{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"3a1a0bf1-d724-415b-91bb-85c94f929d1e","screeningDate":"2026-10-01T19:55:02.556Z","publicationGate":"published","company":{"id":"c0caa75b-cc98-45c5-9b6b-198af2014025","name":"PayPal","slug":"paypal","industry":"FinTech"},"policy":{"id":"c28fb784-5012-4696-8c70-505d4185972a","name":"Privacy Statement","type":"privacy","jurisdiction":"EU","sourceUrl":"https://www.paypal.com/lu/webapps/mpp/ua/privacy-full"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-10-01T19:55:02.539Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":8,"sha256":"2dd2c7902e3ae2c1cc74be83b8a7da4561bb3ca381a7d1d718f00a1a3873bbcb","capturedAt":"2026-08-18T03:00:10.960Z"},"current":{"version":9,"sha256":"5d1465082e494d6c0da8ed291548622a699a561e95bde61e1ccd30ecd490deff","capturedAt":"2026-10-01T19:55:02.546Z"}},"assessment":{"summary":"PayPal's updated policy expands data collection from non-account holders and introduces new services involving broader third-party data sharing, increasing privacy risk.","overallRisk":"High","overallScore":7,"previousPublicChange":{"id":"b8cd3366-f02b-4bb6-9211-2c5b3269a404","overallRisk":"Medium","overallScore":6,"screeningDate":"2026-08-18T03:00:10.967Z"},"scoreDelta":1,"direction":"higher","reasons":[{"icon":"alert","textEn":"Expanded data collection from third-party payment networks for non-account holders.","textIt":"Raccolta dati estesa da reti di pagamento terze per non titolari di conto.","deltaScore":2,"evidenceQuote":"receive a payment from a PayPal account holder (through the Visa+ service or other third party wallets, payment networks, and processors)","evidenceSide":"new","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"alert","textEn":"New 'PayPal World transactions' explicitly involve broader third-party data sharing.","textIt":"Nuove 'transazioni PayPal World' implicano una più ampia condivisione dati con terze parti.","deltaScore":2,"evidenceQuote":"We will use information from third parties, including third-party wallets, payment networks, and processors, to process PayPal World transactions.","evidenceSide":"new","relatedKpi":"kpiThirdPartySharing","anchorStatus":"verified"},{"icon":"warning","textEn":"AI training uses personal data without explicit opt-out details in this policy.","textIt":"L'addestramento dell'IA usa dati personali senza dettagli espliciti sull'opt-out.","deltaScore":1,"evidenceQuote":"We may use Personal Information to train our artificial intelligence (AI) models that power our Services","evidenceSide":"old","relatedKpi":"kpiAiTrainingOptOut","anchorStatus":"verified"}],"keyPoints":[{"textEn":"PayPal will now collect data from non-account holders receiving payments via a wider range of third-party wallets and payment networks.","textIt":"PayPal raccoglierà dati da non titolari di conto che ricevono pagamenti tramite un'ampia gamma di wallet e reti di pagamento di terze parti.","sentiment":"negative"},{"textEn":"A new service, 'PayPal World transactions,' explicitly involves using information from various third-party payment processors.","textIt":"Un nuovo servizio, 'transazioni PayPal World', prevede esplicitamente l'uso di informazioni da vari processori di pagamento di terze parti.","sentiment":"negative"},{"textEn":"The policy confirms PayPal uses personal information to train its AI models, but does not detail opt-out options.","textIt":"La policy conferma che PayPal utilizza le informazioni personali per addestrare i suoi modelli di IA, ma non specifica le opzioni di opt-out.","sentiment":"negative"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"PayPal's expanded data practices mean enterprises using PayPal must ensure their own compliance with GDPR and the AI Act, especially regarding third-party data processing and AI governance. Due diligence on data flows is critical.","complianceNoteEn":"GDPR Art 28, AI Act"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Expanded data collection and sharing, especially for non-account holders and new services, raises GDPR concerns regarding consent and transparency. Users should be aware of broader data flows.","complianceNoteEn":"GDPR Articles 6, 9, 13, 14"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises must maintain robust data governance frameworks to manage the expanded data flows and third-party relationships. Ensuring consistent compliance across diverse regulatory landscapes is a growing challenge.","complianceNoteEn":null},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Users globally face increased complexity in understanding how their data is collected and shared across various third-party payment networks. Proactive review of privacy settings is recommended.","complianceNoteEn":null},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses integrating with PayPal need to assess how these changes affect their compliance with various US state privacy laws. Managing third-party data processors and ensuring transparency to users is key.","complianceNoteEn":"State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The broader data collection and sharing could impact consumer privacy rights under state laws like CCPA/CPRA. Users should review their rights to know, delete, and opt-out of data sales/sharing.","complianceNoteEn":"CCPA/CPRA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Statement source still match the recorded public snapshot version 9?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/3a1a0bf1-d724-415b-91bb-85c94f929d1e","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"0beefc26c00128b15cfe9ccd60f7a2a937081f42df0294f3d3d096abbafa9a88"}