{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.1.0","mappingVersion":"2026-07-29.1","changeId":"3132e1ec-23cc-4313-af6b-22445e10e1f9","screeningDate":"2026-11-10T21:42:26.664Z","publicationGate":"published","company":{"id":"9bffb74f-0f91-46a9-a635-74b5e91623e1","name":"Microsoft","slug":"microsoft","industry":"Tech Giant"},"policy":{"id":"cda59c99-32eb-4c5d-aae6-a269c7b681f6","name":"Privacy Statement","type":"privacy","jurisdiction":"US","sourceUrl":"https://www.microsoft.com/en-us/privacy/privacystatement"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-11-10T21:42:26.642Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":3,"sha256":"9e926972399f575385a7e5ce858a241e040cf216702544060ac870cb4b135c24","capturedAt":"2026-09-23T17:20:06.815Z"},"current":{"version":4,"sha256":"758c8fea9383e7729144e1e5fb83c17ce6de5a1fda22f99a023a8a64a5fd2300","capturedAt":"2026-11-10T21:42:26.642Z"}},"analysisLineage":{"status":"verified","requestSha256":"7187a68b77671054d5edd8ed39f1b96c1c34df3c470223093976ab0bb2206ed1","responseSha256":"99667efcad454701e50a8a7f9f7c879fd9016e5ae1aa25dbe199dc3cf1b3b258","model":"gemini-2.5-flash","promptVersion":"policy-analysis.v3-full-document","schemaVersion":"policy-analysis.schema.v2","inputCoverage":"complete","semanticCoverage":"not_measured","documents":{"old":{"sha256":"9e926972399f575385a7e5ce858a241e040cf216702544060ac870cb4b135c24","charLength":217438,"byteLength":218035,"rangeUnit":"utf16-code-unit","includedRanges":[[0,217438]],"excludedRanges":[]},"new":{"sha256":"758c8fea9383e7729144e1e5fb83c17ce6de5a1fda22f99a023a8a64a5fd2300","charLength":215537,"byteLength":216104,"rangeUnit":"utf16-code-unit","includedRanges":[[0,215537]],"excludedRanges":[]}},"boundary":"Hash verification links retained inputs and the application SDK request. It does not prove provider execution, semantic completeness or legal correctness."},"captureLineage":{"old":{"provenance":"unknown","sourceUrl":null,"requestedUrl":null,"finalUrl":null,"capturedAt":"2026-09-23T17:20:06.815Z","urlDisclosure":"credentials-query-fragment-redacted"},"current":{"provenance":"captured","sourceUrl":"https://www.microsoft.com/en-us/privacy/privacystatement","requestedUrl":"https://www.microsoft.com/en-us/privacy/privacystatement","finalUrl":"https://www.microsoft.com/en-us/privacy/privacystatement","capturedAt":"2026-11-10T21:42:26.642Z","urlDisclosure":"credentials-query-fragment-redacted"}},"assessment":{"summary":"Microsoft's updated policy details broader data collection, new third-party data sharing, and extensive cross-device data integration, increasing overall data privacy risk.","overallRisk":"High","overallScore":8,"previousPublicChange":{"id":"0a9d773d-4417-4498-833b-e9ae88d6433c","overallRisk":"High","overallScore":8,"screeningDate":"2026-09-23T17:20:06.825Z"},"scoreDelta":0,"direction":"unchanged","reasons":[{"icon":"warning","textEn":"Expanded device data collection, including device age and locale settings.","textIt":"Raccolta dati del dispositivo estesa, inclusi età e impostazioni locali.","deltaScore":1,"evidenceQuote":"Device, connectivity, and configuration data. For example, IP addresses, age of the device, device identifiers and type, device language and locale settings, nearby networks, and other information about the operating systems and other softw","evidenceSide":"new","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"warning","textEn":"New third-party data source for workplace and productivity data.","textIt":"Nuova fonte di dati di terze parti per dati di produttività e lavoro.","deltaScore":1,"evidenceQuote":"Companies that provide workplace and productivity data for research, development, and improvement of our products and services.","evidenceSide":"new","relatedKpi":"kpiThirdPartySharing","anchorStatus":"verified"},{"icon":"alert","textEn":"Extensive cross-device data integration for linked mobile experiences.","textIt":"Ampia integrazione dati tra dispositivi per esperienze mobili collegate.","deltaScore":1,"evidenceQuote":"Phone Link features and Mobile devices in Settings let you link your mobile devices (e.g., iPhone and Android) and apps (e.g., WhatsApp) to your Windows PCs, enabling a variety of cross-device experiences across your linked Windows devices.","evidenceSide":"new","relatedKpi":"kpiDataCollection","anchorStatus":"verified"}],"keyPoints":[{"textEn":"Expanded device data collection now includes device age, type, and language settings.","textIt":"La raccolta dati sui dispositivi ora include età, tipo e impostazioni della lingua del dispositivo.","sentiment":"negative"},{"textEn":"New third-party data sources include workplace and productivity data for product improvement.","textIt":"Nuove fonti di dati di terze parti includono dati di produttività e lavoro per il miglioramento dei prodotti.","sentiment":"negative"},{"textEn":"The 'Linked mobile experiences' section is significantly expanded, detailing extensive cross-device data syncing.","textIt":"La sezione 'Esperienze mobili collegate' è stata notevolmente ampliata, dettagliando la sincronizzazione estesa dei dati tra dispositivi.","sentiment":"negative"},{"textEn":"Clarifications on personalized offers and age-appropriate experiences provide better transparency and controls.","textIt":"Chiarimenti su offerte personalizzate ed esperienze adatte all'età offrono maggiore trasparenza e controlli.","sentiment":"positive"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"High","impactAnalysisEn":"Enterprises using Microsoft products must review updated data processing agreements to ensure compliance with GDPR and the upcoming AI Act. The expanded third-party data sources and cross-border transfers require careful due diligence.","complianceNoteEn":"GDPR Articles 28, 44; AI Act"},{"region":"EU","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"The expanded data collection and cross-device integration raise concerns under GDPR, especially regarding consent for new data types and third-party sharing. Users should actively manage their privacy settings to mitigate risks.","complianceNoteEn":"GDPR Articles 6, 9, 13, 14"},{"region":"Global","perspective":"Enterprise","riskLevel":"High","impactAnalysisEn":"Global enterprises must ensure their internal policies align with Microsoft's updated data practices, especially concerning third-party data sharing and cross-border transfers. Comprehensive data governance strategies are crucial.","complianceNoteEn":"International Data Transfer"},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The policy's detailed disclosure of data collection and cross-device integration, while transparent, indicates extensive data processing. Users globally should be aware of the broad scope of data used for personalization and AI model training.","complianceNoteEn":"Global Privacy Principles"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses must assess how Microsoft's expanded data collection and sharing practices affect their compliance with US state privacy laws. This includes reviewing data processing terms for workplace and productivity data.","complianceNoteEn":"US State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Increased data collection, including device identifiers and location, impacts user privacy under CCPA/CPRA. Users should leverage opt-out mechanisms for personalized ads and review data sharing for linked mobile experiences.","complianceNoteEn":"CCPA/CPRA Right to Opt-Out"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"},{"field":"kpiContentModeration","label":"Content moderation","value":"Transparent"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Statement source still match the recorded public snapshot version 4?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/3132e1ec-23cc-4313-af6b-22445e10e1f9","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"f7723187197b06250abaf178ed4c9f8e371a2bf21a92e9731b60e77ffdcd0654"}