{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"79e18fd1-c585-4cbd-a32c-e456bfd142f5","screeningDate":"2026-10-09T02:45:24.435Z","publicationGate":"published","company":{"id":"2c5bac29-0643-4196-be90-4b5b2767b6ed","name":"OpenAI","slug":"openai","industry":"AI Provider"},"policy":{"id":"9e7ca672-d487-4edc-92b9-8567f4c1adcf","name":"Privacy Policy","type":"privacy","jurisdiction":"EU","sourceUrl":"https://openai.com/policies/eu-privacy-policy"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-10-09T02:45:24.430Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":2,"sha256":"2f2f693d8e75320f5079f1160cb3ed5343f2f9bec082c4afea1762928ea09e32","capturedAt":"2026-09-24T16:32:08.367Z"},"current":{"version":3,"sha256":"da5ee101be311da6c45cb1dd8817e00f678677d5e71166c24059a19ec4336ff1","capturedAt":"2026-10-09T02:45:24.432Z"}},"assessment":{"summary":"This OpenAI Privacy Policy update shows no changes, maintaining extensive data collection, broad sharing, and conditional data retention practices.","overallRisk":"High","overallScore":7,"previousPublicChange":{"id":"b6f77d48-bc9c-4085-bf97-702fd935ce2e","overallRisk":"High","overallScore":7,"screeningDate":"2026-09-24T16:32:08.374Z"},"scoreDelta":0,"direction":"unchanged","reasons":[{"icon":"alert","textEn":"Extensive collection of user content, usage, device, and third-party data.","textIt":"Ampia raccolta di contenuti utente, utilizzo, dati del dispositivo e di terze parti.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiDataCollection","anchorStatus":"not-recorded"},{"icon":"warning","textEn":"Broad data sharing with numerous third parties, affiliates, and for business transfers.","textIt":"Ampia condivisione dei dati con numerosi terzi, affiliati e per trasferimenti aziendali.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiThirdPartySharing","anchorStatus":"not-recorded"},{"icon":"warning","textEn":"Vague retention clauses allow extended data storage for 'legitimate' reasons.","textIt":"Clausole di conservazione vaghe consentono l'archiviazione estesa dei dati per 'motivi legittimi'.","deltaScore":0,"evidenceQuote":"In some cases, we need to retain Personal Data for longer even after you delete it, for example because we are legally required to, to address fraud and abuse, for security reasons, or for financial record-keeping purposes.","evidenceSide":"old","relatedKpi":"kpiDataRetention","anchorStatus":"verified"}],"keyPoints":[{"textEn":"OpenAI collects a wide range of personal data, including user content, usage patterns, device info, and location data.","textIt":"OpenAI raccoglie un'ampia gamma di dati personali, inclusi contenuti utente, modelli di utilizzo, informazioni sul dispositivo e dati di localizzazione.","sentiment":"negative"},{"textEn":"Data is shared broadly with third-party vendors, affiliates, and government authorities, impacting user privacy.","textIt":"I dati sono ampiamente condivisi con fornitori terzi, affiliati e autorità governative, influenzando la privacy dell'utente.","sentiment":"negative"},{"textEn":"Users can opt out of content being used for model training and delete chat history, offering some control.","textIt":"Gli utenti possono disattivare l'uso dei contenuti per l'addestramento del modello e cancellare la cronologia delle chat, offrendo un certo controllo.","sentiment":"positive"},{"textEn":"Data retention periods are flexible, allowing longer storage for legal, security, or fraud prevention reasons.","textIt":"I periodi di conservazione dei dati sono flessibili, consentendo un'archiviazione più lunga per motivi legali, di sicurezza o di prevenzione delle frodi.","sentiment":"negative"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises using OpenAI's services must ensure their data processing aligns with GDPR, especially regarding broad data sharing and retention. The policy's lack of cross-border transfer details requires careful due diligence.","complianceNoteEn":"GDPR Art. 28, 44"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The policy's broad data collection and retention clauses pose a medium risk for EU individuals, despite explicit GDPR-like rights. Extended retention for 'legitimate reasons' could conflict with data minimization principles.","complianceNoteEn":"GDPR Art. 5, 17"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises must navigate diverse regulatory landscapes when using OpenAI, ensuring their use cases comply with local data protection laws. The policy's general nature necessitates careful contractual review.","complianceNoteEn":null},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Globally, individuals face medium privacy risks due to the policy's extensive data collection and sharing, which may not align with all local privacy expectations. Opt-out mechanisms offer some mitigation.","complianceNoteEn":null},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"US enterprises must assess how OpenAI's data practices align with various state privacy laws and industry-specific regulations. Broad data sharing and retention require robust internal compliance frameworks.","complianceNoteEn":null},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"US individuals face medium risk due to extensive data collection and sharing, though opt-out options provide some control. State-specific privacy laws like CCPA/CPRA grant rights, but policy clarity on these is general.","complianceNoteEn":"CCPA/CPRA Rights"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiContentModeration","label":"Content moderation","value":"Opaque"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Policy source still match the recorded public snapshot version 3?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/79e18fd1-c585-4cbd-a32c-e456bfd142f5","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"9fe8b3540d895fb77248cecb9faf8a58c5c22e688fd8661e68166902f42a3640"}