{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"322d5b66-a58e-485c-a367-487528a80f44","screeningDate":"2026-09-23T17:17:22.476Z","publicationGate":"published","company":{"id":"9bffb74f-0f91-46a9-a635-74b5e91623e1","name":"Microsoft","slug":"microsoft","industry":"Tech Giant"},"policy":{"id":"5681de09-ab08-4131-9922-34b96d28db2d","name":"Privacy Statement","type":"privacy","jurisdiction":"Global","sourceUrl":"https://www.microsoft.com/en-us/privacy/privacystatement"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-09-23T17:17:22.460Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":2,"sha256":"0d69136f4c89eac5a2a6b57f1c5f81fb68e1acc289f939d66e158406f74ab54e","capturedAt":"2026-08-01T04:33:55.910Z"},"current":{"version":3,"sha256":"9e926972399f575385a7e5ce858a241e040cf216702544060ac870cb4b135c24","capturedAt":"2026-09-23T17:17:22.466Z"}},"assessment":{"summary":"The updated Microsoft Privacy Statement expands data collection for device usage and reduces transparency on marketing data use, raising privacy concerns.","overallRisk":"Medium","overallScore":4,"previousPublicChange":{"id":"9d711828-e470-4300-8423-ae4201c57786","overallRisk":"High","overallScore":7,"screeningDate":"2026-08-01T04:33:55.921Z"},"scoreDelta":-3,"direction":"lower","reasons":[{"icon":"warning","textEn":"Expanded data collection for device and usage data.","textIt":"Raccolta dati estesa per dispositivo e utilizzo.","deltaScore":-1,"evidenceQuote":"Data about your device and product features you use, hardware and software details, product performance, your interactions with our websites and apps, and your settings.","evidenceSide":"new","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"alert","textEn":"Reduced marketing transparency due to truncated section.","textIt":"Trasparenza marketing ridotta a causa della sezione troncata.","deltaScore":-1,"evidenceQuote":"Marketing, Advertising, and Pr","evidenceSide":"new","relatedKpi":"kpiAlgoTransparency","anchorStatus":"verified"},{"icon":"info","textEn":"Unclear AI training opt-out mechanism within the policy text.","textIt":"Meccanismo di opt-out per l'addestramento AI non chiaro nel testo della politica.","deltaScore":-1,"evidenceQuote":"As part of our efforts to improve and develop our products, we may use your data to develop and train our AI models. Learn more here.","evidenceSide":"new","relatedKpi":"kpiAiTrainingOptOut","anchorStatus":"verified"}],"keyPoints":[{"textEn":"Microsoft now collects more detailed device and usage data, including website and app interactions.","textIt":"Microsoft ora raccoglie dati più dettagliati su dispositivo e utilizzo, incluse le interazioni con siti web e app.","sentiment":"negative"},{"textEn":"The section on marketing data usage is incomplete, reducing transparency for users.","textIt":"La sezione sull'uso dei dati di marketing è incompleta, riducendo la trasparenza per gli utenti.","sentiment":"negative"},{"textEn":"AI model training is mentioned, but explicit opt-out options are not detailed in the policy.","textIt":"L'addestramento dei modelli AI è menzionato, ma le opzioni esplicite di opt-out non sono dettagliate nella politica.","sentiment":"negative"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Companies using Microsoft products face higher due diligence to ensure their data processing aligns with GDPR, given expanded data collection. This requires careful review of data flows.","complianceNoteEn":"GDPR Articles 28, 30"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Increased data collection and reduced transparency could challenge GDPR compliance, especially regarding consent and transparency. Users should be aware of broader data processing.","complianceNoteEn":"GDPR Articles 5, 6, 13"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises must re-evaluate their data governance strategies to account for Microsoft's updated data practices. This impacts cross-border data transfer and accountability frameworks.","complianceNoteEn":null},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Users worldwide face broader data collection and less clarity on marketing data use, requiring proactive privacy management. The general lack of explicit AI opt-out is a global concern.","complianceNoteEn":null},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses must assess how Microsoft's expanded data collection affects their own compliance with state privacy laws. This includes vendor management and data processing agreements.","complianceNoteEn":"State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Expanded data collection impacts privacy rights under CCPA/CPRA, requiring users to actively manage settings. The lack of explicit AI opt-out is also a concern.","complianceNoteEn":"CCPA/CPRA Right to Know"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Partial"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiContentModeration","label":"Content moderation","value":"Partial"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Statement source still match the recorded public snapshot version 3?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/322d5b66-a58e-485c-a367-487528a80f44","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"f3af34a0a359561dffb70cbc34e72b29178f2540b8b3ef53896e01ff5eb6c1c5"}