{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"121a92db-3af8-48da-8b5e-fa953a94d08b","screeningDate":"2026-07-07T02:34:31.393Z","publicationGate":"published","company":{"id":"c0caa75b-cc98-45c5-9b6b-198af2014025","name":"PayPal","slug":"paypal","industry":"FinTech"},"policy":{"id":"9e09108f-4041-4c64-8e16-88543e1b7e43","name":"Privacy Statement","type":"privacy","jurisdiction":"US","sourceUrl":"https://www.paypal.com/us/webapps/mpp/ua/privacy-full"},"sourceConfidence":{"state":"review-required","lastCheckedAt":"2026-07-06T03:59:34.660Z","retrievalChannel":"seeded","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":1,"sha256":"454b2ac83b0b91a71efa67e3f19979294f3439aec17b937619690174e02bf9bb","capturedAt":"2026-07-06T07:20:32.551Z"},"current":{"version":2,"sha256":"06b8d9b74879230525e3aad0c15e820f38dba6d2c41a3a99c9baac8c95465ef6","capturedAt":"2026-07-07T02:34:31.385Z"}},"assessment":{"summary":"PayPal collects extensive personal and sensitive data, including biometrics, for services, fraud, and AI training, sharing it broadly with many third parties.","overallRisk":"High","overallScore":8,"previousPublicChange":null,"scoreDelta":null,"direction":"baseline","reasons":[{"icon":"warning","textEn":"Extensive data collection, including sensitive and biometric data.","textIt":"Ampia raccolta di dati, inclusi sensibili e biometrici.","deltaScore":2,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"},{"icon":"alert","textEn":"Data used for AI training and automated decisions without clear opt-out.","textIt":"Dati usati per AI e decisioni automatizzate senza chiaro opt-out.","deltaScore":3,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"},{"icon":"warning","textEn":"Broad sharing of personal data with many third parties.","textIt":"Ampia condivisione di dati personali con molte terze parti.","deltaScore":2,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"Extensive data collection, including sensitive and biometric data, requires user consent.","textIt":"L'ampia raccolta di dati, inclusi quelli sensibili e biometrici, richiede il consenso dell'utente.","sentiment":"negative"},{"textEn":"Personal data is used to train AI models and for automated decision-making.","textIt":"I dati personali sono usati per addestrare modelli AI e per decisioni automatizzate.","sentiment":"negative"},{"textEn":"Information is broadly shared with many third parties, including data brokers.","textIt":"Le informazioni sono ampiamente condivise con molte terze parti, inclusi i data broker.","sentiment":"negative"},{"textEn":"Policy mentions jurisdiction-specific rights, but details are not in this excerpt.","textIt":"La politica menziona diritti specifici per giurisdizione, ma i dettagli non sono in questo estratto.","sentiment":"neutral"},{"textEn":"Users can manage linked accounts and set profile visibility to 'Private'.","textIt":"Gli utenti possono gestire gli account collegati e impostare la visibilità del profilo su 'Privato'.","sentiment":"positive"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium-High","impactAnalysisEn":"PayPal faces significant GDPR compliance challenges, especially with data transfers and AI governance. DORA may also apply to financial services.","complianceNoteEn":"GDPR, DORA, AI Act"},{"region":"EU","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"Extensive data collection and AI training raise GDPR concerns. The upcoming AI Act will impose strict rules on high-risk AI systems.","complianceNoteEn":"GDPR, AI Act"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium-High","impactAnalysisEn":"Operating globally requires adherence to a complex patchwork of international privacy laws. Compliance is challenging for extensive data processing.","complianceNoteEn":"Cross-border Data Transfer"},{"region":"Global","perspective":"Individual","riskLevel":"Medium-High","impactAnalysisEn":"Users worldwide face similar privacy concerns regarding extensive data collection, sharing, and AI use. Local protections vary significantly.","complianceNoteEn":"Global Privacy Frameworks"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium-High","impactAnalysisEn":"Navigating diverse state privacy laws (e.g., CCPA, VCDPA) and financial regulations for extensive data processing is complex.","complianceNoteEn":"CCPA/CPRA, GLBA"},{"region":"US","perspective":"Individual","riskLevel":"Medium-High","impactAnalysisEn":"Broad data collection and AI use raise concerns under CCPA/CPRA. Users have rights like opt-out of sale and deletion in many states.","complianceNoteEn":"CCPA/CPRA, State Privacy Laws"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Partial"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Explicit Opt-In"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Statement source still match the recorded public snapshot version 2?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/121a92db-3af8-48da-8b5e-fa953a94d08b","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"8cde9b61c9606c1dfcc709806e5f1111eb209b616f949fa673256f7d52779221"}