{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"0a9d773d-4417-4498-833b-e9ae88d6433c","screeningDate":"2026-09-23T17:20:06.825Z","publicationGate":"published","company":{"id":"9bffb74f-0f91-46a9-a635-74b5e91623e1","name":"Microsoft","slug":"microsoft","industry":"Tech Giant"},"policy":{"id":"cda59c99-32eb-4c5d-aae6-a269c7b681f6","name":"Privacy Statement","type":"privacy","jurisdiction":"US","sourceUrl":"https://www.microsoft.com/en-us/privacy/privacystatement"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-09-23T17:20:06.806Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":2,"sha256":"0d69136f4c89eac5a2a6b57f1c5f81fb68e1acc289f939d66e158406f74ab54e","capturedAt":"2026-08-01T04:35:55.968Z"},"current":{"version":3,"sha256":"9e926972399f575385a7e5ce858a241e040cf216702544060ac870cb4b135c24","capturedAt":"2026-09-23T17:20:06.815Z"}},"assessment":{"summary":"The policy update explicitly broadens device and usage data collection to include website and app interactions, maintaining existing concerns about AI training and data retention.","overallRisk":"High","overallScore":8,"previousPublicChange":{"id":"a551ca11-952d-4a8a-b79a-0c1df7462093","overallRisk":"High","overallScore":9,"screeningDate":"2026-08-01T04:35:55.981Z"},"scoreDelta":-1,"direction":"lower","reasons":[{"icon":"warning","textEn":"Explicitly broader data collection for device and usage data.","textIt":"Raccolta dati esplicitamente più ampia per dati dispositivo e utilizzo.","deltaScore":1,"evidenceQuote":"your interactions with our websites and apps","evidenceSide":"new","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"alert","textEn":"User data is broadly used for AI model training without clear opt-out.","textIt":"I dati utente sono ampiamente usati per l'addestramento AI senza opt-out chiari.","deltaScore":0,"evidenceQuote":"we may use your data to develop, train, and fine-tune our AI models, including large language models (LLMs).","evidenceSide":"new","relatedKpi":"kpiAiTrainingOptOut","anchorStatus":"verified"},{"icon":"warning","textEn":"Policy lacks specific data retention periods for personal data.","textIt":"La politica non specifica periodi di conservazione dei dati personali.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiDataRetention","anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"Device and usage data collection now explicitly includes your interactions with Microsoft websites and apps.","textIt":"La raccolta dei dati di utilizzo del dispositivo include ora esplicitamente le interazioni con siti web e app Microsoft.","sentiment":"negative"},{"textEn":"Your data, including de-identified data, is used to develop and train AI models, including LLMs.","textIt":"I tuoi dati, inclusi quelli de-identificati, sono usati per sviluppare e addestrare modelli AI, inclusi gli LLM.","sentiment":"negative"},{"textEn":"The policy does not specify clear retention periods for various types of personal data collected.","textIt":"La politica non specifica periodi di conservazione chiari per i vari tipi di dati personali raccolti.","sentiment":"negative"},{"textEn":"Microsoft continues to comply with EU-U.S., UK Extension, and Swiss-U.S. Data Privacy Frameworks.","textIt":"Microsoft continua a rispettare i Data Privacy Frameworks EU-U.S., UK Extension e Swiss-U.S.","sentiment":"neutral"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises using Microsoft products must ensure their data processing agreements (DPAs) reflect this clarified data collection scope. Compliance with the upcoming AI Act for AI training data remains a key consideration.","complianceNoteEn":"GDPR Art. 28, AI Act"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The explicit inclusion of website/app interactions in data collection could raise concerns under GDPR regarding transparency and necessity. Individuals should review their privacy settings to manage this expanded scope.","complianceNoteEn":"GDPR Art. 5, 6, 13"},{"region":"Global","perspective":"Enterprise","riskLevel":"High","impactAnalysisEn":"Global enterprises must ensure their use of Microsoft products aligns with diverse international data protection regulations. The lack of specific data retention periods can complicate compliance efforts across jurisdictions.","complianceNoteEn":"International Data Laws"},{"region":"Global","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"The policy's broad data collection and AI training clauses, coupled with unspecified retention, present general privacy concerns. Individuals globally should be aware of how their interactions contribute to data profiles.","complianceNoteEn":"Global Privacy Principles"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses relying on Microsoft services need to assess how this clarified data collection aligns with state-specific privacy laws. Ensuring robust internal policies and vendor agreements is crucial.","complianceNoteEn":"State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The expanded data collection for device and usage data may impact consumer rights under CCPA/CPRA, particularly regarding the right to know and opt-out of certain data sharing. Users should actively manage their privacy settings.","complianceNoteEn":"CCPA/CPRA Rights"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiContentModeration","label":"Content moderation","value":"Transparent"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Statement source still match the recorded public snapshot version 3?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/0a9d773d-4417-4498-833b-e9ae88d6433c","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"a6952da5a252aff472a506c33d8e136857346484f8a48c648aa72d0ef42f161b"}