{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.1.0","mappingVersion":"2026-07-29.1","changeId":"7f57cc5f-f61d-456d-81e8-3f0c281620ca","screeningDate":"2026-11-05T18:39:05.904Z","publicationGate":"published","company":{"id":"c0caa75b-cc98-45c5-9b6b-198af2014025","name":"PayPal","slug":"paypal","industry":"FinTech"},"policy":{"id":"ffcb0efc-2a6f-473d-8296-e939fccb4aef","name":"Acceptable Use Policy","type":"aup","jurisdiction":"US","sourceUrl":"https://www.paypal.com/us/legalhub/paypal/acceptableuse-full"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-11-05T18:39:05.897Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":1,"sha256":"3c6806655dbf162cea60b322eccf95a040bfbc535ae6264861e38bca422e78cc","capturedAt":"2026-10-02T04:56:59.003Z"},"current":{"version":2,"sha256":"d8787e9d7a60f2f2688e499303f862f0cd5f0aa4135c18d439b270c00e9de594","capturedAt":"2026-11-05T18:39:05.897Z"}},"analysisLineage":{"status":"verified","requestSha256":"6319bd5d69c189aeaecb350ef7f8a4af75fc6f54910299f10fc80f1b891177c3","responseSha256":"2962f46067d9bbcf046f332ea817cc7c9d0c05453e265f1f34b999b7116135d3","model":"gemini-2.5-flash","promptVersion":"policy-analysis.v3-full-document","schemaVersion":"policy-analysis.schema.v2","inputCoverage":"complete","semanticCoverage":"not_measured","documents":{"old":{"sha256":"3c6806655dbf162cea60b322eccf95a040bfbc535ae6264861e38bca422e78cc","charLength":7985,"byteLength":7985,"rangeUnit":"utf16-code-unit","includedRanges":[[0,7985]],"excludedRanges":[]},"new":{"sha256":"d8787e9d7a60f2f2688e499303f862f0cd5f0aa4135c18d439b270c00e9de594","charLength":8135,"byteLength":8135,"rangeUnit":"utf16-code-unit","includedRanges":[[0,8135]],"excludedRanges":[]}},"boundary":"Hash verification links retained inputs and the application SDK request. It does not prove provider execution, semantic completeness or legal correctness."},"captureLineage":{"old":{"provenance":"unknown","sourceUrl":null,"requestedUrl":null,"finalUrl":null,"capturedAt":"2026-10-02T04:56:59.003Z","urlDisclosure":"credentials-query-fragment-redacted"},"current":{"provenance":"captured","sourceUrl":"https://www.paypal.com/us/legalhub/paypal/acceptableuse-full","requestedUrl":"https://www.paypal.com/us/legalhub/paypal/acceptableuse-full","finalUrl":"https://www.paypal.com/us/legalhub/paypal/acceptableuse-full","capturedAt":"2026-11-05T18:39:05.897Z","urlDisclosure":"credentials-query-fragment-redacted"}},"assessment":{"summary":"PayPal's updated policy significantly broadens its ban on discriminatory activities, now explicitly prohibiting engagement in or celebration of hate.","overallRisk":"High","overallScore":7,"previousPublicChange":null,"scoreDelta":null,"direction":"baseline","reasons":[{"icon":"alert","textEn":"New clause broadens prohibited discriminatory activities.","textIt":"Nuova clausola amplia le attività discriminatorie proibite.","deltaScore":1,"evidenceQuote":"(f) the engagement in, or the encouragement, promotion, or celebration of, violence or discriminatory activity based on race, religion, disability, gender, sexual orientation, national origin, or any characteristic protected under applicabl","evidenceSide":"new","relatedKpi":"kpiContentModeration","anchorStatus":"verified"},{"icon":"warning","textEn":"Expanded scope of actions now prohibited (engagement, celebration).","textIt":"Ambito ampliato delle azioni ora proibite (coinvolgimento, celebrazione).","deltaScore":1,"evidenceQuote":"(f) the engagement in, or the encouragement, promotion, or celebration of, violence or discriminatory activity based on race, religion, disability, gender, sexual orientation, national origin, or any characteristic protected under applicabl","evidenceSide":"new","relatedKpi":"kpiContentModeration","anchorStatus":"verified"},{"icon":"info","textEn":"Extensive list of activities requiring pre-approval for businesses.","textIt":"Ampio elenco di attività che richiedono pre-approvazione per le aziende.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiRegulatoryCompliance","anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"Expanded definition of prohibited discriminatory activities, including specific protected characteristics.","textIt":"Definizione ampliata delle attività discriminatorie proibite, incluse specifiche caratteristiche protette.","sentiment":"negative"},{"textEn":"New policy explicitly bans 'engagement in' and 'celebration of' violence or discrimination.","textIt":"La nuova politica vieta esplicitamente 'l'impegno in' e la 'celebrazione di' violenza o discriminazione.","sentiment":"negative"},{"textEn":"The policy reinforces PayPal's commitment to combating hate speech and illegal activities.","textIt":"La politica rafforza l'impegno di PayPal nella lotta contro l'incitamento all'odio e le attività illegali.","sentiment":"positive"},{"textEn":"Many business types still require pre-approval, maintaining a high barrier to entry for certain services.","textIt":"Molti tipi di attività richiedono ancora la pre-approvazione, mantenendo un'alta barriera per alcuni servizi.","sentiment":"neutral"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"EU businesses must ensure their operations and user-generated content strictly comply with the expanded anti-discrimination rules. Non-compliance could lead to account suspension and reputational damage, impacting DORA compliance for financial entities.","complianceNoteEn":"GDPR, DORA, AI Act"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Individuals in the EU face broader restrictions on content and activities deemed discriminatory. This aligns with GDPR principles on sensitive data and the upcoming AI Act's focus on non-discrimination.","complianceNoteEn":"GDPR Art. 9, AI Act"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises using PayPal need to implement robust content moderation and compliance frameworks to adhere to the stricter anti-discrimination policy. This ensures consistent application across diverse markets and reduces global regulatory risks.","complianceNoteEn":null},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Globally, individuals using PayPal must be aware of the expanded restrictions on discriminatory content and actions. This policy aims for a consistent standard across all jurisdictions, potentially limiting certain forms of expression.","complianceNoteEn":null},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"US businesses, especially those relying on user-generated content, face a higher compliance burden to monitor and enforce these broader anti-discrimination rules. This could impact content moderation strategies and legal risk assessments.","complianceNoteEn":"State Consumer Protection Laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"US individuals will experience increased scrutiny over content that could be interpreted as discriminatory or promoting violence. This reflects a growing trend in platform policies to address hate speech, aligning with state-level privacy laws like CCPA.","complianceNoteEn":"CCPA, State Anti-Discrimination Laws"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"not-assessed","assessedCount":0,"mappedFieldCount":4,"evidence":[]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":1,"mappedFieldCount":4,"evidence":[{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":1,"mappedFieldCount":4,"evidence":[{"field":"kpiContentModeration","label":"Content moderation","value":"Opaque"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"not-assessed","assessedCount":0,"mappedFieldCount":4,"evidence":[]}]},"humanReviewQuestions":["Does the original Acceptable Use Policy source still match the recorded public snapshot version 2?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/7f57cc5f-f61d-456d-81e8-3f0c281620ca","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"fdb17b7d39f7193049dadb364649b364d9968c87eaa66a77fc002ee1e40bad2c"}