{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.1.0","mappingVersion":"2026-07-29.1","changeId":"34c3d794-dc39-4c5a-b425-809f4a7dbb1e","screeningDate":"2026-11-14T23:40:41.929Z","publicationGate":"published","company":{"id":"db74e904-0a7d-4a0c-a18f-a8270bf3f498","name":"TikTok","slug":"tiktok","industry":"Social Media"},"policy":{"id":"ba9a6eba-2f2e-4b30-8a92-04f7743f0d65","name":"Privacy Policy","type":"privacy","jurisdiction":"EU","sourceUrl":"https://www.tiktok.com/legal/privacy-policy-eea"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-11-14T23:40:41.910Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":5,"sha256":"ee13d9375db8e4f3b8ed278301fc45ea4ffd4965f492286e399580c3983cf39f","capturedAt":"2026-11-12T22:40:20.627Z"},"current":{"version":6,"sha256":"3a6bbd7afaf7b77774d876a3cec3527e25a5b72f6f8556bbb89dc67d69b34a61","capturedAt":"2026-11-14T23:40:41.910Z"}},"analysisLineage":{"status":"verified","requestSha256":"47358317157dd0333dee6ace8bb7f42eff5355abbdbcafec0b95dd528577cca4","responseSha256":"6a121c8af19af1d5715917fc426296b03d4697a113b826ea8daf7218f514873f","model":"gemini-2.5-flash","promptVersion":"policy-analysis.v3-full-document","schemaVersion":"policy-analysis.schema.v2","inputCoverage":"complete","semanticCoverage":"not_measured","documents":{"old":{"sha256":"ee13d9375db8e4f3b8ed278301fc45ea4ffd4965f492286e399580c3983cf39f","charLength":45616,"byteLength":45769,"rangeUnit":"utf16-code-unit","includedRanges":[[0,45616]],"excludedRanges":[]},"new":{"sha256":"3a6bbd7afaf7b77774d876a3cec3527e25a5b72f6f8556bbb89dc67d69b34a61","charLength":45436,"byteLength":45589,"rangeUnit":"utf16-code-unit","includedRanges":[[0,45436]],"excludedRanges":[]}},"boundary":"Hash verification links retained inputs and the application SDK request. It does not prove provider execution, semantic completeness or legal correctness."},"captureLineage":{"old":{"provenance":"captured","sourceUrl":"https://www.tiktok.com/legal/privacy-policy-eea","requestedUrl":"https://www.tiktok.com/legal/privacy-policy-eea","finalUrl":"https://www.tiktok.com/legal/page/eea/privacy-policy/en","capturedAt":"2026-11-12T22:40:20.627Z","urlDisclosure":"credentials-query-fragment-redacted"},"current":{"provenance":"captured","sourceUrl":"https://www.tiktok.com/legal/privacy-policy-eea","requestedUrl":"https://www.tiktok.com/legal/privacy-policy-eea","finalUrl":"https://www.tiktok.com/legal/page/eea/privacy-policy/en","capturedAt":"2026-11-14T23:40:41.910Z","urlDisclosure":"credentials-query-fragment-redacted"}},"assessment":{"summary":"TikTok's Privacy Policy remains unchanged in its core content, detailing extensive data collection and broad sharing practices with global transfers.","overallRisk":"High","overallScore":7,"previousPublicChange":{"id":"8fee8965-4f52-4d9e-86b4-33dc60fdadd7","overallRisk":"Low","overallScore":3,"screeningDate":"2026-11-12T22:40:20.638Z"},"scoreDelta":4,"direction":"higher","reasons":[{"icon":"alert","textEn":"Extensive data collection, including sensitive technical and inferred user data.","textIt":"Ampia raccolta di dati, inclusi dati tecnici sensibili e dati utente inferiti.","deltaScore":0,"evidenceQuote":"We collect certain device and network connection information when you access the Platform. This information includes your device model, operating system, keystroke patterns or rhythms, IP address, system language and device settings. We als","evidenceSide":"old","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"warning","textEn":"Broad data sharing with third parties, advertisers, and global corporate group entities.","textIt":"Ampia condivisione dei dati con terze parti, inserzionisti ed entità del gruppo aziendale globale.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiThirdPartySharing","anchorStatus":"not-recorded"},{"icon":"warning","textEn":"Automated content moderation and personalization lack explicit transparency details.","textIt":"La moderazione automatizzata dei contenuti e la personalizzazione mancano di dettagli trasparenti.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiAutomatedDecision","anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"Extensive data collection, including keystroke patterns, inferred interests, and clipboard content.","textIt":"Ampia raccolta di dati, inclusi schemi di digitazione, interessi inferiti e contenuto degli appunti.","sentiment":"negative"},{"textEn":"Broad sharing of user data with numerous third parties, advertisers, and global corporate entities.","textIt":"Ampia condivisione dei dati utente con numerosi terze parti, inserzionisti ed entità aziendali globali.","sentiment":"negative"},{"textEn":"Automated content moderation and personalized ads based on inferred data are standard practices.","textIt":"La moderazione automatizzata dei contenuti e gli annunci personalizzati basati su dati inferiti sono pratiche standard.","sentiment":"negative"},{"textEn":"Users retain rights to access, delete, port, and object to data processing, with in-app controls.","textIt":"Gli utenti mantengono i diritti di accesso, cancellazione, portabilità e opposizione al trattamento dei dati, con controlli in-app.","sentiment":"positive"},{"textEn":"Global data transfers rely on adequacy decisions and Standard Contractual Clauses for protection.","textIt":"I trasferimenti globali di dati si basano su decisioni di adeguatezza e Clausole Contrattuali Standard per la protezione.","sentiment":"neutral"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises using TikTok face compliance challenges, especially regarding joint controllership with TikTok and cross-border data transfers. Ensuring GDPR compliance for data shared with third parties and corporate entities is critical.","complianceNoteEn":"GDPR Articles 26, 44-49"},{"region":"EU","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"Individuals face high privacy risks due to extensive data collection, automated decision-making, and broad data sharing, despite GDPR-mandated rights. The policy's reliance on legitimate interests for many processing activities may be challenged under GDPR.","complianceNoteEn":"GDPR Articles 6, 9, 22"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises must navigate complex regulatory landscapes when integrating with TikTok, especially concerning data residency, cross-border transfers, and varying consent requirements. Due diligence on TikTok's practices is essential.","complianceNoteEn":"International Data Transfer"},{"region":"Global","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"Globally, individuals face high privacy risks due to TikTok's extensive data collection, global data transfers, and opaque automated processing. The lack of universal strong data protection standards exacerbates these concerns.","complianceNoteEn":"Global Data Protection"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"US enterprises must manage risks associated with broad data sharing and potential liabilities from TikTok's data practices. Ensuring vendor agreements align with US state privacy laws is important.","complianceNoteEn":"State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"US individuals face medium privacy risks due to extensive data collection and sharing, though state laws like CCPA/CPRA provide some rights. The policy's broad data use for personalization and advertising is a key concern.","complianceNoteEn":"CCPA/CPRA, VCDPA, CPA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiContentModeration","label":"Content moderation","value":"Partial"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Explicit Opt-In"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Policy source still match the recorded public snapshot version 6?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/34c3d794-dc39-4c5a-b425-809f4a7dbb1e","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"2b783ae44d276295cf6fee850dfd71c7b8c8d4fded97474788fbc7d0b4b4e91c"}