How Privacy Engineering Is Shaping the Age of AI

As governments race to catch up with fast-moving data technologies and artificial intelligence, companies are discovering a practical problem behind the policy debates: they need people who can translate privacy law and AI rules into systems that actually work. Graduates of Carnegie Mellon University’s privacy engineering program are increasingly being hired to do exactly that—bringing technical training, legal literacy and an ethics-focused mindset into product development and governance.

Geetika Gopi (SCS 2023) is one example of how that expertise is being used inside major technology firms. Now based in Boston, Gopi leads Amazon’s Workplace Artificial Intelligence and Language Model Assessments (WILMA) program. After completing a master’s degree in privacy engineering, she joined Amazon as a senior AI privacy specialist and ultimately advanced to oversee the team she helped launch.

Her group, she said, conducts scientific reviews of AI systems that affect Amazon’s workplace population—employees, job candidates and contingent workers—before those tools go live. The WILMA process relies on a cross-functional panel that includes legal counsel, AI specialists and input/output psychology experts. The goal is twofold: to satisfy expectations for “responsible AI” and to ensure compliance with privacy and AI rules around the world prior to deployment.

Gopi did not begin in privacy. Her early career focused on cybersecurity, with work in digital forensics and defensive operations. Over time, she became drawn to privacy as something more than a legal checkbox—an engineering and operational challenge that can be built into systems and workflows. When she learned Carnegie Mellon offered what she understood to be the world’s only formal educational track specifically in privacy engineering, she decided it was the right place to deepen that skill set.

The demand for that kind of hybrid professional has grown as privacy regulation expands. The European Union’s General Data Protection Regulation took effect in 2018. In the United States, the California Consumer Privacy Act became effective in 2022. For companies operating internationally, the practical consequence is that meeting obligations in multiple jurisdictions often means designing to the strictest rules they face anywhere. And as laws continue to evolve, businesses must weigh whether to merely meet current requirements—or to go beyond them in anticipation of new legislation and rising consumer expectations.

That is where graduates trained to think across disciplines can be especially valuable. Gopi argues the program’s curriculum is ahead of many industry norms because it produces “T-shaped” professionals: people with deep technical capabilities and broad fluency across the domains that influence privacy decisions. She pointed to coursework such as Computer Law and Technology, Differential Privacy, and Engineering Privacy by Design as the kind of preparation that allows practitioners to move between legal analysis, mathematical approaches and systems engineering.

Reflecting the widening scope of the field, Carnegie Mellon has renamed its degrees. The full-time option is now the Master’s in Privacy Engineering and AI Governance. The part-time track—designed for students who continue working while studying—has been retitled the Master’s in Privacy Technology and AI Governance. The programs are expanding quickly alongside industry demand.

Another alumnus, Jack Gardner (SCS 2022), arrived via a different route. He studied economics and mathematics at Gettysburg College, then worked at the Consumer Financial Protection Bureau as a research assistant focused on decision-making and behavioral studies. A friend already enrolled in the privacy engineering program encouraged him to apply. Gardner’s background in research methods—built in college and at the CFPB—helped him pivot into privacy engineering while continuing to focus on user behavior and consumer protection. As a full-time student in Pittsburgh, he began building a broader understanding of the legal and technical priorities that shape modern privacy work, including through coursework in privacy policy and law.

Why it matters

AI systems increasingly make or influence decisions about hiring, workplace management and consumer services—areas where privacy, fairness and accountability are under intense scrutiny. Organizations that cannot operationalize compliance across regions risk legal exposure and public backlash, while individuals face growing uncertainty over how their data is used. Watch for whether emerging AI regulations push more companies to adopt structured, multidisciplinary assessments like WILMA—and to hire engineers trained specifically to bridge law and code.