{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.1.0","mappingVersion":"2026-07-29.1","changeId":"25330a35-6bce-4de2-8716-1796e250e928","screeningDate":"2026-10-14T03:41:18.321Z","publicationGate":"published","company":{"id":"3e20dca5-ce3f-4e7e-930c-7aa4753a789d","name":"Google","slug":"google","industry":"Tech Giant"},"policy":{"id":"c287880a-4512-4dc0-a8bd-cdf7d4f33e15","name":"Privacy Policy","type":"privacy","jurisdiction":"Global","sourceUrl":"https://policies.google.com/privacy"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-10-23T11:38:49.076Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":3,"sha256":"3e68770c74db79945a9864618429780a62729ad217d96163fe55166b24fdc337","capturedAt":"2026-10-01T19:45:23.783Z"},"current":{"version":4,"sha256":"db08325ace1e8979a4ff707d93b4f53a581848d15b0ddb5ce57d5f26c4150293","capturedAt":"2026-10-14T03:41:18.314Z"}},"analysisLineage":{"status":"not_recorded","inputCoverage":"unknown","semanticCoverage":"not_measured","boundary":"Hash verification links retained inputs and the application SDK request. It does not prove provider execution, semantic completeness or legal correctness."},"captureLineage":{"old":{"provenance":"unknown","sourceUrl":null,"requestedUrl":null,"finalUrl":null,"capturedAt":"2026-10-01T19:45:23.783Z","urlDisclosure":"credentials-query-fragment-redacted"},"current":{"provenance":"unknown","sourceUrl":null,"requestedUrl":null,"finalUrl":null,"capturedAt":"2026-10-14T03:41:18.314Z","urlDisclosure":"credentials-query-fragment-redacted"}},"assessment":{"summary":"Google clarified how it collects and uses unsigned-out data via unique identifiers across devices.","overallRisk":"Medium","overallScore":5,"previousPublicChange":{"id":"a01305c4-06e9-4113-a4c4-418e4c819740","overallRisk":"Medium","overallScore":6,"screeningDate":"2026-10-01T19:45:23.788Z"},"scoreDelta":-1,"direction":"lower","reasons":[{"icon":"warning","textEn":"New explicit clause covering data collection without an active account.","textIt":"Nuova clausola esplicita sulla raccolta dati senza un account attivo.","deltaScore":2,"evidenceQuote":"Google also collects and uses data that is not associated with your account.","evidenceSide":"new","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"alert","textEn":"Expanded tracking scope across devices for signed-out users.","textIt":"Ampliamento dell'ambito di tracciamento tra dispositivi per utenti non connessi.","deltaScore":1,"evidenceQuote":"or ads based on your activity across devices.","evidenceSide":"new","relatedKpi":"kpiThirdPartySharing","anchorStatus":"verified"},{"icon":"info","textEn":"Unchanged data retention and account deletion mechanisms.","textIt":"Meccanismi di conservazione e cancellazione dei dati invariati.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiDataRetention","anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"Explicitly notes data collection for users who are not signed into a Google account.","textIt":"Indica esplicitamente la raccolta dati per gli utenti non connessi a un account Google.","sentiment":"negative"},{"textEn":"Highlights cross-device tracking using browser and device unique identifiers.","textIt":"Evidenzia il tracciamento cross-device tramite identificatori univoci di browser e dispositivi.","sentiment":"negative"},{"textEn":"Retains existing core privacy controls and account deletion features.","textIt":"Mantiene i controlli sulla privacy e le funzionalità di eliminazione dell'account esistenti.","sentiment":"positive"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses utilizing Google analytics must ensure valid user consent is obtained under ePrivacy rules.","complianceNoteEn":"ePrivacy Directive"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Signed-out tracking must comply with GDPR consent requirements for cookies and storage.","complianceNoteEn":"GDPR Art 6"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global deployments must audit how embedded tracking interacts with local privacy statutes.","complianceNoteEn":null},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Unsigned-out tracking expands global profile building across multiple unlinked devices.","complianceNoteEn":null},{"region":"US","perspective":"Enterprise","riskLevel":"Low","impactAnalysisEn":"Companies must manage state-specific opt-out rights for cross-context behavioral advertising.","complianceNoteEn":"State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"Low","impactAnalysisEn":"State privacy laws like CCPA apply to device-level identifiers and targeted ad collection.","complianceNoteEn":"CCPA / CPRA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Transparent"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Mentioned"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Transparent"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"},{"field":"kpiContentModeration","label":"Content moderation","value":"Transparent"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Mentioned"}]}]},"humanReviewQuestions":["Does the original Privacy Policy source still match the recorded public snapshot version 4?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/25330a35-6bce-4de2-8716-1796e250e928","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"3139407deb55a281465ab29e8323613830955f1e0215551c68b54312cd414f74"}