{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.1.0","mappingVersion":"2026-07-29.1","changeId":"2eb47239-1f48-47c7-a109-ed8efb3b7dfd","screeningDate":"2026-10-24T12:44:00.231Z","publicationGate":"published","company":{"id":"db74e904-0a7d-4a0c-a18f-a8270bf3f498","name":"TikTok","slug":"tiktok","industry":"Social Media"},"policy":{"id":"ba9a6eba-2f2e-4b30-8a92-04f7743f0d65","name":"Privacy Policy","type":"privacy","jurisdiction":"EU","sourceUrl":"https://www.tiktok.com/legal/privacy-policy-eea"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-10-24T12:44:00.223Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":2,"sha256":"3a6bbd7afaf7b77774d876a3cec3527e25a5b72f6f8556bbb89dc67d69b34a61","capturedAt":"2026-09-24T16:39:32.038Z"},"current":{"version":3,"sha256":"ee13d9375db8e4f3b8ed278301fc45ea4ffd4965f492286e399580c3983cf39f","capturedAt":"2026-10-24T12:44:00.223Z"}},"analysisLineage":{"status":"verified","requestSha256":"e283f2f681a2c51d9f5766218c0b13798092278811b1d6e615112bf604dde551","responseSha256":"d2bbfe3d653b140a6a507e45b2f3e94ce6227db8e9d74b20afbb29f92d0177c4","model":"gemini-3.5-flash-lite","promptVersion":"policy-analysis.v3-full-document","schemaVersion":"policy-analysis.schema.v2","inputCoverage":"complete","semanticCoverage":"not_measured","documents":{"old":{"sha256":"3a6bbd7afaf7b77774d876a3cec3527e25a5b72f6f8556bbb89dc67d69b34a61","charLength":45436,"byteLength":45589,"rangeUnit":"utf16-code-unit","includedRanges":[[0,45436]],"excludedRanges":[]},"new":{"sha256":"ee13d9375db8e4f3b8ed278301fc45ea4ffd4965f492286e399580c3983cf39f","charLength":45616,"byteLength":45769,"rangeUnit":"utf16-code-unit","includedRanges":[[0,45616]],"excludedRanges":[]}},"boundary":"Hash verification links retained inputs and the application SDK request. It does not prove provider execution, semantic completeness or legal correctness."},"captureLineage":{"old":{"provenance":"unknown","sourceUrl":null,"requestedUrl":null,"finalUrl":null,"capturedAt":"2026-09-24T16:39:32.038Z","urlDisclosure":"credentials-query-fragment-redacted"},"current":{"provenance":"captured","sourceUrl":"https://www.tiktok.com/legal/privacy-policy-eea","requestedUrl":"https://www.tiktok.com/legal/privacy-policy-eea","finalUrl":"https://www.tiktok.com/legal/page/eea/privacy-policy/en","capturedAt":"2026-10-24T12:44:00.223Z","urlDisclosure":"credentials-query-fragment-redacted"}},"assessment":{"summary":"TikTok updated its UK privacy policy regarding ad personalization and choices, taking effect in November 2026.","overallRisk":"Medium","overallScore":5,"previousPublicChange":{"id":"245f8e52-2b6c-4d4e-8565-600f69b8a78d","overallRisk":"High","overallScore":7,"screeningDate":"2026-09-24T16:39:32.041Z"},"scoreDelta":-2,"direction":"lower","reasons":[{"icon":"info","textEn":"Added specific terms for UK ad practices starting November 2026.","textIt":"Aggiunti termini specifici per le pratiche pubblicitarie nel Regno Unito da novembre 2026.","deltaScore":1,"evidenceQuote":"We are changing how we show ads to UK users. Our new Privacy Policy for UK users comes into effect on 11 November 2026 or, if you are in the UK, when you make a choice about ads.","evidenceSide":"new","relatedKpi":"kpiConsentMechanism","anchorStatus":"verified"},{"icon":"info","textEn":"Extensive data collection across device technical and usage metrics.","textIt":"Raccolta dati estesa su metriche tecniche e di utilizzo del dispositivo.","deltaScore":2,"evidenceQuote":"We collect certain device and network connection information when you access the Platform.","evidenceSide":"new","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"info","textEn":"Broad international data transfers to servers in the US, Malaysia, and Singapore.","textIt":"Ampi trasferimenti internazionali di dati verso server in USA, Malesia e Singapore.","deltaScore":1,"evidenceQuote":"We store the information described in the “What Information We Collect” section in servers located in the United States, Malaysia and Singapore.","evidenceSide":"new","relatedKpi":"kpiCrossBorderTransfer","anchorStatus":"verified"}],"keyPoints":[{"textEn":"New ad presentation terms introduced specifically for UK users.","textIt":"Nuovi termini di presentazione degli annunci introdotti specificamente per gli utenti del Regno Unito.","sentiment":"neutral"},{"textEn":"Effective date set for 11 November 2026 or upon user ad choice.","textIt":"Data di entrata in vigore fissata all'11 novembre 2026 o alla scelta dell'utente sugli annunci.","sentiment":"neutral"},{"textEn":"Joint controllership between Ireland and UK entities remains unchanged.","textIt":"La contitolarità tra le entità di Irlanda e Regno Unito rimane invariata.","sentiment":"neutral"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses utilizing TikTok analytics or advertising must adhere to joint controllership terms.","complianceNoteEn":"GDPR Art 26"},{"region":"EU","perspective":"Individual","riskLevel":"Low","impactAnalysisEn":"EU users maintain standard GDPR rights regarding access, deletion, and object processing.","complianceNoteEn":"GDPR Art 15-21"},{"region":"Global","perspective":"Enterprise","riskLevel":"Low","impactAnalysisEn":"Corporate group entities coordinate globally to provide unified infrastructure and moderation.","complianceNoteEn":null},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Global users face broad data collection across devices, messages, and external partner networks.","complianceNoteEn":null},{"region":"US","perspective":"Enterprise","riskLevel":"Low","impactAnalysisEn":"US advertisers benefit from comprehensive measurement and audience attribution reports.","complianceNoteEn":null},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Data is routinely transferred and stored on servers located in the United States.","complianceNoteEn":null}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"},{"field":"kpiContentModeration","label":"Content moderation","value":"Partial"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Policy source still match the recorded public snapshot version 3?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/2eb47239-1f48-47c7-a109-ed8efb3b7dfd","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"26e6c058335a5f375644d4be0ae330e5ece36ed79b1337daf8c357eed386d4b6"}