{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"7d60dfa9-f444-46e9-972a-e1679643fa6e","screeningDate":"2026-07-07T02:39:05.499Z","publicationGate":"published","company":{"id":"6f69e944-8b6c-4dce-8693-58804624471b","name":"Meta","slug":"meta","industry":"Tech Giant"},"policy":{"id":"466d072b-d894-49fe-aa33-8d607a298f67","name":"Privacy Policy","type":"privacy","jurisdiction":"EU","sourceUrl":"https://www.facebook.com/privacy/policy/"},"sourceConfidence":{"state":"review-required","lastCheckedAt":"2026-07-06T03:59:34.660Z","retrievalChannel":"seeded","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":3,"sha256":"9c785dc13c6976d29569fd221c435e1277e0fbe12fad803f4b1b69392652504b","capturedAt":"2026-07-06T22:26:18.081Z"},"current":{"version":4,"sha256":"52164a545dbe7a8d2468fdc70157cf96f334218f3157404e271267a6f71d9f8c","capturedAt":"2026-07-07T02:39:05.496Z"}},"assessment":{"summary":"Meta's new policy broadens AI data use and sharing with third parties, increasing privacy risks despite improved legal transparency for EU users.","overallRisk":"High","overallScore":8,"previousPublicChange":{"id":"161eb7f2-6bd6-4742-a173-ff9df57ac47f","overallRisk":"High","overallScore":8,"screeningDate":"2026-07-06T22:26:18.086Z"},"scoreDelta":0,"direction":"unchanged","reasons":[{"icon":"alert","textEn":"Expanded AI data use for personalization and third-party sharing.","textIt":"Uso esteso dei dati IA per personalizzazione e condivisione con terzi.","deltaScore":2,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"},{"icon":"warning","textEn":"Broad data sharing with authorities, now with specific legal citations.","textIt":"Ampia condivisione dati con autorità, ora con citazioni legali specifiche.","deltaScore":1,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"},{"icon":"alert","textEn":"Lack of clear user opt-out for general AI training data.","textIt":"Mancanza di opt-out chiaro per i dati di addestramento IA generale.","deltaScore":1,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"Expanded use of your content and interactions for AI development and personalization across Meta products.","textIt":"Uso esteso dei tuoi contenuti e interazioni per lo sviluppo e la personalizzazione dell'IA nei prodotti Meta.","sentiment":"negative"},{"textEn":"Meta explicitly states it may offer its AI technology to third parties, including developers and researchers.","textIt":"Meta dichiara esplicitamente che potrebbe offrire la sua tecnologia IA a terzi, inclusi sviluppatori e ricercatori.","sentiment":"negative"},{"textEn":"New detailed legal bases for data sharing with authorities, particularly for EU users, citing specific regulations.","textIt":"Nuove basi legali dettagliate per la condivisione dei dati con le autorità, in particolare per gli utenti UE, citando regolamenti specifici.","sentiment":"neutral"},{"textEn":"Increased focus on safeguards and specific interests for users under the age of majority.","textIt":"Maggiore attenzione alle salvaguardie e agli interessi specifici per gli utenti minorenni.","sentiment":"positive"},{"textEn":"No clear opt-out mechanism for your data being used to train Meta's AI models.","textIt":"Nessun chiaro meccanismo di opt-out per l'utilizzo dei tuoi dati per addestrare i modelli IA di Meta.","sentiment":"negative"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises using Meta's platforms face increased scrutiny regarding data processing for AI and third-party sharing. Compliance with GDPR, DORA, and the Data Act is crucial, especially with explicit legal citations.","complianceNoteEn":"GDPR, DORA, Data Act"},{"region":"EU","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"The expanded use of data for AI, without clear opt-outs, raises significant concerns under GDPR and the upcoming AI Act. While legal bases are more transparent, the breadth of data sharing remains high.","complianceNoteEn":"GDPR Art. 6, AI Act"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises using Meta's services must assess the implications of broad AI data processing and third-party sharing across diverse regulatory landscapes. Robust data governance and contractual agreements are critical.","complianceNoteEn":"International Data Transfer"},{"region":"Global","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"Globally, individuals face increased privacy risks from Meta's expanded AI data use and sharing. The lack of universal opt-out for AI training means users must rely on regional protections or platform settings.","complianceNoteEn":"Global Privacy Standards"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses leveraging Meta's platforms must navigate broad data use for AI and third-party insights. Ensuring internal compliance with US state privacy laws and contractual obligations is essential.","complianceNoteEn":"State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"Users face high risk due to extensive data collection for AI and broad sharing, with less specific legal protections compared to the EU. State laws like CCPA/CPRA offer some rights, but AI use is a growing concern.","complianceNoteEn":"CCPA/CPRA, State Privacy Laws"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"},{"field":"kpiContentModeration","label":"Content moderation","value":"Partial"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Implicit"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Policy source still match the recorded public snapshot version 4?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/7d60dfa9-f444-46e9-972a-e1679643fa6e","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"f6d56f106b6c4915a63ac3266b86c4a25ea545b6d03014b4a4da551fd4430c38"}