{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.1.0","mappingVersion":"2026-07-29.1","changeId":"00ea4d5e-288b-4d65-a4cf-c1ebf1433015","screeningDate":"2026-11-07T19:41:31.109Z","publicationGate":"published","company":{"id":"83da1ad9-8891-4372-a9db-bdf82c894d2a","name":"Anthropic","slug":"anthropic","industry":"Tech Giant"},"policy":{"id":"5afd72ff-64d7-411d-823e-3573e2901762","name":"Non-User Privacy Policy","type":"privacy","jurisdiction":"Global","sourceUrl":"https://www.anthropic.com/legal/non-user-privacy-policy"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-11-07T19:41:31.101Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":2,"sha256":"5280b5dd650aa5d07a2b0923b2277b10ae988cf6144542e5012b0d99f9f03ee7","capturedAt":"2026-10-22T11:42:18.898Z"},"current":{"version":3,"sha256":"7c0d4889bead53b7130809115a3f147a382f7dc1ec7d74d135f84c99e9734253","capturedAt":"2026-11-07T19:41:31.101Z"}},"analysisLineage":{"status":"verified","requestSha256":"14d73a15686c68db53c497676e61f1fd8a34dbafb0e381e09d4bf8eaf7827bce","responseSha256":"f36cbb4dd67ea46c509b25e36802fb09fba86c61cfeab9274d2240cdc2bf53a4","model":"gemini-3.5-flash-lite","promptVersion":"policy-analysis.v3-full-document","schemaVersion":"policy-analysis.schema.v2","inputCoverage":"complete","semanticCoverage":"not_measured","documents":{"old":{"sha256":"5280b5dd650aa5d07a2b0923b2277b10ae988cf6144542e5012b0d99f9f03ee7","charLength":20375,"byteLength":20459,"rangeUnit":"utf16-code-unit","includedRanges":[[0,20375]],"excludedRanges":[]},"new":{"sha256":"7c0d4889bead53b7130809115a3f147a382f7dc1ec7d74d135f84c99e9734253","charLength":20365,"byteLength":20449,"rangeUnit":"utf16-code-unit","includedRanges":[[0,20365]],"excludedRanges":[]}},"boundary":"Hash verification links retained inputs and the application SDK request. It does not prove provider execution, semantic completeness or legal correctness."},"captureLineage":{"old":{"provenance":"captured","sourceUrl":"https://www.anthropic.com/legal/non-user-privacy-policy","requestedUrl":"https://www.anthropic.com/legal/non-user-privacy-policy","finalUrl":"https://www.anthropic.com/legal/non-user-privacy-policy","capturedAt":"2026-10-22T11:42:18.898Z","urlDisclosure":"credentials-query-fragment-redacted"},"current":{"provenance":"captured","sourceUrl":"https://www.anthropic.com/legal/non-user-privacy-policy","requestedUrl":"https://www.anthropic.com/legal/non-user-privacy-policy","finalUrl":"https://www.anthropic.com/legal/non-user-privacy-policy","capturedAt":"2026-11-07T19:41:31.101Z","urlDisclosure":"credentials-query-fragment-redacted"}},"assessment":{"summary":"Anthropic clarifies how web data and non-user personal information are processed for AI model training under legitimate interests.","overallRisk":"Medium","overallScore":5,"previousPublicChange":{"id":"f18cd619-6b84-4c05-9a23-fa7d685d2fc1","overallRisk":"Medium","overallScore":5,"screeningDate":"2026-10-22T11:42:18.906Z"},"scoreDelta":0,"direction":"unchanged","reasons":[{"icon":"warning","textEn":"Collects public internet data which may incidentally contain personal information.","textIt":"Raccoglie dati pubblici che potrebbero contenere incidentalmente informazioni personali.","deltaScore":3,"evidenceQuote":"When we gather this material, we are not looking for information about particular individuals, but some of it will incidentally contain personal information","evidenceSide":"new","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"alert","textEn":"Relies on legitimate interests for training models without explicit user consent.","textIt":"Si basa su legittimi interessi per l'addestramento senza il consenso esplicito dell'utente.","deltaScore":4,"evidenceQuote":"It is in our legitimate interests to train and improve our AI models.","evidenceSide":"new","relatedKpi":"kpiConsentMechanism","anchorStatus":"verified"},{"icon":"info","textEn":"Retains data as long as necessary for model training and future versions.","textIt":"Conserva i dati per il tempo necessario all'addestramento dei modelli e versioni future.","deltaScore":2,"evidenceQuote":"how long it remains necessary for training, testing, maintaining and improving our models, including future versions","evidenceSide":"new","relatedKpi":"kpiDataRetention","anchorStatus":"verified"}],"keyPoints":[{"textEn":"Explains how public internet data and third-party datasets are collected to train generative AI models.","textIt":"Spiega come vengono raccolti i dati pubblici di Internet e i set di dati di terze parti per addestrare i modelli.","sentiment":"neutral"},{"textEn":"Confirms automated web crawler ClaudeBot respects robots.txt and does not bypass CAPTCHA.","textIt":"Conferma che il crawler ClaudeBot rispetta robots.txt e non bypassa i controlli CAPTCHA.","sentiment":"positive"},{"textEn":"Relies on legitimate interests as the legal basis for processing training data containing personal info.","textIt":"Si basa sui legittimi interessi come base giuridica per l'elaborazione dei dati di addestramento.","sentiment":"neutral"},{"textEn":"Provides channels for non-users to exercise privacy rights despite technical complexity.","textIt":"Fornisce canali ai non utenti per esercitare i diritti sulla privacy nonostante la complessità tecnica.","sentiment":"positive"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses must ensure third-party datasets shared with Anthropic comply with lawful transfer mechanisms under EU law.","complianceNoteEn":"GDPR Chapter V"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"EU residents enjoy GDPR data subject rights, though enforcing deletion on trained AI models remains complex.","complianceNoteEn":"GDPR Art 17"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global organizations partnering with Anthropic must evaluate international data transfer and compliance frameworks.","complianceNoteEn":"Cross-Border Compliance"},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Global non-users are subject to US data transfers and must rely on standard contractual clauses for safeguards.","complianceNoteEn":"Standard Contractual Clauses"},{"region":"US","perspective":"Enterprise","riskLevel":"Low","impactAnalysisEn":"Enterprises transferring public datasets must verify compliance with commercial data acquisition agreements.","complianceNoteEn":"CCPA / CPA"},{"region":"US","perspective":"Individual","riskLevel":"Low","impactAnalysisEn":"US individuals have limited federal privacy rights, relying instead on state-specific consumer privacy legislation.","complianceNoteEn":"State Privacy Laws"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Transparent"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Committed"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Committed"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Mentioned"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Transparent"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Committed"},{"field":"kpiContentModeration","label":"Content moderation","value":"Transparent"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Committed"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Mentioned"}]}]},"humanReviewQuestions":["Does the original Non-User Privacy Policy source still match the recorded public snapshot version 3?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/00ea4d5e-288b-4d65-a4cf-c1ebf1433015","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"447d9b16afe7fb2f635030303138518f8ec0fa7593bcab57ce4892a9dac4041a"}