{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"1ee4e96e-0be3-46bf-8c66-10c4e8f3718a","screeningDate":"2026-07-06T09:44:43.365Z","publicationGate":"published","company":{"id":"fc0a9a77-eb4b-432a-8229-00185c53d30e","name":"Klarna","slug":"klarna","industry":"FinTech"},"policy":{"id":"6b03f215-97db-4a24-b92a-22ef3e11fea5","name":"Privacy Notice","type":"privacy","jurisdiction":"US","sourceUrl":"https://www.klarna.com/us/privacy/"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-08-21T19:01:54.621Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":1,"sha256":"0a26f91446bc356b554ea9e21aebbc76bcd29a49ef250c40b1d8534bd7fdb615","capturedAt":"2026-07-06T07:21:39.840Z"},"current":{"version":2,"sha256":"81a509728ad2a446629990c6802f8965950701a259f8df28669d5febf11a11c7","capturedAt":"2026-07-06T09:44:43.356Z"}},"assessment":{"summary":"The new Klarna policy improves user rights access but removes explicit details on biometric data collection and specific AI/ML processing, reducing transparency.","overallRisk":"High","overallScore":8,"previousPublicChange":null,"scoreDelta":null,"direction":"baseline","reasons":[{"icon":"alert","textEn":"Omission of biometric data collection details reduces critical transparency.","textIt":"L'omissione dei dettagli sulla raccolta di dati biometrici riduce la trasparenza critica.","deltaScore":4,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"},{"icon":"warning","textEn":"Reduced clarity on AI/ML data usage for model training and automated decisions.","textIt":"Chiarezza ridotta sull'uso dei dati AI/ML per l'addestramento dei modelli e le decisioni automatizzate.","deltaScore":3,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"},{"icon":"info","textEn":"Specific product data collection and third-party integrations are now generalized.","textIt":"La raccolta dati specifici del prodotto e le integrazioni di terze parti sono ora generalizzate.","deltaScore":1,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"New policy is more user-friendly with an FAQ format, making information easier to find.","textIt":"La nuova politica è più user-friendly con un formato FAQ, rendendo le informazioni più facili da trovare.","sentiment":"positive"},{"textEn":"Explicit details on biometric data collection and third-party vendors are no longer present.","textIt":"I dettagli espliciti sulla raccolta di dati biometrici e sui fornitori terzi non sono più presenti.","sentiment":"negative"},{"textEn":"Less transparency on specific AI/ML data usage for model training and automated decisions.","textIt":"Minore trasparenza sull'uso specifico dei dati AI/ML per l'addestramento dei modelli e le decisioni automatizzate.","sentiment":"negative"},{"textEn":"Clearer in-app paths for exercising data access and deletion rights are now provided.","textIt":"Sono ora forniti percorsi in-app più chiari per esercitare i diritti di accesso e cancellazione dei dati.","sentiment":"positive"},{"textEn":"Introduces a specific GLBA opt-out for sharing non-public personal information.","textIt":"Introduce un'opzione di opt-out GLBA specifica per la condivisione di informazioni personali non pubbliche.","sentiment":"positive"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"High","impactAnalysisEn":"Klarna faces increased compliance risk under GDPR due to reduced transparency on sensitive data processing. The upcoming AI Act will demand clear governance for AI systems, which is less detailed here.","complianceNoteEn":"GDPR, AI Act"},{"region":"EU","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"The lack of explicit biometric data disclosure raises significant GDPR concerns, especially regarding consent for sensitive data. Reduced transparency on AI usage also impacts rights under the upcoming AI Act.","complianceNoteEn":"GDPR Art. 9, AI Act"},{"region":"Global","perspective":"Enterprise","riskLevel":"High","impactAnalysisEn":"Klarna's global operations face increased scrutiny and potential non-compliance issues across diverse regulatory landscapes. Reduced transparency can lead to reputational damage and consumer distrust worldwide.","complianceNoteEn":"Cross-border Data Transfer"},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Users globally face reduced transparency regarding sensitive data collection and AI processing, making it harder to understand and control their personal information. This could erode trust in Klarna's data practices.","complianceNoteEn":"Global Privacy Principles"},{"region":"US","perspective":"Enterprise","riskLevel":"High","impactAnalysisEn":"Klarna faces heightened legal and reputational risks from state biometric privacy laws if collection continues without explicit disclosure. Compliance with evolving state AI regulations may also be challenging.","complianceNoteEn":"State Biometric Laws, CCPA/CPRA"},{"region":"US","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"The omission of biometric data details is a major concern under state biometric privacy laws (e.g., BIPA). While a GLBA opt-out is new, clarity on CCPA/CPRA rights for automated decisions is reduced.","complianceNoteEn":"BIPA, CCPA/CPRA, GLBA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"not-assessed","assessedCount":0,"mappedFieldCount":4,"evidence":[]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"not-assessed","assessedCount":0,"mappedFieldCount":4,"evidence":[]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"not-assessed","assessedCount":0,"mappedFieldCount":4,"evidence":[]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"not-assessed","assessedCount":0,"mappedFieldCount":4,"evidence":[]}]},"humanReviewQuestions":["Does the original Privacy Notice source still match the recorded public snapshot version 2?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/1ee4e96e-0be3-46bf-8c66-10c4e8f3718a","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"a7c1925dd1652c31cbe4531d499f0620ee1faaf8d49fd090ffe3ac57edc2a23b"}