{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"07af8187-6856-489f-9d19-4058d9120405","screeningDate":"2026-08-02T12:50:33.854Z","publicationGate":"published","company":{"id":"c0caa75b-cc98-45c5-9b6b-198af2014025","name":"PayPal","slug":"paypal","industry":"FinTech"},"policy":{"id":"9e09108f-4041-4c64-8e16-88543e1b7e43","name":"Privacy Statement","type":"privacy","jurisdiction":"US","sourceUrl":"https://www.paypal.com/us/webapps/mpp/ua/privacy-full"},"sourceConfidence":{"state":"review-required","lastCheckedAt":"2026-07-06T03:59:34.660Z","retrievalChannel":"seeded","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":5,"sha256":"454b2ac83b0b91a71efa67e3f19979294f3439aec17b937619690174e02bf9bb","capturedAt":"2026-08-02T11:30:24.238Z"},"current":{"version":6,"sha256":"06b8d9b74879230525e3aad0c15e820f38dba6d2c41a3a99c9baac8c95465ef6","capturedAt":"2026-08-02T12:50:33.846Z"}},"assessment":{"summary":"No changes were detected in PayPal's Privacy Statement, maintaining existing extensive data collection, sharing, and AI training practices.","overallRisk":"Medium","overallScore":6,"previousPublicChange":{"id":"2b3c911a-ff82-4eb2-93cd-d97cc9c642a0","overallRisk":"Medium","overallScore":7,"screeningDate":"2026-08-02T11:30:24.248Z"},"scoreDelta":-1,"direction":"lower","reasons":[{"icon":"info","textEn":"No changes detected in the policy update.","textIt":"Nessuna modifica rilevata nell'aggiornamento della politica.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"},{"icon":"warning","textEn":"Extensive collection of personal, sensitive, and biometric data.","textIt":"Ampia raccolta di dati personali, sensibili e biometrici.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiDataCollection","anchorStatus":"not-recorded"},{"icon":"warning","textEn":"Broad sharing of data with service providers and other third parties.","textIt":"Ampia condivisione dei dati con fornitori di servizi e terze parti.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiThirdPartySharing","anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"No changes found between the old and new policy versions.","textIt":"Nessuna modifica trovata tra le vecchie e nuove versioni della politica.","sentiment":"neutral"},{"textEn":"PayPal collects extensive personal and sensitive data, including biometrics.","textIt":"PayPal raccoglie dati personali e sensibili estesi, inclusi dati biometrici.","sentiment":"negative"},{"textEn":"Data is broadly shared with service providers and third parties.","textIt":"I dati sono ampiamente condivisi con fornitori di servizi e terze parti.","sentiment":"negative"},{"textEn":"AI models are trained using personal information for services and fraud.","textIt":"I modelli AI sono addestrati usando informazioni personali per servizi e frodi.","sentiment":"negative"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"The policy maintains existing compliance obligations under GDPR, especially regarding data processing, cross-border transfers, and AI governance. Enterprises must ensure their use of PayPal aligns with these.","complianceNoteEn":"GDPR Art. 28, 44"},{"region":"EU","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"No changes mean GDPR implications for extensive data collection, including biometrics, and AI training remain. Users should be aware of their rights under GDPR.","complianceNoteEn":"GDPR Art. 5, 6, 9"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises must continue to navigate the complexities of data transfers and varying international privacy regulations when integrating PayPal services.","complianceNoteEn":"Cross-border Data"},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The policy's broad data collection and AI use maintain global privacy concerns. Users worldwide should exercise caution and manage their account settings.","complianceNoteEn":"Global Privacy Norms"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses using PayPal must continue to ensure their data handling practices align with state-specific privacy laws like CCPA/CPRA, especially concerning third-party sharing.","complianceNoteEn":"State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"No changes mean existing data collection and sharing practices continue, impacting user privacy under CCPA/CPRA. Users should review their rights to know, delete, and opt-out.","complianceNoteEn":"CCPA/CPRA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Statement source still match the recorded public snapshot version 6?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/07af8187-6856-489f-9d19-4058d9120405","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"82bc738b5b8262eef7fc0f96b096b44e32e1bb6ccedaab133502021cc70cac39"}