{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"61a7ae88-69d7-4ef1-a5c8-48c71b078187","screeningDate":"2026-10-01T19:45:01.927Z","publicationGate":"published","company":{"id":"3e20dca5-ce3f-4e7e-930c-7aa4753a789d","name":"Google","slug":"google","industry":"Tech Giant"},"policy":{"id":"4b255c8b-197c-4046-b848-bce7e1485583","name":"Privacy Policy","type":"privacy","jurisdiction":"EU","sourceUrl":"https://policies.google.com/privacy"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-10-01T19:45:01.907Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":2,"sha256":"1c28ab187c38f58e8028b79637ebf0943028dc3541b45553f3e059b8b3daf6c2","capturedAt":"2026-07-24T20:56:45.180Z"},"current":{"version":3,"sha256":"3877df381d43fa097e08017987ead6bcb7d59d218230c95c7c9709041caa2838","capturedAt":"2026-10-01T19:45:01.916Z"}},"assessment":{"summary":"The Google Privacy Policy has not changed, maintaining existing data collection practices and user controls without introducing new risks.","overallRisk":"Medium","overallScore":6,"previousPublicChange":{"id":"f863326f-229b-4494-8b13-239f8fcd72a4","overallRisk":"Medium","overallScore":6,"screeningDate":"2026-07-24T20:56:45.188Z"},"scoreDelta":0,"direction":"unchanged","reasons":[{"icon":"info","textEn":"No changes detected in the policy content, maintaining current data practices.","textIt":"Nessuna modifica rilevata nella policy, mantenendo le attuali pratiche sui dati.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"},{"icon":"info","textEn":"Existing user controls for privacy management are still available as before.","textIt":"I controlli utente esistenti per la gestione della privacy sono ancora disponibili.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiConsentMechanism","anchorStatus":"not-recorded"},{"icon":"warning","textEn":"Extensive data collection for personalization and AI training remains a core practice.","textIt":"L'ampia raccolta dati per personalizzazione e training AI rimane una pratica centrale.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiDataCollection","anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"The policy content is identical to the previous version, indicating no new data practices or changes to user rights.","textIt":"Il contenuto della policy è identico alla versione precedente, non introducendo nuove pratiche sui dati o modifiche ai diritti degli utenti.","sentiment":"neutral"},{"textEn":"Users continue to have access to privacy controls for managing activity, ad settings, and data deletion.","textIt":"Gli utenti continuano ad avere accesso ai controlli sulla privacy per la gestione delle attività, delle impostazioni annunci e l'eliminazione dei dati.","sentiment":"neutral"},{"textEn":"Google's extensive data collection across services for personalization and service improvement remains consistent.","textIt":"L'ampia raccolta di dati di Google attraverso i servizi per la personalizzazione e il miglioramento del servizio rimane invariata.","sentiment":"neutral"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"No changes mean no new compliance burdens for EU enterprises integrating Google services. Existing data processing agreements and compliance frameworks remain relevant.","complianceNoteEn":"GDPR Article 28 (Processor)"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The policy's consistency means no new direct impact on individual rights under GDPR. Users should continue to leverage existing privacy controls to manage their data.","complianceNoteEn":"GDPR Articles 15-22 (Data Subject Rights)"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises integrating Google services face no new policy implications. They should continue to ensure their own compliance with local and international data protection standards.","complianceNoteEn":"International Data Transfer Mechanisms"},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Globally, individuals experience no change in Google's privacy commitments or data handling. The existing framework of user controls remains the primary tool for managing personal data.","complianceNoteEn":"Global Data Protection Principles"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"US businesses using Google services will find no new policy requirements. Continued adherence to existing data protection laws like CCPA and state-specific regulations is necessary.","complianceNoteEn":"State Privacy Laws (e.g., CCPA, VCDPA, CPA)"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"US individuals face no new policy changes, so their privacy rights under CCPA/CPRA are unaffected. They should continue to use Google's privacy dashboard for data management.","complianceNoteEn":"CCPA/CPRA (Right to Know, Delete, Opt-Out)"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiContentModeration","label":"Content moderation","value":"Opaque"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Policy source still match the recorded public snapshot version 3?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/61a7ae88-69d7-4ef1-a5c8-48c71b078187","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"eaa7c506bd2ed0fb7f062ce0d4c30236c4336159a084a47fa4b0d9e9bf3bf958"}