{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.1.0","mappingVersion":"2026-07-29.1","changeId":"49f0fd14-1e9d-4a0f-b9f2-5c8f92147544","screeningDate":"2026-10-18T07:41:59.390Z","publicationGate":"published","company":{"id":"3e20dca5-ce3f-4e7e-930c-7aa4753a789d","name":"Google","slug":"google","industry":"Tech Giant"},"policy":{"id":"4b255c8b-197c-4046-b848-bce7e1485583","name":"Privacy Policy","type":"privacy","jurisdiction":"EU","sourceUrl":"https://policies.google.com/privacy"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-10-23T11:38:47.592Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":4,"sha256":"079b208a94d1b3dbc4092311679126c1b3c9f8e96d3c7ac02934d73997cde550","capturedAt":"2026-10-14T03:40:46.685Z"},"current":{"version":5,"sha256":"10570755198c0b6cd5d6ccac20a2bed41dfc42e8440e8ca4a71ee7c403f6e7b8","capturedAt":"2026-10-18T07:41:59.373Z"}},"analysisLineage":{"status":"verified","requestSha256":"65de28e59836e4ff992ed4f861113082861bb535b93a86e7fd7f6598909bd61c","responseSha256":"647d53adca50514738d4e2cd40798b9117e52ba85ffe1298e63645adb871df59","model":"gemini-2.5-flash","promptVersion":"policy-analysis.v3-full-document","schemaVersion":"policy-analysis.schema.v2","inputCoverage":"complete","semanticCoverage":"not_measured","documents":{"old":{"sha256":"079b208a94d1b3dbc4092311679126c1b3c9f8e96d3c7ac02934d73997cde550","charLength":121576,"byteLength":122071,"rangeUnit":"utf16-code-unit","includedRanges":[[0,121576]],"excludedRanges":[]},"new":{"sha256":"10570755198c0b6cd5d6ccac20a2bed41dfc42e8440e8ca4a71ee7c403f6e7b8","charLength":122813,"byteLength":123312,"rangeUnit":"utf16-code-unit","includedRanges":[[0,122813]],"excludedRanges":[]}},"boundary":"Hash verification links retained inputs and the application SDK request. It does not prove provider execution, semantic completeness or legal correctness."},"captureLineage":{"old":{"provenance":"unknown","sourceUrl":null,"requestedUrl":null,"finalUrl":null,"capturedAt":"2026-10-14T03:40:46.685Z","urlDisclosure":"credentials-query-fragment-redacted"},"current":{"provenance":"captured","sourceUrl":"https://policies.google.com/privacy","requestedUrl":"https://policies.google.com/privacy","finalUrl":"https://policies.google.com/privacy","capturedAt":"2026-10-18T07:41:59.373Z","urlDisclosure":"credentials-query-fragment-redacted"}},"assessment":{"summary":"Google's updated policy allows users to opt-in to share data across services like Gmail and Drive for personalized content and ads, a shift from previous restrictions.","overallRisk":"High","overallScore":7,"previousPublicChange":{"id":"3b7777e3-cc17-4498-a1ec-e6e1256ffb17","overallRisk":"High","overallScore":7,"screeningDate":"2026-10-14T03:40:46.692Z"},"scoreDelta":0,"direction":"unchanged","reasons":[{"icon":"warning","textEn":"Expanded data use for personalization across Google services.","textIt":"Uso esteso dei dati per la personalizzazione tra i servizi Google.","deltaScore":2,"evidenceQuote":"Puoi scegliere di consentire a determinati servizi Google, inclusi servizi come la Ricerca o le app Gemini, di accedere ai dati di altri servizi Google che utilizzi, come Google Foto e le app Workspace come Gmail e Drive, al fine di offrirt","evidenceSide":"new","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"alert","textEn":"Conditional use of sensitive content (Gmail, Drive) for personalized ads.","textIt":"Uso condizionale di contenuti sensibili (Gmail, Drive) per annunci personalizzati.","deltaScore":1,"evidenceQuote":"Non ti mostriamo annunci personalizzati basati sui tuoi contenuti di Drive, Gmail o Google Foto, a meno che tu non scelga di rendere disponibili i dati di questi servizi ad altri servizi Google che supportano gli annunci personalizzati.","evidenceSide":"new","relatedKpi":"kpiThirdPartySharing","anchorStatus":"verified"},{"icon":"info","textEn":"New explicit opt-in mechanism for cross-service data linking.","textIt":"Nuovo meccanismo di opt-in esplicito per il collegamento dei dati tra servizi.","deltaScore":1,"evidenceQuote":"Puoi scegliere di consentire a determinati servizi Google, inclusi servizi come la Ricerca o le app Gemini, di accedere ai dati di altri servizi Google che utilizzi, come Google Foto e le app Workspace come Gmail e Drive, al fine di offrirt","evidenceSide":"new","relatedKpi":"kpiConsentMechanism","anchorStatus":"verified"}],"keyPoints":[{"textEn":"New opt-in for cross-service data sharing for personalization and ads, including data from Gmail, Drive, and Photos.","textIt":"Nuovo opt-in per la condivisione di dati tra servizi per personalizzazione e annunci, inclusi dati da Gmail, Drive e Foto.","sentiment":"negative"},{"textEn":"Previously restricted data (Gmail, Drive, Photos) can now be used for personalized ads with user consent.","textIt":"Dati precedentemente limitati (Gmail, Drive, Foto) possono ora essere usati per annunci personalizzati con consenso utente.","sentiment":"negative"},{"textEn":"Explicit user choice is required for this expanded data use, providing a level of control.","textIt":"È richiesta una scelta esplicita dell'utente per questo uso esteso dei dati, offrendo un livello di controllo.","sentiment":"positive"},{"textEn":"AI services like Gemini can leverage more user data for personalized experiences if consent is given.","textIt":"Servizi AI come Gemini possono utilizzare più dati utente per esperienze personalizzate se viene dato il consenso.","sentiment":"negative"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises using Google Workspace must ensure their internal policies and user consent mechanisms are updated. This change impacts data governance and compliance strategies under GDPR and the upcoming AI Act.","complianceNoteEn":"GDPR, AI Act"},{"region":"EU","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"The change requires explicit consent for cross-service data linking, aligning with GDPR principles. However, users must actively manage these new choices to prevent broader data use for personalization and AI, which could be seen as a response to the Digital Markets Act (DMA).","complianceNoteEn":"GDPR Art. 6, DMA"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises must adapt their data governance frameworks to Google's new data linking capabilities. This requires careful consideration of various international data protection regulations and internal compliance.","complianceNoteEn":null},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The policy introduces more granular control but also expands the scope of data use for personalization and AI globally. Users worldwide must actively manage their settings to maintain their desired privacy level.","complianceNoteEn":null},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses using Google services should review their data handling practices and user agreements. Compliance with state-specific privacy laws like CCPA/CPRA becomes more complex with expanded data linking options.","complianceNoteEn":"CCPA/CPRA"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"While offering an opt-in, this change expands the potential for data use for personalization and AI. Users need to be vigilant about their privacy settings to exercise rights under CCPA/CPRA.","complianceNoteEn":"CCPA/CPRA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiContentModeration","label":"Content moderation","value":"Transparent"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Explicit Opt-In"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Policy source still match the recorded public snapshot version 5?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/49f0fd14-1e9d-4a0f-b9f2-5c8f92147544","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"a46839467cd5f6bfdb2436810ded8c9105f2e64b52e9a5d0451ca2846d21beb1"}