{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"01af060e-86ec-4f31-b617-fda6ff7b6be1","screeningDate":"2026-09-24T16:38:00.523Z","publicationGate":"published","company":{"id":"abeee5e5-6930-4e28-995a-552c200bc853","name":"X (Twitter)","slug":"x-twitter","industry":"Social Media"},"policy":{"id":"73b56cdd-595f-4133-a517-b5fa94dc0c97","name":"Privacy Policy","type":"privacy","jurisdiction":"Global","sourceUrl":"https://x.com/en/privacy"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-09-24T16:38:00.516Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":2,"sha256":"1236fd7b51eb8a9a11c1df06078f86e64e57da47e4f1d4a4eba6589048f7430a","capturedAt":"2026-07-19T03:54:19.226Z"},"current":{"version":3,"sha256":"2b6339236361d3b0c989580a31b10289a4c31af13bc0cc2b3a942bbe92803810","capturedAt":"2026-09-24T16:38:00.519Z"}},"assessment":{"summary":"The X Privacy Policy has no changes; it continues to detail extensive data collection, broad third-party sharing for AI training (opt-out), and biometric data collection.","overallRisk":"High","overallScore":7,"previousPublicChange":{"id":"13282507-aa4e-4157-b3bf-9ecb3c05a06d","overallRisk":"High","overallScore":8,"screeningDate":"2026-07-19T03:54:19.229Z"},"scoreDelta":-1,"direction":"lower","reasons":[{"icon":"alert","textEn":"Extensive data collection across multiple user categories.","textIt":"Ampia raccolta di dati attraverso diverse categorie di utenti.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiDataCollection","anchorStatus":"not-recorded"},{"icon":"alert","textEn":"Broad third-party data sharing for AI training with an opt-out mechanism.","textIt":"Ampia condivisione dati con terze parti per AI con meccanismo di opt-out.","deltaScore":0,"evidenceQuote":"If you do not opt out, in some instances the recipients of the information may use it for their own independent purposes in addition to those stated in X’s Privacy Policy, including, for example, to train their artificial intelligence model","evidenceSide":"new","relatedKpi":"kpiAiTrainingOptOut","anchorStatus":"verified"},{"icon":"warning","textEn":"Collection of sensitive biometric information with user consent.","textIt":"Raccolta di informazioni biometriche sensibili con consenso utente.","deltaScore":0,"evidenceQuote":"Biometric information. Based on your consent, we may collect and use your biometric information for safety, security, and identification purposes.","evidenceSide":"new","relatedKpi":"kpiDataCollection","anchorStatus":"verified"}],"keyPoints":[{"textEn":"X collects extensive personal data, including usage, device, location, and inferred identity information.","textIt":"X raccoglie dati personali estesi, inclusi informazioni sull'utilizzo, dispositivo, posizione e identità inferita.","sentiment":"negative"},{"textEn":"Biometric information may be collected with your consent for safety, security, and identification purposes.","textIt":"Le informazioni biometriche possono essere raccolte con il tuo consenso per scopi di sicurezza e identificazione.","sentiment":"negative"},{"textEn":"Your data, including public posts, can be used to train AI models by X and third parties, with an opt-out option.","textIt":"I tuoi dati, inclusi i post pubblici, possono essere usati per addestrare modelli AI da X e terze parti, con un'opzione di opt-out.","sentiment":"negative"},{"textEn":"Information is broadly shared with partners, advertisers, and service providers for various purposes.","textIt":"Le informazioni sono ampiamente condivise con partner, inserzionisti e fornitori di servizi per vari scopi.","sentiment":"negative"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses using X for marketing or data analysis must ensure their practices align with GDPR, especially regarding data processing agreements and cross-border transfers. The AI Act may also introduce new obligations for AI model training data.","complianceNoteEn":"GDPR Articles 28, 44"},{"region":"EU","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"The extensive data collection and broad third-party sharing, especially for AI training with an opt-out, raise significant concerns under GDPR. Users should be aware of their rights regarding data processing and consent.","complianceNoteEn":"GDPR Articles 5, 6, 9"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises must conduct thorough due diligence on X's data practices to ensure alignment with diverse international privacy regulations. Data transfer mechanisms and AI governance are critical areas for review.","complianceNoteEn":"International Data Transfer"},{"region":"Global","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"The policy's global reach means users worldwide face extensive data collection and sharing. The opt-out for AI training is a key control, but the public nature of the platform demands user vigilance.","complianceNoteEn":"Global Privacy Norms"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Companies leveraging X's platform need to navigate a complex patchwork of state privacy laws. Compliance with data sharing and AI training clauses requires careful assessment to avoid legal exposure.","complianceNoteEn":"State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Broad data collection and sharing practices, including biometric data, are notable. Users should review state-specific privacy rights (e.g., CCPA/CPRA) regarding data access, deletion, and opt-out of sales/sharing.","complianceNoteEn":"CCPA/CPRA, BIPA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Partial"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiContentModeration","label":"Content moderation","value":"Opaque"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Implicit"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Policy source still match the recorded public snapshot version 3?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/01af060e-86ec-4f31-b617-fda6ff7b6be1","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"7b09a576c06f553fc850a188cfe6013dcd858a57dc5f16c7de3995f356e0c06c"}