{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"3498c155-1644-4939-8c9b-2460a75b5778","screeningDate":"2026-07-28T22:40:42.898Z","publicationGate":"published","company":{"id":"6f69e944-8b6c-4dce-8693-58804624471b","name":"Meta","slug":"meta","industry":"Tech Giant"},"policy":{"id":"5946f95d-2fa3-4628-896a-f773d09ffbbd","name":"Privacy Policy","type":"privacy","jurisdiction":"US","sourceUrl":"https://www.facebook.com/privacy/policy/"},"sourceConfidence":{"state":"review-required","lastCheckedAt":"2026-07-06T03:59:34.660Z","retrievalChannel":"seeded","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":3,"sha256":"52164a545dbe7a8d2468fdc70157cf96f334218f3157404e271267a6f71d9f8c","capturedAt":"2026-07-10T01:51:12.248Z"},"current":{"version":4,"sha256":"f1efe39ef8d90e7cab3f599bb1a847daa85a55afa8dd02cbcae2d7e313b2c265","capturedAt":"2026-07-28T22:40:42.896Z"}},"assessment":{"summary":"Meta's policy update makes it clearer that your interactions and messages with their AI features are collected and used to improve their AI.","overallRisk":"Medium","overallScore":7,"previousPublicChange":{"id":"686214a4-1396-4f81-bdd0-63a523dcf90a","overallRisk":"Medium","overallScore":6,"screeningDate":"2026-07-10T01:51:12.251Z"},"scoreDelta":1,"direction":"higher","reasons":[{"icon":"warning","textEn":"Explicit AI interaction data collection, including messages, raises privacy concerns.","textIt":"La raccolta esplicita di dati sulle interazioni AI, inclusi i messaggi, solleva preoccupazioni sulla privacy.","deltaScore":2,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"},{"icon":"warning","textEn":"AI features can now 'perform actions,' suggesting broader data processing scope.","textIt":"Le funzionalità AI possono ora 'eseguire azioni', suggerendo un ambito di elaborazione dati più ampio.","deltaScore":1,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"},{"icon":"info","textEn":"Metadata collection is now explicitly 'subject to applicable law,' a minor positive.","textIt":"La raccolta di metadati è ora esplicitamente 'soggetta alla legge applicabile', un piccolo aspetto positivo.","deltaScore":-1,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"Explicit collection of AI interactions: Policy now clearly states that content and messages exchanged with AI features are collected.","textIt":"Raccolta esplicita delle interazioni AI: la policy ora afferma chiaramente che i contenuti e i messaggi scambiati con le funzionalità AI vengono raccolti.","sentiment":"negative"},{"textEn":"Broader AI capabilities: AI features are now described as being able to 'perform actions,' indicating expanded functionality.","textIt":"Capacità AI più ampie: le funzionalità AI sono ora descritte come in grado di 'eseguire azioni', indicando una funzionalità estesa.","sentiment":"negative"},{"textEn":"Metadata clarity: Collection of metadata about content and messages is now explicitly 'subject to applicable law.'","textIt":"Chiarezza sui metadati: la raccolta di metadati su contenuti e messaggi è ora esplicitamente 'soggetta alla legge applicabile'.","sentiment":"positive"},{"textEn":"Product branding: 'AI at Meta' is now referred to as 'Meta AI' or 'our features that are part of AI at Meta.'","textIt":"Branding del prodotto: 'AI at Meta' è ora chiamato 'Meta AI' o 'le nostre funzionalità che fanno parte di Meta AI'.","sentiment":"neutral"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises using Meta's AI features should assess their own data processing agreements and ensure compliance with GDPR, especially regarding client data shared via AI. The AI Act may introduce further obligations.","complianceNoteEn":"GDPR Art. 28, AI Act"},{"region":"EU","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"The explicit collection of AI interaction data, including messages, raises concerns under GDPR principles of data minimization and purpose limitation. Users lack clear opt-out mechanisms for AI training.","complianceNoteEn":"GDPR Art. 5, 6, 9"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises using Meta AI must navigate a complex patchwork of international data protection laws. Ensuring consistent compliance and transparent data handling for AI across jurisdictions is challenging.","complianceNoteEn":"Cross-border Data Transfer"},{"region":"Global","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"Globally, users face increased data collection for AI, with potential implications for privacy and data control. The lack of universal opt-out for AI training means users must rely on local regulations.","complianceNoteEn":"Global Privacy Norms"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses integrating Meta AI should ensure their data practices align with US state privacy laws. They must consider how client data processed by Meta AI affects their own compliance obligations.","complianceNoteEn":"State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The expanded AI data collection could impact user privacy rights under state laws like CCPA/CPRA. Users should review privacy settings, as explicit opt-out for AI training is not specified.","complianceNoteEn":"CCPA/CPRA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"},{"field":"kpiContentModeration","label":"Content moderation","value":"Partial"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Implicit"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Policy source still match the recorded public snapshot version 4?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/3498c155-1644-4939-8c9b-2460a75b5778","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"7803289007cb355520f70ff4bf32b4bd9623b7ca798dace3a64a1cf270596728"}