{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.1.0","mappingVersion":"2026-07-29.1","changeId":"7a3b60a4-df29-4282-b5be-3b10f88223e4","screeningDate":"2026-10-18T07:42:28.688Z","publicationGate":"published","company":{"id":"3e20dca5-ce3f-4e7e-930c-7aa4753a789d","name":"Google","slug":"google","industry":"Tech Giant"},"policy":{"id":"c287880a-4512-4dc0-a8bd-cdf7d4f33e15","name":"Privacy Policy","type":"privacy","jurisdiction":"Global","sourceUrl":"https://policies.google.com/privacy"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-10-22T11:38:40.884Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":4,"sha256":"db08325ace1e8979a4ff707d93b4f53a581848d15b0ddb5ce57d5f26c4150293","capturedAt":"2026-10-14T03:41:18.314Z"},"current":{"version":5,"sha256":"563fbdb6e85d5f4ae9a7cb859f6144daf2d9baecc0f1b5a4b40138ea210da578","capturedAt":"2026-10-18T07:42:28.674Z"}},"analysisLineage":{"status":"verified","requestSha256":"d035f7ee9437f59952ee5f3f9e3a6ffd3cd97748aa14a05fd0d4ebecd543d54b","responseSha256":"1fa7aa932598fe44b39459890abd285846a86232d9cd53e4a95238c15915521d","model":"gemini-2.5-flash","promptVersion":"policy-analysis.v3-full-document","schemaVersion":"policy-analysis.schema.v2","inputCoverage":"complete","semanticCoverage":"not_measured","documents":{"old":{"sha256":"db08325ace1e8979a4ff707d93b4f53a581848d15b0ddb5ce57d5f26c4150293","charLength":103491,"byteLength":103883,"rangeUnit":"utf16-code-unit","includedRanges":[[0,103491]],"excludedRanges":[]},"new":{"sha256":"563fbdb6e85d5f4ae9a7cb859f6144daf2d9baecc0f1b5a4b40138ea210da578","charLength":104542,"byteLength":104934,"rangeUnit":"utf16-code-unit","includedRanges":[[0,104542]],"excludedRanges":[]}},"boundary":"Hash verification links retained inputs and the application SDK request. It does not prove provider execution, semantic completeness or legal correctness."},"captureLineage":{"old":{"provenance":"unknown","sourceUrl":null,"requestedUrl":null,"finalUrl":null,"capturedAt":"2026-10-14T03:41:18.314Z","urlDisclosure":"credentials-query-fragment-redacted"},"current":{"provenance":"captured","sourceUrl":"https://policies.google.com/privacy","requestedUrl":"https://policies.google.com/privacy","finalUrl":"https://policies.google.com/privacy","capturedAt":"2026-10-18T07:42:28.674Z","urlDisclosure":"credentials-query-fragment-redacted"}},"assessment":{"summary":"Google's updated policy allows more data sharing between its services for personalization and ads, requiring user consent for this expanded data linking.","overallRisk":"High","overallScore":10,"previousPublicChange":{"id":"25330a35-6bce-4de2-8716-1796e250e928","overallRisk":"Medium","overallScore":5,"screeningDate":"2026-10-14T03:41:18.321Z"},"scoreDelta":5,"direction":"higher","reasons":[{"icon":"alert","textEn":"New clause allows cross-service data access for personalization.","textIt":"Nuova clausola consente l'accesso ai dati tra servizi per la personalizzazione.","deltaScore":2,"evidenceQuote":"You may choose to allow certain Google services, including services like Search or Gemini Apps, to access data from other Google services you use, such as Google Photos and Workspace apps like Gmail and Drive, in order to provide you with a","evidenceSide":"new","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"alert","textEn":"Previous ad privacy safeguard from Drive/Gmail/Photos is now conditional.","textIt":"La precedente protezione pubblicitaria da Drive/Gmail/Foto è ora condizionale.","deltaScore":2,"evidenceQuote":"We don’t show you personalized ads based on your content from Drive, Gmail, or Google Photos, unless you choose to make data from these services available to other Google services that support personalized ads.","evidenceSide":"new","relatedKpi":"kpiThirdPartySharing","anchorStatus":"verified"},{"icon":"warning","textEn":"Increased data integration for AI features like 'Personal Intelligence'.","textIt":"Maggiore integrazione dei dati per funzionalità AI come 'Personal Intelligence'.","deltaScore":1,"evidenceQuote":"If you choose to allow certain services to process data from other services, including for features such as Personal Intelligence, the same data may be used to personalize your experience.","evidenceSide":"new","relatedKpi":"kpiAiTrainingOptOut","anchorStatus":"verified"}],"keyPoints":[{"textEn":"Google services can now link data from Photos, Gmail, and Drive for personalized experiences, if you opt-in.","textIt":"I servizi Google possono ora collegare dati da Foto, Gmail e Drive per esperienze personalizzate, se l'utente acconsente.","sentiment":"negative"},{"textEn":"Previous protection against personalized ads from Drive/Gmail/Photos is now conditional on user choice.","textIt":"La precedente protezione dagli annunci personalizzati da Drive/Gmail/Foto è ora condizionata dalla scelta dell'utente.","sentiment":"negative"},{"textEn":"New 'Personal Intelligence' features will leverage cross-service data for enhanced personalization.","textIt":"Le nuove funzionalità di 'Personal Intelligence' utilizzeranno dati tra servizi per una personalizzazione avanzata.","sentiment":"negative"},{"textEn":"Users must actively manage settings to control this expanded data sharing and personalization.","textIt":"Gli utenti devono gestire attivamente le impostazioni per controllare questa condivisione e personalizzazione dei dati.","sentiment":"neutral"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises using Google Workspace must ensure their internal policies and user agreements align with Google's expanded data usage. They need to understand how user data might be linked across Google services and its implications for GDPR compliance.","complianceNoteEn":"GDPR Article 28"},{"region":"EU","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"The expanded data linking, even with consent, raises GDPR concerns regarding the scope of processing and potential for extensive profiling. Users must actively manage settings to maintain privacy under GDPR and the Digital Markets Act (DMA).","complianceNoteEn":"GDPR Articles 5, 6, 7, DMA"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises using Google services must adapt their data governance frameworks to account for Google's expanded data linking capabilities. This requires careful review of data processing agreements and ensuring user consent mechanisms are globally compliant.","complianceNoteEn":"Cross-border data transfer"},{"region":"Global","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"The increased data integration across Google's services, even with opt-in controls, generally heightens privacy risks for individuals worldwide. Users must be proactive in managing their settings to limit extensive data profiling and personalized experiences.","complianceNoteEn":"Global Privacy Principles"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses relying on Google's ad and analytics services need to understand the implications of cross-service data linking for their own compliance. They must ensure their data practices and user consents are robust, especially concerning targeted advertising under state privacy laws.","complianceNoteEn":"CCPA/CPRA"},{"region":"US","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"The policy's expanded data linking for personalization and ads, while consent-based, increases the volume of personal data processed. This requires users to be vigilant with their privacy settings under CCPA/CPRA, which grant rights to opt-out of sharing and targeted advertising.","complianceNoteEn":"CCPA/CPRA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiContentModeration","label":"Content moderation","value":"Transparent"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Explicit Opt-In"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Policy source still match the recorded public snapshot version 5?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/7a3b60a4-df29-4282-b5be-3b10f88223e4","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"2d30a0da008c490d2e7f01d127c7ab9f070585dac2bf15dfbde4311e034ff66a"}