{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"36ec1a14-399c-4961-b2f1-aeb51e8b0b92","screeningDate":"2026-10-09T02:45:00.114Z","publicationGate":"published","company":{"id":"2c5bac29-0643-4196-be90-4b5b2767b6ed","name":"OpenAI","slug":"openai","industry":"AI Provider"},"policy":{"id":"038bc0ee-ddf2-4161-af89-c6c0ec036b3f","name":"Privacy Policy","type":"privacy","jurisdiction":"Global","sourceUrl":"https://openai.com/policies/privacy-policy/"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-10-09T02:45:00.107Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":1,"sha256":"2f2f693d8e75320f5079f1160cb3ed5343f2f9bec082c4afea1762928ea09e32","capturedAt":"2026-10-02T04:56:50.099Z"},"current":{"version":2,"sha256":"da5ee101be311da6c45cb1dd8817e00f678677d5e71166c24059a19ec4336ff1","capturedAt":"2026-10-09T02:45:00.110Z"}},"assessment":{"summary":"No changes were detected in the updated policy, maintaining existing data collection, usage, and sharing practices with user opt-out options.","overallRisk":"High","overallScore":7,"previousPublicChange":null,"scoreDelta":null,"direction":"baseline","reasons":[{"icon":"alert","textEn":"Extensive data collection from various sources, including publicly available internet data.","textIt":"Ampia raccolta di dati da varie fonti, inclusi dati pubblici di internet.","deltaScore":0,"evidenceQuote":"We also collect information from other sources, like information that is publicly available on the internet, to develop the models that power our Services.","evidenceSide":"new","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"warning","textEn":"Broad sharing of personal data with numerous third parties and government authorities.","textIt":"Ampia condivisione di dati personali con numerose terze parti e autorità governative.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiThirdPartySharing","anchorStatus":"not-recorded"},{"icon":"warning","textEn":"Flexible data retention periods with exceptions for legal and security reasons.","textIt":"Periodi di conservazione dei dati flessibili con eccezioni per motivi legali e di sicurezza.","deltaScore":0,"evidenceQuote":"In some cases, we need to retain Personal Data for longer even after you delete it, for example because we are legally required to, to address fraud and abuse, for security reasons, or for financial record-keeping purposes.","evidenceSide":"new","relatedKpi":"kpiDataRetention","anchorStatus":"verified"}],"keyPoints":[{"textEn":"OpenAI collects extensive personal data, including user content, usage data, and information from third-party sources.","textIt":"OpenAI raccoglie dati personali estesi, inclusi contenuti utente, dati di utilizzo e informazioni da terze parti.","sentiment":"negative"},{"textEn":"User data may be shared broadly with vendors, affiliates, government authorities, and other users or third-party partners.","textIt":"I dati utente possono essere ampiamente condivisi con fornitori, affiliati, autorità governative e altri utenti o partner terzi.","sentiment":"negative"},{"textEn":"Users can opt out of their content being used for model training and manage chat history and other data controls.","textIt":"Gli utenti possono disattivare l'uso dei loro contenuti per l'addestramento dei modelli e gestire la cronologia delle chat e altri controlli sui dati.","sentiment":"positive"},{"textEn":"Data retention periods are flexible, allowing for longer retention for legal, security, or fraud prevention reasons.","textIt":"I periodi di conservazione dei dati sono flessibili, consentendo una conservazione più lunga per motivi legali, di sicurezza o di prevenzione delle frodi.","sentiment":"negative"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises using OpenAI services must ensure their data processing agreements align with GDPR requirements, especially concerning data transfers and third-party sharing. The lack of change means no new compliance burdens, but existing ones remain.","complianceNoteEn":"GDPR Articles 28, 44"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"No changes mean existing GDPR rights apply, but broad data collection and sharing still pose privacy concerns. Users should actively use opt-out features to protect their data.","complianceNoteEn":"GDPR Articles 13, 14, 15, 17"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises must continue to navigate diverse international data transfer regulations and ensure their use of OpenAI services aligns with local data residency and privacy requirements. The policy's stability offers no new challenges.","complianceNoteEn":"Cross-Border Data Transfer"},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Globally, individuals face consistent data collection and sharing practices, with the availability of opt-out controls for model training. Awareness of local data protection laws and exercising available rights is crucial.","complianceNoteEn":"Global Data Protection"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses integrating OpenAI services need to consider their own compliance with various state privacy laws regarding data handling and third-party disclosures. The policy's unchanged nature means no new assessments are immediately required.","complianceNoteEn":"State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The policy's broad data collection and sharing practices are consistent with many US state privacy laws like CCPA/CPRA. Users should be aware of how their data is used for advertising and model training.","complianceNoteEn":"CCPA/CPRA Rights"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Partial"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiContentModeration","label":"Content moderation","value":"Opaque"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Policy source still match the recorded public snapshot version 2?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/36ec1a14-399c-4961-b2f1-aeb51e8b0b92","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"95a2ba5fa7b61a28c21ce674a723dff45b510fdbabdc2db6084a7303114cc4cc"}