting the external pressure landscape, privacy leaders are being asked to justify ongoing governance investment without the urgency of an imminent regulatory deadline. The organizations navigating that pressure well, she argued, are the ones who built around infrastructure rather than compliance cycles — systems designed to hold regardless of which way the regulatory wind is blowing.
Around those sessions, the rest of the House kept moving. Reserved tables filled and turned over. Conversations that started in line for coffee continued at the back of the room an hour later. Several deals that will close this year began at one of those tables.
Plug-and-play privacy tools were designed for a world where the policy box was the finish line. That world is ending. What's replacing it demands something harder.”Ethyca Team
The Through-Line
The thread underneath every conversation we had at Ethyca House — in the roundtables, at the breakfasts, over coffee at 11am on a Tuesday — was the same.
The promise gap is real. It is growing. It is a technical debt problem with legal and business consequences attached. Plug-and-play privacy tools were designed for a world where the policy box was the finish line. That world is ending. What's replacing it demands something harder: systems that can actually execute on the commitments organizations have been making for years.
The privacy leaders who see that clearly are already building toward it. The ones who don't are accumulating risk with every new deployment.
That is why we built Ethyca House. Not to depart from GPS, but to make space at it — for the kind of conversation the industry actually needs.
We'll be back. More to come.
If the conversations at Ethyca House sounded like the ones happening inside your organization — about the gap between what your privacy program promises and what your systems can actually deliver — book time to speak with us.
Ethyca builds the infrastructure underneath modern privacy programs at companies like The New York Times, Condé Nast, and Ramp. No slide deck. No 30-minute demo. A real conversation about what you're trying to solve.
.jpeg?rect=801,0,3198,3198&w=3200&h=3200&fit=min&auto=format)
.png?w=3200&h=2133&auto=format)
.png?w=3200&h=2133&auto=format)