{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"245f8e52-2b6c-4d4e-8565-600f69b8a78d","screeningDate":"2026-09-24T16:39:32.041Z","publicationGate":"published","company":{"id":"db74e904-0a7d-4a0c-a18f-a8270bf3f498","name":"TikTok","slug":"tiktok","industry":"Social Media"},"policy":{"id":"ba9a6eba-2f2e-4b30-8a92-04f7743f0d65","name":"Privacy Policy","type":"privacy","jurisdiction":"EU","sourceUrl":"https://www.tiktok.com/legal/privacy-policy-eea"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-09-24T16:39:32.034Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":1,"sha256":"789e875ec54faa26ba20b091dcae75e06ef67b80f2dd17922745f381d2b05dd1","capturedAt":"2026-07-06T07:20:56.511Z"},"current":{"version":2,"sha256":"3a6bbd7afaf7b77774d876a3cec3527e25a5b72f6f8556bbb89dc67d69b34a61","capturedAt":"2026-09-24T16:39:32.038Z"}},"assessment":{"summary":"TikTok's Privacy Policy remains unchanged, continuing extensive data collection and sharing practices, including using user content for AI training.","overallRisk":"Medium","overallScore":7,"previousPublicChange":null,"scoreDelta":null,"direction":"baseline","reasons":[{"icon":"alert","textEn":"Extensive data collection, including clipboard and inferred information.","textIt":"Ampia raccolta di dati, inclusi appunti e informazioni inferite.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiDataCollection","anchorStatus":"not-recorded"},{"icon":"alert","textEn":"Broad sharing of user data with various third parties and advertisers.","textIt":"Ampia condivisione dei dati utente con terze parti e inserzionisti.","deltaScore":0,"evidenceQuote":"We share limited information which may include Information You Provide, Technical Information, and Usage Information with third party platforms and partners whose platform or services are integrated with the Platform, or with whom we have a","evidenceSide":"new","relatedKpi":"kpiThirdPartySharing","anchorStatus":"verified"},{"icon":"warning","textEn":"User content is used for AI model training without a clear opt-out.","textIt":"I contenuti utente sono usati per l'addestramento AI senza un chiaro opt-out.","deltaScore":0,"evidenceQuote":"Review, improve, and develop the Platform, including by monitoring interactions and usage across your devices, analysing how people are using it, and by training, testing, and improving our technology, such as our machine learning models an","evidenceSide":"new","relatedKpi":"kpiAiTrainingOptOut","anchorStatus":"verified"}],"keyPoints":[{"textEn":"The policy collects extensive personal data, including user content, clipboard data, and inferred interests.","textIt":"La politica raccoglie dati personali estesi, inclusi contenuti utente, dati degli appunti e interessi inferiti.","sentiment":"negative"},{"textEn":"Information is broadly shared with third-party partners, advertisers, and within TikTok's corporate group.","textIt":"Le informazioni sono ampiamente condivise con partner terzi, inserzionisti e all'interno del gruppo aziendale di TikTok.","sentiment":"negative"},{"textEn":"User content is used for training machine learning models and algorithms, with no explicit opt-out mentioned.","textIt":"I contenuti degli utenti sono utilizzati per addestrare modelli e algoritmi di machine learning, senza un'opzione di opt-out esplicita.","sentiment":"negative"},{"textEn":"The policy relies on contractual necessity and legitimate interests for much of its data processing.","textIt":"La politica si basa sulla necessità contrattuale e sugli interessi legittimi per gran parte del trattamento dei dati.","sentiment":"neutral"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses integrating with TikTok or advertising on the platform must ensure their data sharing practices comply with GDPR and the upcoming AI Act. Joint controller arrangements with TikTok require careful review for compliance.","complianceNoteEn":"GDPR Articles 26, 28"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The extensive data collection and sharing practices, including for AI training, raise concerns under GDPR principles of data minimization and purpose limitation. Users should be aware of their rights regarding personal data processing.","complianceNoteEn":"GDPR Articles 5, 6, 9"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises partnering with TikTok must ensure their data processing agreements and privacy notices align with international data protection standards. Cross-border data transfer mechanisms need careful validation.","complianceNoteEn":null},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Globally, individuals should be aware of the broad scope of data collected and shared, and the use of their content for AI training. Understanding local privacy laws and exercising available rights is important.","complianceNoteEn":null},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"US businesses using TikTok for marketing or integration must navigate various state privacy laws. Ensuring transparency in data sharing and providing opt-out mechanisms are crucial for compliance.","complianceNoteEn":"State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Users in the US face similar concerns regarding extensive data collection and sharing, particularly with advertisers. State laws like CCPA/CPRA grant rights to know, delete, and opt-out of sales/sharing of personal information.","complianceNoteEn":"CCPA/CPRA Rights"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiContentModeration","label":"Content moderation","value":"Partial"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Policy source still match the recorded public snapshot version 2?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/245f8e52-2b6c-4d4e-8565-600f69b8a78d","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"b3b380a9ac8636b28113dae70b4784783e265b9ac73f64cf4dff5c1cb59e79fb"}