{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"2c167795-987c-4b85-8baa-b6ab48f37c61","screeningDate":"2026-10-01T19:45:54.652Z","publicationGate":"published","company":{"id":"3e20dca5-ce3f-4e7e-930c-7aa4753a789d","name":"Google","slug":"google","industry":"Tech Giant"},"policy":{"id":"11539eab-9c04-4d21-8496-ac21de3bc7e2","name":"Privacy Policy","type":"privacy","jurisdiction":"US","sourceUrl":"https://policies.google.com/privacy"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-10-01T19:45:54.641Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":2,"sha256":"61d74aa5731363bb1caa708128349f2d4096a6b1ebbce23bf55268c71461a29a","capturedAt":"2026-07-24T20:57:29.396Z"},"current":{"version":3,"sha256":"3e68770c74db79945a9864618429780a62729ad217d96163fe55166b24fdc337","capturedAt":"2026-10-01T19:45:54.645Z"}},"assessment":{"summary":"No changes were found between the old and new Google Privacy Policy versions, maintaining existing data collection, usage, and sharing practices.","overallRisk":"High","overallScore":7,"previousPublicChange":{"id":"ecc39763-b2f3-40c2-ac76-9f0844adb261","overallRisk":"Medium","overallScore":6,"screeningDate":"2026-07-24T20:57:29.404Z"},"scoreDelta":1,"direction":"higher","reasons":[{"icon":"info","textEn":"No changes detected in policy text between the old and new versions provided.","textIt":"Nessuna modifica rilevata nel testo della politica tra le versioni vecchie e nuove fornite.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"},{"icon":"info","textEn":"Existing data collection practices remain broad across Google's diverse services.","textIt":"Le pratiche esistenti di raccolta dati rimangono ampie su tutti i servizi Google.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiDataCollection","anchorStatus":"not-recorded"},{"icon":"info","textEn":"AI training data usage and IP licensing terms are not explicitly detailed.","textIt":"L'uso dei dati per l'addestramento AI e i termini di licenza IP non sono dettagliati.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiAiTrainingOptOut","anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"Users retain significant control over their data through various privacy settings and activity controls.","textIt":"Gli utenti mantengono un controllo significativo sui propri dati tramite varie impostazioni e controlli sulla privacy.","sentiment":"positive"},{"textEn":"Google collects extensive data from apps, devices, and user activity to provide and improve services.","textIt":"Google raccoglie dati estesi da app, dispositivi e attività utente per fornire e migliorare i servizi.","sentiment":"neutral"},{"textEn":"Personal information is shared with third parties only with user consent, for external processing, or legal reasons.","textIt":"Le informazioni personali sono condivise con terze parti solo con consenso, per elaborazione esterna o motivi legali.","sentiment":"neutral"},{"textEn":"The policy outlines clear options for users to export, review, and delete their personal information.","textIt":"La politica descrive chiare opzioni per gli utenti per esportare, rivedere ed eliminare le proprie informazioni personali.","sentiment":"positive"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Low","impactAnalysisEn":"Enterprises using Google services must continue to ensure their own compliance with GDPR and the upcoming AI Act. Google's policy provides a framework.","complianceNoteEn":"GDPR, AI Act"},{"region":"EU","perspective":"Individual","riskLevel":"Low","impactAnalysisEn":"No changes mean existing GDPR compliance efforts remain. Individuals retain strong rights to data access, deletion, and control over processing.","complianceNoteEn":"GDPR Articles 15, 17, 21"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises using Google services benefit from a consistent privacy framework, but must still address local data residency and transfer requirements.","complianceNoteEn":"Cross-border data transfer"},{"region":"Global","perspective":"Individual","riskLevel":"Low","impactAnalysisEn":"The policy's global applicability ensures consistent user controls and data protection principles worldwide. Users should leverage available privacy tools.","complianceNoteEn":null},{"region":"US","perspective":"Enterprise","riskLevel":"Low","impactAnalysisEn":"Businesses relying on Google's platform should continue to verify their data processing agreements meet US state privacy laws.","complianceNoteEn":"CCPA/CPRA, State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"Low","impactAnalysisEn":"Users maintain existing controls over personal data. The policy aligns with CCPA/CPRA principles for data access and deletion rights.","complianceNoteEn":"CCPA/CPRA, State Privacy Laws"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiContentModeration","label":"Content moderation","value":"Partial"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Explicit Opt-In"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Policy source still match the recorded public snapshot version 3?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/2c167795-987c-4b85-8baa-b6ab48f37c61","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"000ef6d15f62f76210010e2901792165d6acf7f753f7f862a51d696e3b30d448"}