{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"6d94c250-62ab-4f8b-88b6-03573281433f","screeningDate":"2026-08-01T04:36:34.328Z","publicationGate":"published","company":{"id":"c0caa75b-cc98-45c5-9b6b-198af2014025","name":"PayPal","slug":"paypal","industry":"FinTech"},"policy":{"id":"c28fb784-5012-4696-8c70-505d4185972a","name":"Privacy Statement","type":"privacy","jurisdiction":"EU","sourceUrl":"https://www.paypal.com/lu/webapps/mpp/ua/privacy-full"},"sourceConfidence":{"state":"review-required","lastCheckedAt":"2026-07-06T03:59:34.660Z","retrievalChannel":"seeded","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":3,"sha256":"320239c1eb5644bef52632ccf2177de89fd5c2d82de78bab34f0b8c193a41ec7","capturedAt":"2026-07-10T01:46:35.687Z"},"current":{"version":4,"sha256":"168f01646ad727bfb22632a07b38d4213b1e7ace135386ba18deefa502a85984","capturedAt":"2026-08-01T04:36:34.322Z"}},"assessment":{"summary":"PayPal collects extensive personal and sensitive data, uses it for AI training and automated decisions, and shares it broadly with third parties.","overallRisk":"High","overallScore":7,"previousPublicChange":{"id":"ff3b694b-c127-40a7-ad9a-147c054b1221","overallRisk":"High","overallScore":7,"screeningDate":"2026-07-10T01:46:35.696Z"},"scoreDelta":0,"direction":"unchanged","reasons":[{"icon":"alert","textEn":"Extensive collection of sensitive and biometric data.","textIt":"Ampia raccolta di dati sensibili e biometrici.","deltaScore":3,"evidenceQuote":"Biometric data: Such as voice identification, photo identification, or face scans, which we may collect when you consent in the user experience","evidenceSide":"new","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"alert","textEn":"Broad sharing with third parties, including data brokers.","textIt":"Ampia condivisione con terze parti, inclusi i data broker.","deltaScore":2,"evidenceQuote":"Third parties, including service providers, Partners and Merchants, payment partners, such as payment networks and processors, credit reporting agencies and public and private credit databases (\"CRAs\"), government entities, data brokers, an","evidenceSide":"new","relatedKpi":"kpiThirdPartySharing","anchorStatus":"verified"},{"icon":"alert","textEn":"Personal data used for AI training and automated decisions.","textIt":"Dati personali usati per l'addestramento AI e decisioni automatizzate.","deltaScore":2,"evidenceQuote":"AI and Automated Decision Making. We may use Personal Information to train our artificial intelligence (AI) models that power our Services and help us deliver more secure, efficient, and personalized services.","evidenceSide":"new","relatedKpi":"kpiAiTrainingOptOut","anchorStatus":"verified"}],"keyPoints":[{"textEn":"Extensive collection of personal, sensitive, and biometric data.","textIt":"Ampia raccolta di dati personali, sensibili e biometrici.","sentiment":"negative"},{"textEn":"Data is used for AI model training and automated decision-making.","textIt":"I dati vengono utilizzati per l'addestramento di modelli AI e decisioni automatizzate.","sentiment":"negative"},{"textEn":"Information is broadly shared with many third parties, including data brokers.","textIt":"Le informazioni sono ampiamente condivise con molte terze parti, inclusi i data broker.","sentiment":"negative"},{"textEn":"Precise geolocation data is collected for personalization and security.","textIt":"I dati di geolocalizzazione precisa vengono raccolti per personalizzazione e sicurezza.","sentiment":"negative"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"High","impactAnalysisEn":"High compliance risk. Broad data sharing and AI use necessitate robust Data Protection Impact Assessments (DPIAs) and clear lawful bases under GDPR. Potential for significant fines under GDPR and future AI Act.","complianceNoteEn":"GDPR, AI Act"},{"region":"EU","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"High risk due to extensive data collection, AI training, and broad third-party sharing, raising concerns under GDPR principles like data minimization and transparency. The upcoming AI Act will further scrutinize automated decision-making processes.","complianceNoteEn":"GDPR, AI Act"},{"region":"Global","perspective":"Enterprise","riskLevel":"High","impactAnalysisEn":"High compliance risk. Managing adherence across diverse global privacy regulations (e.g., LGPD, PIPL, PIPEDA) becomes highly complex with extensive data processing and international transfers. DORA may also apply for financial entities.","complianceNoteEn":"DORA, LGPD, PIPL"},{"region":"Global","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"High risk. Users worldwide face extensive data collection, AI use, and broad sharing, with varying levels of legal protection depending on their jurisdiction. This necessitates proactive management of privacy settings.","complianceNoteEn":null},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Medium compliance risk. Adhering to various state privacy laws (e.g., CCPA, CPRA, VCDPA) is complex due to broad data practices. AI use requires careful consideration of fairness and non-discrimination.","complianceNoteEn":"CCPA, CPRA"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Medium risk. Extensive data collection and sharing are common, but state laws like CCPA/CPRA grant rights to know, delete, and opt-out of sales/sharing. AI use for profiling could be a concern.","complianceNoteEn":"CCPA, CPRA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":1,"mappedFieldCount":4,"evidence":[{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Partial"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":1,"mappedFieldCount":4,"evidence":[{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Opt-Out"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Statement source still match the recorded public snapshot version 4?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/6d94c250-62ab-4f8b-88b6-03573281433f","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"075b69bd99ffe2325ce087d96da7ef3919c62e09f794e620d28786d44d563b5c"}