{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.1.0","mappingVersion":"2026-07-29.1","changeId":"3b7777e3-cc17-4498-a1ec-e6e1256ffb17","screeningDate":"2026-10-14T03:40:46.692Z","publicationGate":"published","company":{"id":"3e20dca5-ce3f-4e7e-930c-7aa4753a789d","name":"Google","slug":"google","industry":"Tech Giant"},"policy":{"id":"4b255c8b-197c-4046-b848-bce7e1485583","name":"Privacy Policy","type":"privacy","jurisdiction":"EU","sourceUrl":"https://policies.google.com/privacy"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-10-22T11:38:39.374Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":3,"sha256":"3877df381d43fa097e08017987ead6bcb7d59d218230c95c7c9709041caa2838","capturedAt":"2026-10-01T19:45:01.916Z"},"current":{"version":4,"sha256":"079b208a94d1b3dbc4092311679126c1b3c9f8e96d3c7ac02934d73997cde550","capturedAt":"2026-10-14T03:40:46.685Z"}},"analysisLineage":{"status":"not_recorded","inputCoverage":"unknown","semanticCoverage":"not_measured","boundary":"Hash verification links retained inputs and the application SDK request. It does not prove provider execution, semantic completeness or legal correctness."},"captureLineage":{"old":{"provenance":"unknown","sourceUrl":null,"requestedUrl":null,"finalUrl":null,"capturedAt":"2026-10-01T19:45:01.916Z","urlDisclosure":"credentials-query-fragment-redacted"},"current":{"provenance":"unknown","sourceUrl":null,"requestedUrl":null,"finalUrl":null,"capturedAt":"2026-10-14T03:40:46.685Z","urlDisclosure":"credentials-query-fragment-redacted"}},"assessment":{"summary":"Google's updated policy clarifies it collects data from your devices even when you're not logged in, using unique identifiers for personalization.","overallRisk":"High","overallScore":7,"previousPublicChange":{"id":"61a7ae88-69d7-4ef1-a5c8-48c71b078187","overallRisk":"Medium","overallScore":6,"screeningDate":"2026-10-01T19:45:01.927Z"},"scoreDelta":1,"direction":"higher","reasons":[{"icon":"info","textEn":"Explicit logged-out data collection via unique identifiers is now stated.","textIt":"È ora dichiarata la raccolta esplicita di dati da disconnessi tramite identificatori unici.","deltaScore":1,"evidenceQuote":"Google raccoglie e utilizza anche dati non associati al tuo account. Per esempio, quando non esegui l'accesso a un Account Google, archiviamo le informazioni che raccogliamo tramite identificatori univoci legati al browser, all'applicazione","evidenceSide":"new","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"info","textEn":"Personalization based on logged-out device activity is now clearer.","textIt":"La personalizzazione basata sull'attività del dispositivo da disconnesso è più chiara.","deltaScore":1,"evidenceQuote":"Ciò ci consente, tra le altre cose, di mantenere le stesse preferenze tra una sessione di navigazione e l'altra, ad esempio la tua lingua preferita o se visualizzare o meno annunci o risultati di ricerca più pertinenti in base alle tue atti","evidenceSide":"new","relatedKpi":"kpiAutomatedDecision","anchorStatus":"verified"},{"icon":"warning","textEn":"Policy lacks transparency on how automated systems and algorithms function.","textIt":"La policy manca di trasparenza sul funzionamento di sistemi e algoritmi automatizzati.","deltaScore":1,"evidenceQuote":"Utilizziamo sistemi automatizzati che analizzano i tuoi contenuti per fornirti ad esempio i risultati di ricerca su misura per te, gli annunci personalizzati o altre funzionalità modellate in base a come utilizzi i nostri servizi. Inoltre a","evidenceSide":"new","relatedKpi":"kpiAlgoTransparency","anchorStatus":"verified"}],"keyPoints":[{"textEn":"Google now explicitly states it collects data not linked to your account, using unique device identifiers.","textIt":"Google ora dichiara esplicitamente di raccogliere dati non collegati al tuo account, usando identificatori unici del dispositivo.","sentiment":"negative"},{"textEn":"Logged-out activity on your devices can still influence personalized ads and search results.","textIt":"L'attività sui tuoi dispositivi, anche da disconnesso, può influenzare annunci e risultati di ricerca personalizzati.","sentiment":"negative"},{"textEn":"The policy maintains existing privacy controls for managing your data and ad preferences.","textIt":"La policy mantiene i controlli privacy esistenti per la gestione dei tuoi dati e delle preferenze pubblicitarie.","sentiment":"positive"},{"textEn":"Google uses automated systems and algorithms for content analysis and personalization.","textIt":"Google utilizza sistemi automatizzati e algoritmi per l'analisi dei contenuti e la personalizzazione.","sentiment":"neutral"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises using Google services must ensure their data processing agreements and user consent mechanisms align with GDPR, especially concerning device-level tracking for non-logged-in users.","complianceNoteEn":"GDPR Article 6, 13"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The clarification on logged-out data collection, while increasing transparency, highlights extensive processing under GDPR. Users should be aware their device activity contributes to profiling even without an account.","complianceNoteEn":"GDPR Transparency"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises relying on Google's ecosystem must maintain robust privacy frameworks. They need to address diverse international regulations concerning data collection and user consent for all user states.","complianceNoteEn":"Cross-border Data Governance"},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Globally, users should recognize that Google's data collection is extensive, even when not logged in. This emphasizes the need to actively manage privacy settings across all devices.","complianceNoteEn":"Global Privacy Awareness"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses leveraging Google's ad and analytics services must ensure their privacy disclosures and consent flows meet US state privacy laws, particularly regarding cross-context behavioral advertising.","complianceNoteEn":"CPRA Opt-Out"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The policy's explicit mention of logged-out device tracking is relevant for CCPA/CPRA rights. Users should understand how their activity contributes to personalization and exercise opt-out rights.","complianceNoteEn":"CCPA/CPRA Right to Know"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiContentModeration","label":"Content moderation","value":"Opaque"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Policy source still match the recorded public snapshot version 4?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/3b7777e3-cc17-4498-a1ec-e6e1256ffb17","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"b7eb115b1f11cbb3f17f3d8ed65372c4ca31d5ec4d22fc2b821f22d79ae43d40"}