{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"686214a4-1396-4f81-bdd0-63a523dcf90a","screeningDate":"2026-07-10T01:51:12.251Z","publicationGate":"published","company":{"id":"6f69e944-8b6c-4dce-8693-58804624471b","name":"Meta","slug":"meta","industry":"Tech Giant"},"policy":{"id":"5946f95d-2fa3-4628-896a-f773d09ffbbd","name":"Privacy Policy","type":"privacy","jurisdiction":"US","sourceUrl":"https://www.facebook.com/privacy/policy/"},"sourceConfidence":{"state":"review-required","lastCheckedAt":"2026-07-06T03:59:34.660Z","retrievalChannel":"seeded","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":2,"sha256":"9c785dc13c6976d29569fd221c435e1277e0fbe12fad803f4b1b69392652504b","capturedAt":"2026-07-06T22:11:16.602Z"},"current":{"version":3,"sha256":"52164a545dbe7a8d2468fdc70157cf96f334218f3157404e271267a6f71d9f8c","capturedAt":"2026-07-10T01:51:12.248Z"}},"assessment":{"summary":"Meta's policy update expands AI use and legal transparency, but lacks clear user controls for AI training and content ownership, raising privacy concerns.","overallRisk":"Medium","overallScore":6,"previousPublicChange":{"id":"6c63cb4a-b2bd-496e-b994-7def76160bde","overallRisk":"High","overallScore":8,"screeningDate":"2026-07-06T22:11:16.607Z"},"scoreDelta":-2,"direction":"lower","reasons":[{"icon":"warning","textEn":"Broad AI data collection for training without explicit user opt-out.","textIt":"Ampia raccolta dati IA per l'addestramento senza opt-out esplicito dell'utente.","deltaScore":-1.5,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"},{"icon":"warning","textEn":"Ambiguous ownership of user-generated content created with Meta's AI.","textIt":"Proprietà ambigua dei contenuti generati dall'utente con l'IA di Meta.","deltaScore":-0.5,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"},{"icon":"info","textEn":"Enhanced legal transparency for EU users, detailing specific compliance obligations.","textIt":"Trasparenza legale migliorata per gli utenti UE, dettagliando gli obblighi specifici.","deltaScore":1,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"Expanded AI use for content creation, personalization, and offering AI tech to third parties.","textIt":"Uso esteso dell'IA per la creazione di contenuti, personalizzazione e offerta di tecnologia IA a terzi.","sentiment":"negative"},{"textEn":"Increased transparency on legal bases, citing specific EU and Irish regulations for data processing.","textIt":"Maggiore trasparenza sulle basi legali, citando specifiche normative UE e irlandesi per il trattamento dei dati.","sentiment":"positive"},{"textEn":"New clauses explicitly address safeguards and well-being for users under the age of majority.","textIt":"Nuove clausole affrontano esplicitamente le salvaguardie e il benessere degli utenti minorenni.","sentiment":"positive"},{"textEn":"No explicit opt-out for user data being used to train Meta's AI models is provided.","textIt":"Non è previsto un opt-out esplicito per l'utilizzo dei dati utente per addestrare i modelli IA di Meta.","sentiment":"negative"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Detailed legal compliance references (GDPR, Data Act, DORA) are beneficial for enterprises integrating with Meta. Yet, the broad scope of AI data processing and sharing with third parties requires careful due diligence for data governance.","complianceNoteEn":"GDPR, Data Act, DORA"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The policy offers greater transparency on legal bases, aligning with GDPR requirements. However, expanded AI use without clear opt-out for training data raises concerns under the upcoming AI Act and existing data protection principles.","complianceNoteEn":"GDPR Art 6, AI Act"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises operating globally must navigate Meta's extensive data processing and AI development, ensuring their own compliance across diverse jurisdictions. The lack of explicit AI training opt-out could complicate data governance strategies.","complianceNoteEn":"International Data Transfer"},{"region":"Global","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"The policy's global reach means expanded AI data collection affects users worldwide, regardless of local regulations. Cross-border data transfers remain unrestricted, posing consistent privacy risks for individuals.","complianceNoteEn":"Global Data Protection"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses using Meta's platforms face continued broad data sharing for advertising and insights. The expanded AI capabilities offer new tools but also necessitate understanding data flows and compliance with evolving state privacy and AI laws.","complianceNoteEn":"State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Broad data collection and sharing practices persist, impacting user privacy under CCPA/CPRA. The expanded AI use, without explicit opt-out for training, could lead to new privacy challenges as state AI regulations emerge.","complianceNoteEn":"CCPA/CPRA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Committed"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Committed"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Committed"},{"field":"kpiContentModeration","label":"Content moderation","value":"Partial"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Implicit"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Committed"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Policy source still match the recorded public snapshot version 3?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/686214a4-1396-4f81-bdd0-63a523dcf90a","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"082718b06a9430158dfab3a9963db5d2991b0ef0323d8f8b96388d21ccaf43d5"}