{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.1.0","mappingVersion":"2026-07-29.1","changeId":"1baf2615-ab0f-4173-9dd9-d540c02b8bce","screeningDate":"2026-10-14T03:41:43.653Z","publicationGate":"published","company":{"id":"3e20dca5-ce3f-4e7e-930c-7aa4753a789d","name":"Google","slug":"google","industry":"Tech Giant"},"policy":{"id":"11539eab-9c04-4d21-8496-ac21de3bc7e2","name":"Privacy Policy","type":"privacy","jurisdiction":"US","sourceUrl":"https://policies.google.com/privacy"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-10-22T11:38:42.436Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":3,"sha256":"3e68770c74db79945a9864618429780a62729ad217d96163fe55166b24fdc337","capturedAt":"2026-10-01T19:45:54.645Z"},"current":{"version":4,"sha256":"db08325ace1e8979a4ff707d93b4f53a581848d15b0ddb5ce57d5f26c4150293","capturedAt":"2026-10-14T03:41:43.646Z"}},"analysisLineage":{"status":"not_recorded","inputCoverage":"unknown","semanticCoverage":"not_measured","boundary":"Hash verification links retained inputs and the application SDK request. It does not prove provider execution, semantic completeness or legal correctness."},"captureLineage":{"old":{"provenance":"unknown","sourceUrl":null,"requestedUrl":null,"finalUrl":null,"capturedAt":"2026-10-01T19:45:54.645Z","urlDisclosure":"credentials-query-fragment-redacted"},"current":{"provenance":"unknown","sourceUrl":null,"requestedUrl":null,"finalUrl":null,"capturedAt":"2026-10-14T03:41:43.646Z","urlDisclosure":"credentials-query-fragment-redacted"}},"assessment":{"summary":"Google now explicitly collects and uses data not linked to your account, tracking activity for ads/search results across devices even when signed out.","overallRisk":"High","overallScore":7,"previousPublicChange":{"id":"2c167795-987c-4b85-8baa-b6ab48f37c61","overallRisk":"High","overallScore":7,"screeningDate":"2026-10-01T19:45:54.652Z"},"scoreDelta":0,"direction":"unchanged","reasons":[{"icon":"warning","textEn":"New explicit clause on collecting data not tied to accounts.","textIt":"Nuova clausola esplicita sulla raccolta dati non legati agli account.","deltaScore":2,"evidenceQuote":"Google also collects and uses data that is not associated with your account.","evidenceSide":"new","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"warning","textEn":"Expanded cross-device tracking for signed-out users.","textIt":"Tracciamento cross-device esteso per utenti disconnessi.","deltaScore":2,"evidenceQuote":"whether to show you more relevant search results or ads based on your activity across devices.","evidenceSide":"new","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"warning","textEn":"Increased scope of data usage for personalization without login.","textIt":"Ambito di utilizzo dati ampliato per personalizzazione senza login.","deltaScore":1,"evidenceQuote":"This allows us to do things like maintain your preferences across browsing sessions, such as your preferred language or whether to show you more relevant search results or ads based on your activity across devices.","evidenceSide":"new","relatedKpi":"kpiAutomatedDecision","anchorStatus":"verified"}],"keyPoints":[{"textEn":"New clause explicitly states data collection and usage not tied to user accounts.","textIt":"Nuova clausola che dichiara esplicitamente la raccolta e l'uso di dati non legati agli account utente.","sentiment":"negative"},{"textEn":"Expanded tracking for personalized ads and search results across devices for signed-out users.","textIt":"Tracciamento esteso per annunci e risultati di ricerca personalizzati su più dispositivi per utenti disconnessi.","sentiment":"negative"},{"textEn":"Increased scope of data collection and linkage for non-logged-in user activity.","textIt":"Ambito ampliato di raccolta e collegamento dati per attività utente non autenticate.","sentiment":"negative"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses using Google services must ensure their own data processing agreements align with Google's expanded data collection, especially for non-account data. This requires careful review of vendor contracts and privacy notices.","complianceNoteEn":"GDPR Art. 28"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Increased data collection and cross-device tracking for non-signed-in users raises GDPR concerns regarding transparency and the lawful basis for processing. Users may find it harder to understand and control data usage without an account.","complianceNoteEn":"GDPR Art. 5, 6, 7"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises must assess how Google's expanded data collection impacts their global data governance and user trust, especially for non-account data. This necessitates a review of internal policies and external communications.","complianceNoteEn":null},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Users worldwide will experience increased data collection and cross-device tracking, potentially leading to more personalized but less private experiences. This shift requires greater vigilance in managing privacy settings.","complianceNoteEn":null},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Companies relying on Google's ad and analytics services should review the implications of expanded data collection for their own compliance obligations under various state privacy laws. This may require updates to their own privacy disclosures.","complianceNoteEn":"State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Users face broader data collection and tracking, potentially impacting privacy under state laws like CCPA/CPRA. While opt-out mechanisms exist, the default scope of data collection has expanded.","complianceNoteEn":"CCPA/CPRA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Partial"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiContentModeration","label":"Content moderation","value":"Opaque"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Policy source still match the recorded public snapshot version 4?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/1baf2615-ab0f-4173-9dd9-d540c02b8bce","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"260fe10d29fd93020c3c9391f92fa2f2e5d503b1a6482b8b7eaf29cc2428c4c1"}