{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"586c3d9a-1d5d-43dd-bb5e-ca0ef15995ea","screeningDate":"2026-08-01T04:37:05.415Z","publicationGate":"published","company":{"id":"c0caa75b-cc98-45c5-9b6b-198af2014025","name":"PayPal","slug":"paypal","industry":"FinTech"},"policy":{"id":"9e09108f-4041-4c64-8e16-88543e1b7e43","name":"Privacy Statement","type":"privacy","jurisdiction":"US","sourceUrl":"https://www.paypal.com/us/webapps/mpp/ua/privacy-full"},"sourceConfidence":{"state":"review-required","lastCheckedAt":"2026-07-06T03:59:34.660Z","retrievalChannel":"seeded","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":3,"sha256":"454b2ac83b0b91a71efa67e3f19979294f3439aec17b937619690174e02bf9bb","capturedAt":"2026-07-10T01:47:05.636Z"},"current":{"version":4,"sha256":"06b8d9b74879230525e3aad0c15e820f38dba6d2c41a3a99c9baac8c95465ef6","capturedAt":"2026-08-01T04:37:05.409Z"}},"assessment":{"summary":"The PayPal Privacy Statement remains unchanged, detailing extensive data collection, broad sharing, and AI use for training and automated decisions.","overallRisk":"Medium","overallScore":7,"previousPublicChange":{"id":"c401c830-2b20-475a-908c-8c4d762bda1e","overallRisk":"High","overallScore":8,"screeningDate":"2026-07-10T01:47:05.644Z"},"scoreDelta":-1,"direction":"lower","reasons":[{"icon":"alert","textEn":"Extensive collection of personal and sensitive data.","textIt":"Ampia raccolta di dati personali e sensibili.","deltaScore":0,"evidenceQuote":"Biometric data: Such as voice identification, photo identification, or face scans, which we may collect when you consent in the user experience","evidenceSide":"new","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"alert","textEn":"Broad sharing of data with numerous third parties.","textIt":"Ampia condivisione dei dati con numerose terze parti.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiThirdPartySharing","anchorStatus":"not-recorded"},{"icon":"warning","textEn":"AI training and automated decisions lack transparency.","textIt":"La formazione AI e le decisioni automatizzate mancano di trasparenza.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiAiTrainingOptOut","anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"Extensive collection of personal and sensitive data, including biometrics, is outlined.","textIt":"È delineata un'ampia raccolta di dati personali e sensibili, inclusi dati biometrici.","sentiment":"negative"},{"textEn":"Personal data is broadly shared with various third parties and service providers.","textIt":"I dati personali sono ampiamente condivisi con diverse terze parti e fornitori di servizi.","sentiment":"negative"},{"textEn":"Personal information is used for AI model training and automated decision-making processes.","textIt":"Le informazioni personali sono utilizzate per l'addestramento di modelli AI e processi decisionali automatizzati.","sentiment":"negative"},{"textEn":"Consent is explicitly required for collecting biometric and precise geolocation data.","textIt":"Il consenso è esplicitamente richiesto per la raccolta di dati biometrici e di geolocalizzazione precisa.","sentiment":"positive"},{"textEn":"The policy acknowledges jurisdiction-specific privacy rights and GDPR compliance.","textIt":"La politica riconosce i diritti specifici per giurisdizione e la conformità al GDPR.","sentiment":"positive"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Medium risk. Compliance with GDPR and upcoming AI Act requires robust data governance, especially with broad sharing and AI model training.","complianceNoteEn":"GDPR Art. 25, AI Act"},{"region":"EU","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"High risk due to extensive data collection and AI use, despite GDPR mention. Users need clear opt-out for AI training and robust data subject rights.","complianceNoteEn":"GDPR Art. 6, 9, 22"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Medium risk. Managing global data flows and diverse regulatory landscapes requires a comprehensive and adaptable privacy framework.","complianceNoteEn":"Cross-border Data"},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Medium risk. Users globally should be aware of extensive data collection and AI use, and actively manage their privacy settings.","complianceNoteEn":"Global Privacy Norms"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Medium risk. Navigating state-specific privacy laws (e.g., CCPA, VCDPA) and potential federal AI regulations is complex for data handling.","complianceNoteEn":"State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Medium risk. CCPA/CPRA rights apply, but broad data sharing and AI use warrant caution regarding personal data control.","complianceNoteEn":"CCPA/CPRA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Explicit Opt-In"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Statement source still match the recorded public snapshot version 4?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/586c3d9a-1d5d-43dd-bb5e-ca0ef15995ea","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"af49dbcb5bca50f1e9aa040a4a81c1086930a0b8184396321afb9f85df0bada1"}