{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"2b3c911a-ff82-4eb2-93cd-d97cc9c642a0","screeningDate":"2026-08-02T11:30:24.248Z","publicationGate":"published","company":{"id":"c0caa75b-cc98-45c5-9b6b-198af2014025","name":"PayPal","slug":"paypal","industry":"FinTech"},"policy":{"id":"9e09108f-4041-4c64-8e16-88543e1b7e43","name":"Privacy Statement","type":"privacy","jurisdiction":"US","sourceUrl":"https://www.paypal.com/us/webapps/mpp/ua/privacy-full"},"sourceConfidence":{"state":"review-required","lastCheckedAt":"2026-07-06T03:59:34.660Z","retrievalChannel":"seeded","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":4,"sha256":"06b8d9b74879230525e3aad0c15e820f38dba6d2c41a3a99c9baac8c95465ef6","capturedAt":"2026-08-01T04:37:05.409Z"},"current":{"version":5,"sha256":"454b2ac83b0b91a71efa67e3f19979294f3439aec17b937619690174e02bf9bb","capturedAt":"2026-08-02T11:30:24.238Z"}},"assessment":{"summary":"No changes were found in PayPal's Privacy Statement; it continues to outline extensive data collection, AI training, and broad third-party sharing.","overallRisk":"Medium","overallScore":7,"previousPublicChange":{"id":"586c3d9a-1d5d-43dd-bb5e-ca0ef15995ea","overallRisk":"Medium","overallScore":7,"screeningDate":"2026-08-01T04:37:05.415Z"},"scoreDelta":0,"direction":"unchanged","reasons":[{"icon":"warning","textEn":"Extensive collection of sensitive and biometric data, requiring explicit consent.","textIt":"Ampia raccolta di dati sensibili e biometrici, che richiede consenso esplicito.","deltaScore":0,"evidenceQuote":"Biometric data: Such as voice identification, photo identification, or face scans, which we may collect when you consent in the user experience","evidenceSide":"new","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"warning","textEn":"Personal data is used for training AI models without a clear opt-out mechanism.","textIt":"I dati personali sono usati per addestrare modelli AI senza un chiaro meccanismo di opt-out.","deltaScore":0,"evidenceQuote":"AI and Automated Decision Making. We may use Personal Information to train our artificial intelligence (AI) models that power our Services","evidenceSide":"new","relatedKpi":"kpiAiTrainingOptOut","anchorStatus":"verified"},{"icon":"warning","textEn":"Broad sharing of personal data with numerous third parties and corporate affiliates.","textIt":"Ampia condivisione di dati personali con numerose terze parti e affiliati aziendali.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiThirdPartySharing","anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"PayPal collects extensive personal data, including sensitive and biometric information, often requiring user consent.","textIt":"PayPal raccoglie dati personali estesi, inclusi dati sensibili e biometrici, spesso con il consenso dell'utente.","sentiment":"negative"},{"textEn":"Your data may be used to train AI models and for automated decisions in areas like fraud prevention.","textIt":"I tuoi dati possono essere usati per addestrare modelli AI e per decisioni automatizzate, come la prevenzione delle frodi.","sentiment":"negative"},{"textEn":"Personal information is shared broadly with service providers, affiliates, and authorities for various purposes.","textIt":"Le informazioni personali sono ampiamente condivise con fornitori di servizi, affiliati e autorità per vari scopi.","sentiment":"negative"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises using PayPal must ensure their own data processing aligns with GDPR, especially regarding data shared with PayPal. Due diligence on PayPal's data handling and AI practices is crucial for compliance.","complianceNoteEn":"GDPR Article 28"},{"region":"EU","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"The policy's extensive data collection and AI training without explicit opt-out raise GDPR concerns, particularly for sensitive data. Individuals should be aware of their rights under GDPR, including access and deletion.","complianceNoteEn":"GDPR Articles 5, 6, 9"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises using PayPal must navigate a complex web of international data protection laws. Ensuring robust data governance and transparency in AI practices is critical for global operations.","complianceNoteEn":"Cross-border Data"},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Individuals globally face extensive data collection and AI use, necessitating vigilance over personal data. Reviewing local privacy rights and managing account settings are essential steps.","complianceNoteEn":"Global Privacy Norms"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses integrating PayPal must understand data flows and ensure compliance with US state privacy laws. Managing consent for biometric data and transparency around AI use are key considerations.","complianceNoteEn":"State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The broad data collection and sharing, including biometrics, are common but require careful review under state laws like CCPA/CPRA. Users should manage privacy settings to control personal information use.","complianceNoteEn":"CCPA/CPRA, BIPA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Statement source still match the recorded public snapshot version 5?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/2b3c911a-ff82-4eb2-93cd-d97cc9c642a0","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"c7a8466cab7a401609111d08ac952f53937d4628211d7fa53c3152506841da62"}