{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.1.0","mappingVersion":"2026-07-29.1","changeId":"845af367-8a9c-4e81-a516-48fd73b77d0e","screeningDate":"2026-11-10T21:41:57.248Z","publicationGate":"published","company":{"id":"9bffb74f-0f91-46a9-a635-74b5e91623e1","name":"Microsoft","slug":"microsoft","industry":"Tech Giant"},"policy":{"id":"5681de09-ab08-4131-9922-34b96d28db2d","name":"Privacy Statement","type":"privacy","jurisdiction":"Global","sourceUrl":"https://www.microsoft.com/en-us/privacy/privacystatement"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-11-10T21:41:57.230Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":3,"sha256":"9e926972399f575385a7e5ce858a241e040cf216702544060ac870cb4b135c24","capturedAt":"2026-09-23T17:17:22.466Z"},"current":{"version":4,"sha256":"758c8fea9383e7729144e1e5fb83c17ce6de5a1fda22f99a023a8a64a5fd2300","capturedAt":"2026-11-10T21:41:57.230Z"}},"analysisLineage":{"status":"verified","requestSha256":"7187a68b77671054d5edd8ed39f1b96c1c34df3c470223093976ab0bb2206ed1","responseSha256":"9c224c64f89199003f2861d5f57fe74c0e4ea9609053d6b3dd21c3ed93618537","model":"gemini-2.5-flash","promptVersion":"policy-analysis.v3-full-document","schemaVersion":"policy-analysis.schema.v2","inputCoverage":"complete","semanticCoverage":"not_measured","documents":{"old":{"sha256":"9e926972399f575385a7e5ce858a241e040cf216702544060ac870cb4b135c24","charLength":217438,"byteLength":218035,"rangeUnit":"utf16-code-unit","includedRanges":[[0,217438]],"excludedRanges":[]},"new":{"sha256":"758c8fea9383e7729144e1e5fb83c17ce6de5a1fda22f99a023a8a64a5fd2300","charLength":215537,"byteLength":216104,"rangeUnit":"utf16-code-unit","includedRanges":[[0,215537]],"excludedRanges":[]}},"boundary":"Hash verification links retained inputs and the application SDK request. It does not prove provider execution, semantic completeness or legal correctness."},"captureLineage":{"old":{"provenance":"unknown","sourceUrl":null,"requestedUrl":null,"finalUrl":null,"capturedAt":"2026-09-23T17:17:22.466Z","urlDisclosure":"credentials-query-fragment-redacted"},"current":{"provenance":"captured","sourceUrl":"https://www.microsoft.com/en-us/privacy/privacystatement","requestedUrl":"https://www.microsoft.com/en-us/privacy/privacystatement","finalUrl":"https://www.microsoft.com/en-us/privacy/privacystatement","capturedAt":"2026-11-10T21:41:57.230Z","urlDisclosure":"credentials-query-fragment-redacted"}},"assessment":{"summary":"Microsoft's updated policy expands data collection from third-party workplace sources, slightly increasing privacy risk despite clearer controls for linked mobile data.","overallRisk":"High","overallScore":7,"previousPublicChange":{"id":"322d5b66-a58e-485c-a367-487528a80f44","overallRisk":"Medium","overallScore":4,"screeningDate":"2026-09-23T17:17:22.476Z"},"scoreDelta":3,"direction":"higher","reasons":[{"icon":"warning","textEn":"New third-party data source for workplace and productivity data.","textIt":"Nuova fonte di dati di terze parti per dati di lavoro e produttività.","deltaScore":2,"evidenceQuote":"Companies that provide workplace and productivity data for research, development, and improvement of our products and services.","evidenceSide":"new","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"warning","textEn":"Expanded device data collection details, including device age.","textIt":"Dettagli ampliati sulla raccolta dati del dispositivo, inclusa l'età del dispositivo.","deltaScore":1,"evidenceQuote":"Device, connectivity, and configuration data. For example, IP addresses, age of the device, device identifiers and type, device language and locale settings, nearby networks, and other information about the operating systems and other softw","evidenceSide":"new","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"info","textEn":"Clarification on continued use of basic data for offers after opt-out.","textIt":"Chiarimento sull'uso continuo dei dati base per offerte anche dopo l'opt-out.","deltaScore":0.5,"evidenceQuote":"If you choose to turn off Personalized offers or stop the use of data from other Microsoft products, we may use basic account data and contextual info about your device to avoid showing you generic tips, ads, and recommendations that are no","evidenceSide":"new","relatedKpi":"kpiConsentMechanism","anchorStatus":"verified"}],"keyPoints":[{"textEn":"New third-party data source for workplace and productivity data is now explicitly mentioned.","textIt":"Nuova fonte di dati di terze parti per dati di lavoro e produttività esplicitamente menzionata.","sentiment":"negative"},{"textEn":"Device data collection details are expanded to include device age and language settings.","textIt":"Dettagli sulla raccolta dati del dispositivo ampliati per includere età e impostazioni lingua.","sentiment":"neutral"},{"textEn":"Clarification on how basic data is used for personalized offers even after opting out.","textIt":"Chiarimento su come i dati base sono usati per offerte personalizzate anche dopo l'opt-out.","sentiment":"negative"},{"textEn":"Explicit statement that linked mobile content is not stored on Microsoft servers.","textIt":"Dichiarazione esplicita che i contenuti mobili collegati non sono archiviati sui server Microsoft.","sentiment":"positive"},{"textEn":"Age-appropriate experiences can now use device-based info even without user login.","textIt":"Le esperienze adatte all'età possono ora usare informazioni basate sul dispositivo anche senza login.","sentiment":"positive"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises using Microsoft products should review the new third-party data sharing clauses, especially for workplace and productivity data, to ensure compliance with GDPR and the upcoming AI Act. Data processing agreements may need updates.","complianceNoteEn":"GDPR Art. 28, AI Act"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The expanded collection of workplace data and clarification on personalized offers could raise concerns under GDPR, particularly regarding transparency and purpose limitation. However, explicit non-storage of linked mobile content is a positive step for user control.","complianceNoteEn":"GDPR Art. 5, 6, 13"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises must ensure their internal policies and data processing agreements reflect Microsoft's expanded data collection and sharing practices. This is vital for maintaining compliance across diverse international regulations.","complianceNoteEn":null},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Users globally face increased data collection scope with new third-party workplace data. While some controls are clarified, the overall trend points to more data processing, requiring users to actively manage their privacy settings.","complianceNoteEn":null},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses should assess how the new third-party data sources for workplace data align with their internal privacy policies and US state data privacy laws. Transparency with employees regarding data practices is crucial.","complianceNoteEn":"CCPA/CPRA, State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The policy's detailed device data collection and continued use for offers after opt-out may be scrutinized under US state privacy laws like CCPA/CPRA. Users have clearer controls for linked mobile data, which is beneficial.","complianceNoteEn":"CCPA/CPRA, VCDPA, CPA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"},{"field":"kpiContentModeration","label":"Content moderation","value":"Partial"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Explicit Opt-In"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Statement source still match the recorded public snapshot version 4?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/845af367-8a9c-4e81-a516-48fd73b77d0e","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"839c72af66cf424a98033b11be18e68fff5691c44c25adfa58d6545f2bece032"}