{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.1.0","mappingVersion":"2026-07-29.1","changeId":"742c9bd7-04e7-474b-8484-d2f4e670177c","screeningDate":"2026-10-22T11:42:38.652Z","publicationGate":"published","company":{"id":"83da1ad9-8891-4372-a9db-bdf82c894d2a","name":"Anthropic","slug":"anthropic","industry":"Tech Giant"},"policy":{"id":"1cc677eb-3207-4569-880a-aaba223b4803","name":"Privacy Policy","type":"privacy","jurisdiction":"Global","sourceUrl":"https://www.anthropic.com/legal/privacy"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-10-22T11:42:38.645Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":1,"sha256":"d5e44bd43ea79a3753bdd99f4a2a105c825b8de55149646c9c3cc007ed11d2ac","capturedAt":"2026-10-02T04:55:25.205Z"},"current":{"version":2,"sha256":"fa3c2c9786ca92b832bdbfd3e9ab8d50a8b7a3a9daf8c4333827483a479a24b3","capturedAt":"2026-10-22T11:42:38.645Z"}},"analysisLineage":{"status":"verified","requestSha256":"c071e67fe4c9794ee7d59e61aeb9966acf760159050a06d389e42c3c49f74372","responseSha256":"1a31de1cb0ba07fb2b27933896816b3e3e8886e9b1add573fec0af8d2414c2fb","model":"gemini-2.5-flash","promptVersion":"policy-analysis.v3-full-document","schemaVersion":"policy-analysis.schema.v2","inputCoverage":"complete","semanticCoverage":"not_measured","documents":{"old":{"sha256":"d5e44bd43ea79a3753bdd99f4a2a105c825b8de55149646c9c3cc007ed11d2ac","charLength":41632,"byteLength":41728,"rangeUnit":"utf16-code-unit","includedRanges":[[0,41632]],"excludedRanges":[]},"new":{"sha256":"fa3c2c9786ca92b832bdbfd3e9ab8d50a8b7a3a9daf8c4333827483a479a24b3","charLength":39178,"byteLength":39274,"rangeUnit":"utf16-code-unit","includedRanges":[[0,39178]],"excludedRanges":[]}},"boundary":"Hash verification links retained inputs and the application SDK request. It does not prove provider execution, semantic completeness or legal correctness."},"captureLineage":{"old":{"provenance":"unknown","sourceUrl":null,"requestedUrl":null,"finalUrl":null,"capturedAt":"2026-10-02T04:55:25.205Z","urlDisclosure":"credentials-query-fragment-redacted"},"current":{"provenance":"captured","sourceUrl":"https://www.anthropic.com/legal/privacy","requestedUrl":"https://www.anthropic.com/legal/privacy","finalUrl":"https://www.anthropic.com/legal/privacy","capturedAt":"2026-10-22T11:42:38.645Z","urlDisclosure":"credentials-query-fragment-redacted"}},"assessment":{"summary":"The Anthropic Privacy Policy has no material changes; data collection, usage, and user rights remain consistent with the previous version.","overallRisk":"Medium","overallScore":6,"previousPublicChange":null,"scoreDelta":null,"direction":"baseline","reasons":[{"icon":"info","textEn":"No material changes found in the policy content.","textIt":"Nessuna modifica sostanziale trovata nel contenuto della policy.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"},{"icon":"info","textEn":"Data collection and processing practices remain consistent.","textIt":"Le pratiche di raccolta ed elaborazione dei dati rimangono coerenti.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"},{"icon":"info","textEn":"User rights and opt-out mechanisms are unchanged.","textIt":"I diritti degli utenti e i meccanismi di opt-out sono invariati.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"No material changes were identified in the updated Privacy Policy content.","textIt":"Nessuna modifica sostanziale è stata identificata nel contenuto aggiornato della Privacy Policy.","sentiment":"neutral"},{"textEn":"Data collection practices, including for AI model training, remain consistent.","textIt":"Le pratiche di raccolta dati, anche per l'addestramento dei modelli AI, rimangono invariate.","sentiment":"neutral"},{"textEn":"User rights and choices, including opt-out options, are unchanged.","textIt":"I diritti e le scelte degli utenti, incluse le opzioni di opt-out, sono invariati.","sentiment":"neutral"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises using Anthropic's services should continue to ensure their data processing agreements align with GDPR requirements, especially concerning international data transfers and third-party sharing.","complianceNoteEn":"GDPR Art. 28, 44"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"No new impacts for EU individuals. The policy continues to outline GDPR-compliant rights, but data transfers outside the EEA/UK still rely on SCCs and adequacy decisions, which require careful oversight.","complianceNoteEn":"GDPR Art. 45, 46"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises must continue to conduct due diligence on Anthropic's data practices, especially concerning cross-border data transfers and the implications for various international regulations.","complianceNoteEn":"International Data Transfer"},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The policy's global impact remains unchanged, with regional disclosures for Canada, Brazil, and South Korea. Users worldwide should note the extensive data collection and broad third-party sharing practices.","complianceNoteEn":"Global Privacy Norms"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"US enterprises should continue to verify that their use of Anthropic's services aligns with state-specific privacy laws, particularly regarding data sharing and consumer rights.","complianceNoteEn":"State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"No new impacts for US individuals. The policy continues to address 'sale' of personal data as defined by US state laws like CCPA, offering opt-out for targeted advertising.","complianceNoteEn":"CCPA/CPRA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiContentModeration","label":"Content moderation","value":"Opaque"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Policy source still match the recorded public snapshot version 2?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/742c9bd7-04e7-474b-8484-d2f4e670177c","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"d494e323f20b738464658ee0ee5113d56c6b0149ee213c528bfa9afe47d5fde2"}