{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.1.0","mappingVersion":"2026-07-29.1","changeId":"4ae50dcf-48c0-40f8-b4d0-b36be7a2d254","screeningDate":"2026-11-07T19:41:55.590Z","publicationGate":"published","company":{"id":"83da1ad9-8891-4372-a9db-bdf82c894d2a","name":"Anthropic","slug":"anthropic","industry":"Tech Giant"},"policy":{"id":"1cc677eb-3207-4569-880a-aaba223b4803","name":"Privacy Policy","type":"privacy","jurisdiction":"Global","sourceUrl":"https://www.anthropic.com/legal/privacy"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-11-07T19:41:55.579Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":2,"sha256":"fa3c2c9786ca92b832bdbfd3e9ab8d50a8b7a3a9daf8c4333827483a479a24b3","capturedAt":"2026-10-22T11:42:38.645Z"},"current":{"version":3,"sha256":"cf2e9643927a84a5292d48955908b5653ea60f065036c58874dc8b2cd7c09060","capturedAt":"2026-11-07T19:41:55.579Z"}},"analysisLineage":{"status":"verified","requestSha256":"83908402110072f99684258d716bfd206a586b63d3fb524b59691c5e51cdd398","responseSha256":"c812d64589562b3829d23e88022c34434889e568b56d0d119db09f81ebee9487","model":"gemini-2.5-flash","promptVersion":"policy-analysis.v3-full-document","schemaVersion":"policy-analysis.schema.v2","inputCoverage":"complete","semanticCoverage":"not_measured","documents":{"old":{"sha256":"fa3c2c9786ca92b832bdbfd3e9ab8d50a8b7a3a9daf8c4333827483a479a24b3","charLength":39178,"byteLength":39274,"rangeUnit":"utf16-code-unit","includedRanges":[[0,39178]],"excludedRanges":[]},"new":{"sha256":"cf2e9643927a84a5292d48955908b5653ea60f065036c58874dc8b2cd7c09060","charLength":39168,"byteLength":39264,"rangeUnit":"utf16-code-unit","includedRanges":[[0,39168]],"excludedRanges":[]}},"boundary":"Hash verification links retained inputs and the application SDK request. It does not prove provider execution, semantic completeness or legal correctness."},"captureLineage":{"old":{"provenance":"captured","sourceUrl":"https://www.anthropic.com/legal/privacy","requestedUrl":"https://www.anthropic.com/legal/privacy","finalUrl":"https://www.anthropic.com/legal/privacy","capturedAt":"2026-10-22T11:42:38.645Z","urlDisclosure":"credentials-query-fragment-redacted"},"current":{"provenance":"captured","sourceUrl":"https://www.anthropic.com/legal/privacy","requestedUrl":"https://www.anthropic.com/legal/privacy","finalUrl":"https://www.anthropic.com/legal/privacy","capturedAt":"2026-11-07T19:41:55.579Z","urlDisclosure":"credentials-query-fragment-redacted"}},"assessment":{"summary":"This policy version shows no changes, maintaining existing data collection, AI training practices with opt-out, and cross-border data transfer mechanisms.","overallRisk":"Medium","overallScore":6,"previousPublicChange":{"id":"742c9bd7-04e7-474b-8484-d2f4e670177c","overallRisk":"Medium","overallScore":6,"screeningDate":"2026-10-22T11:42:38.652Z"},"scoreDelta":0,"direction":"unchanged","reasons":[{"icon":"warning","textEn":"Extensive data collection for AI training, including user inputs.","textIt":"Ampia raccolta dati per addestramento AI, inclusi gli input degli utenti.","deltaScore":0,"evidenceQuote":"Data that our users or crowd workers provide, including Inputs and Outputs from our Services (unless users opt out)","evidenceSide":"old","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"warning","textEn":"Cross-border data transfers to countries outside EEA/UK.","textIt":"Trasferimenti dati transfrontalieri verso paesi al di fuori di SEE/UK.","deltaScore":0,"evidenceQuote":"your personal data is transferred to our servers in the US, or to other countries outside the European Economic Area (“EEA”) and the UK","evidenceSide":"old","relatedKpi":"kpiCrossBorderTransfer","anchorStatus":"verified"},{"icon":"warning","textEn":"Biometric data collected for identity verification purposes.","textIt":"Dati biometrici raccolti per scopi di verifica dell'identità.","deltaScore":0,"evidenceQuote":"facial geometry templates (which may be considered ‘biometric data’ in some jurisdictions)","evidenceSide":"old","relatedKpi":"kpiDataCollection","anchorStatus":"verified"}],"keyPoints":[{"textEn":"No policy changes were detected in this updated version, maintaining the status quo.","textIt":"Nessuna modifica alla politica è stata rilevata in questa versione aggiornata, mantenendo lo status quo.","sentiment":"neutral"},{"textEn":"Users can opt-out of their Inputs and Outputs being used for AI model training via account settings.","textIt":"Gli utenti possono disattivare l'uso dei loro Input e Output per l'addestramento dei modelli AI tramite le impostazioni dell'account.","sentiment":"positive"},{"textEn":"Personal data is transferred internationally, relying on Standard Contractual Clauses and adequacy decisions.","textIt":"I dati personali vengono trasferiti a livello internazionale, basandosi su Clausole Contrattuali Standard e decisioni di adeguatezza.","sentiment":"neutral"},{"textEn":"Biometric data, such as facial geometry templates, may be collected for identity verification.","textIt":"Dati biometrici, come i modelli di geometria facciale, possono essere raccolti per la verifica dell'identità.","sentiment":"negative"},{"textEn":"Comprehensive data subject rights are outlined, including access, deletion, and correction requests.","textIt":"Sono delineati diritti completi degli interessati, inclusi richieste di accesso, cancellazione e correzione.","sentiment":"positive"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Companies using Anthropic's services must ensure their data processing aligns with GDPR and future AI Act requirements, especially concerning international data transfers and model training. Reliance on SCCs requires thorough due diligence.","complianceNoteEn":"GDPR Art. 46, AI Act"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"GDPR rights are acknowledged, but cross-border data transfers to the US and other non-adequate countries remain a key concern, relying on SCCs. The upcoming AI Act will introduce new obligations for AI systems, impacting how personal data is used for training.","complianceNoteEn":"GDPR Art. 44, AI Act"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Companies operating globally must navigate diverse data protection laws when integrating Anthropic's AI services. Ensuring consistent compliance across jurisdictions, especially for data transfers and AI training, is complex.","complianceNoteEn":"International Data Laws"},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The policy outlines general data rights and acknowledges varying legal frameworks globally, offering some level of protection. Cross-border data flows are a universal consideration, requiring users to understand international transfer risks.","complianceNoteEn":"Global Privacy Norms"},{"region":"US","perspective":"Enterprise","riskLevel":"Low","impactAnalysisEn":"Businesses must ensure their use of Anthropic's services complies with US state-specific privacy laws, particularly regarding data sharing and consumer rights. Data processing agreements are crucial for managing liabilities.","complianceNoteEn":"State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"Low","impactAnalysisEn":"Users have rights similar to CCPA/CPRA, including deletion and opt-out for targeted advertising. Specific disclosures for consumer health data laws in Washington are noted, offering additional protections for sensitive data.","complianceNoteEn":"CCPA/CPRA, State Privacy Laws"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiContentModeration","label":"Content moderation","value":"Opaque"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Policy source still match the recorded public snapshot version 3?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/4ae50dcf-48c0-40f8-b4d0-b36be7a2d254","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"f3dd991a017e42f04861aa713ebe50d0e0f29ce6e193f0c341994ce959350d55"}