{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.1.0","mappingVersion":"2026-07-29.1","changeId":"48d1072d-dff1-448b-af7c-8dc587906e03","screeningDate":"2026-10-24T12:42:50.476Z","publicationGate":"published","company":{"id":"c0caa75b-cc98-45c5-9b6b-198af2014025","name":"PayPal","slug":"paypal","industry":"FinTech"},"policy":{"id":"dc8f08a1-4c7e-4b31-a1cd-c3f8597c965a","name":"User Agreement","type":"terms","jurisdiction":"EU","sourceUrl":"https://www.paypal.com/lu/legalhub/paypal/useragreement-full"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-10-24T12:42:50.454Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":8,"sha256":"3e217da9e7ae7a1db9b349adc236cadeadd301a3ed9218ab56117447e2280894","capturedAt":"2026-10-20T09:41:40.497Z"},"current":{"version":9,"sha256":"dcc651853121f39a69abe965fdc1aa7b74abee98a7ce2a4a039a11821a93bea1","capturedAt":"2026-10-24T12:42:50.454Z"}},"analysisLineage":{"status":"verified","requestSha256":"07769ddacbc8b152999e76e0afa0fa653727d982095535bc0559ebdcbe396e95","responseSha256":"01868534872c149248053d1031f44c980ab5e8d55fec36caaab9cfe60a72a72e","model":"gemini-2.5-flash","promptVersion":"policy-analysis.v3-full-document","schemaVersion":"policy-analysis.schema.v2","inputCoverage":"complete","semanticCoverage":"not_measured","documents":{"old":{"sha256":"3e217da9e7ae7a1db9b349adc236cadeadd301a3ed9218ab56117447e2280894","charLength":140512,"byteLength":140910,"rangeUnit":"utf16-code-unit","includedRanges":[[0,140512]],"excludedRanges":[]},"new":{"sha256":"dcc651853121f39a69abe965fdc1aa7b74abee98a7ce2a4a039a11821a93bea1","charLength":140513,"byteLength":140911,"rangeUnit":"utf16-code-unit","includedRanges":[[0,140513]],"excludedRanges":[]}},"boundary":"Hash verification links retained inputs and the application SDK request. It does not prove provider execution, semantic completeness or legal correctness."},"captureLineage":{"old":{"provenance":"captured","sourceUrl":"https://www.paypal.com/lu/legalhub/paypal/useragreement-full","requestedUrl":"https://www.paypal.com/lu/legalhub/paypal/useragreement-full","finalUrl":"https://www.paypal.com/lu/legalhub/paypal/useragreement-full","capturedAt":"2026-10-20T09:41:40.497Z","urlDisclosure":"credentials-query-fragment-redacted"},"current":{"provenance":"captured","sourceUrl":"https://www.paypal.com/lu/legalhub/paypal/useragreement-full","requestedUrl":"https://www.paypal.com/lu/legalhub/paypal/useragreement-full","finalUrl":"https://www.paypal.com/lu/legalhub/paypal/useragreement-full","capturedAt":"2026-10-24T12:42:50.454Z","urlDisclosure":"credentials-query-fragment-redacted"}},"assessment":{"summary":"The PayPal User Agreement for Luxembourg residents remains unchanged, detailing account rules, payment terms, fees, and dispute resolution processes.","overallRisk":"High","overallScore":7,"previousPublicChange":{"id":"5f802eed-6d0d-453b-8678-01077a1c1a2d","overallRisk":"Medium","overallScore":6,"screeningDate":"2026-10-20T09:41:40.514Z"},"scoreDelta":1,"direction":"higher","reasons":[{"icon":"alert","textEn":"Users bear broad liability for reversals, chargebacks, claims, fees, fines, and penalties.","textIt":"Gli utenti hanno un'ampia responsabilità per storni, chargeback, reclami, commissioni, multe e sanzioni.","deltaScore":0,"evidenceQuote":"You are responsible for all reversals, chargebacks, claims, fees, fines, penalties and other liability incurred by PayPal, any PayPal user, or any third party caused by or arising out of your breach of this user agreement and/or your use of","evidenceSide":"new","relatedKpi":"kpiRegulatoryCompliance","anchorStatus":"verified"},{"icon":"warning","textEn":"PayPal can unilaterally suspend, limit, or terminate accounts based on confidential criteria.","textIt":"PayPal può sospendere, limitare o chiudere unilateralmente gli account basandosi su criteri confidenziali.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiAutomatedDecision","anchorStatus":"not-recorded"},{"icon":"warning","textEn":"PayPal disclaims many warranties and limits its liability for various damages.","textIt":"PayPal declina molte garanzie e limita la sua responsabilità per vari danni.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiRegulatoryCompliance","anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"The agreement details account opening, types (personal/business), security, and closure procedures for users.","textIt":"L'accordo descrive l'apertura dell'account, i tipi (personale/aziendale), la sicurezza e le procedure di chiusura per gli utenti.","sentiment":"neutral"},{"textEn":"It outlines funding sources, currency conversion, and how payments are sent and received through PayPal services.","textIt":"Delinea le fonti di finanziamento, la conversione di valuta e come i pagamenti vengono inviati e ricevuti tramite i servizi PayPal.","sentiment":"neutral"},{"textEn":"Users face broad liability for reversals, chargebacks, and fines, with PayPal retaining significant control.","textIt":"Gli utenti affrontano un'ampia responsabilità per storni, chargeback e multe, con PayPal che mantiene un controllo significativo.","sentiment":"negative"},{"textEn":"PayPal is supervised by the CSSF and commits to regulatory compliance, including PSD2 and DSA.","textIt":"PayPal è supervisionato dalla CSSF e si impegna alla conformità normativa, inclusi PSD2 e DSA.","sentiment":"positive"},{"textEn":"Sellers and PayPal act as independent data controllers, each responsible for their data processing.","textIt":"Venditori e PayPal agiscono come titolari del trattamento dati indipendenti, ciascuno responsabile del proprio trattamento.","sentiment":"neutral"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"High","impactAnalysisEn":"Businesses face significant liability for chargebacks and reversals, and PayPal's discretion in account management. Corporate Customers also explicitly waive certain PSD2 rights, increasing their risk exposure.","complianceNoteEn":"PSD2, DSA"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Individuals are subject to broad liability clauses and PayPal's unilateral account actions, potentially impacting access to funds. However, EU consumer protection regulations like PSD2 and DSA offer some recourse for disputes and content moderation.","complianceNoteEn":"GDPR, PSD2, DSA"},{"region":"Global","perspective":"Enterprise","riskLevel":"High","impactAnalysisEn":"Enterprises worldwide must navigate PayPal's strict terms regarding liability, account holds, and dispute fees, which can significantly affect business operations and financial stability across different jurisdictions.","complianceNoteEn":"International Business Regulations"},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Individuals globally are subject to PayPal's extensive control over accounts and funds, and broad liability terms. Dispute resolution processes are outlined but can be complex and time-consuming for users.","complianceNoteEn":"Global Consumer Protection"},{"region":"US","perspective":"Enterprise","riskLevel":"High","impactAnalysisEn":"Businesses face substantial liability and PayPal's broad rights to manage accounts and funds, potentially impacting operations and cash flow. The 'no warranty' clause is a significant factor for businesses.","complianceNoteEn":"State Business Laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Users are bound by the 'as-is' warranty and limited liability clauses, which may offer less protection than some state laws. Account holds and limitations can severely restrict access to funds without clear transparency.","complianceNoteEn":"CCPA, State Consumer Laws"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiContentModeration","label":"Content moderation","value":"Partial"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Implicit"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original User Agreement source still match the recorded public snapshot version 9?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/48d1072d-dff1-448b-af7c-8dc587906e03","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"d6c8bc413ef9ef09406db1ea3d480d5bd20c0d322e7da18a3748dca399cfaae6"}