{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.1.0","mappingVersion":"2026-07-29.1","changeId":"86ef6b02-beb3-4e84-9f41-8a5a94004114","screeningDate":"2026-10-30T15:41:06.766Z","publicationGate":"published","company":{"id":"4ba804aa-b4e8-41f5-8c47-44feb4750b65","name":"Coca Cola","slug":"coca-cola","industry":"Consumer Goods"},"policy":{"id":"528f0dda-97b3-4b86-a62b-b44dcb2aface","name":"Cookie Notice","type":"privacy","jurisdiction":"Global","sourceUrl":"https://datatrust.coca-cola.com/us/en/notices/cookie-notice"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-10-30T15:41:06.758Z","retrievalChannel":"renderer","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":1,"sha256":"1af5538362ab1d32f6c28fa909aa7f775ea3c90320c005870ce54d408e0cd4f6","capturedAt":"2026-10-09T02:39:21.883Z"},"current":{"version":2,"sha256":"1e9495314531aa366e43311d8bc4a914334c99f257c3f2c98eeeb3988fbc18b3","capturedAt":"2026-10-30T15:41:06.758Z"}},"analysisLineage":{"status":"verified","requestSha256":"1f566754b2b016f55aab259e04942169e7772423ba9938bf2c0ae60728b242a7","responseSha256":"0444b87884b8fe7a82cbe50c69bb217fd527bc6acb0adb2bae7a17dde6ef314f","model":"gemini-2.5-flash","promptVersion":"policy-analysis.v3-full-document","schemaVersion":"policy-analysis.schema.v2","inputCoverage":"complete","semanticCoverage":"not_measured","documents":{"old":{"sha256":"1af5538362ab1d32f6c28fa909aa7f775ea3c90320c005870ce54d408e0cd4f6","charLength":6395,"byteLength":6399,"rangeUnit":"utf16-code-unit","includedRanges":[[0,6395]],"excludedRanges":[]},"new":{"sha256":"1e9495314531aa366e43311d8bc4a914334c99f257c3f2c98eeeb3988fbc18b3","charLength":6394,"byteLength":6398,"rangeUnit":"utf16-code-unit","includedRanges":[[0,6394]],"excludedRanges":[]}},"boundary":"Hash verification links retained inputs and the application SDK request. It does not prove provider execution, semantic completeness or legal correctness."},"captureLineage":{"old":{"provenance":"unknown","sourceUrl":null,"requestedUrl":null,"finalUrl":null,"capturedAt":"2026-10-09T02:39:21.883Z","urlDisclosure":"credentials-query-fragment-redacted"},"current":{"provenance":"captured","sourceUrl":"https://datatrust.coca-cola.com/us/en/notices/cookie-notice","requestedUrl":"https://datatrust.coca-cola.com/us/en/notices/cookie-notice","finalUrl":"https://datatrust.coca-cola.com/us/en/notices/cookie-notice","capturedAt":"2026-10-30T15:41:06.758Z","urlDisclosure":"credentials-query-fragment-redacted"}},"assessment":{"summary":"This Cookie Notice has not changed; it outlines extensive use of cookies for tracking, advertising, and sharing data with third parties.","overallRisk":"Medium","overallScore":6,"previousPublicChange":null,"scoreDelta":null,"direction":"baseline","reasons":[{"icon":"alert","textEn":"Extensive third-party cookie usage for advertising and analytics.","textIt":"Ampio utilizzo di cookie di terze parti per pubblicità e analisi.","deltaScore":-2,"evidenceQuote":"Third-party cookies come from other parties for analytics and marketing automation and can recognize your device across different websites.","evidenceSide":"new","relatedKpi":"kpiThirdPartySharing","anchorStatus":"verified"},{"icon":"alert","textEn":"Broad data sharing with third parties for their own product improvement.","textIt":"Ampia condivisione di dati con terze parti per il miglioramento dei loro prodotti.","deltaScore":-2,"evidenceQuote":"Third parties use Cookies to track visitors and collect consumer information (including personal information) on our behalf and share it with us and/or for their own purposes, for example to improve their own products and services or to col","evidenceSide":"new","relatedKpi":"kpiThirdPartySharing","anchorStatus":"verified"},{"icon":"warning","textEn":"No specific data retention periods mentioned for cookie data.","textIt":"Nessun periodo di conservazione dei dati specificato per i cookie.","deltaScore":-2,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiDataRetention","anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"Strictly necessary cookies are always active for site functionality and cannot be disabled.","textIt":"I cookie strettamente necessari sono sempre attivi per la funzionalità del sito e non possono essere disabilitati.","sentiment":"neutral"},{"textEn":"Analytics, advertising, and personalization cookies extensively track user behavior and interests.","textIt":"I cookie di analisi, pubblicità e personalizzazione tracciano ampiamente il comportamento e gli interessi degli utenti.","sentiment":"negative"},{"textEn":"Third parties collect and share cookie data for their own purposes, including product improvement.","textIt":"Terze parti raccolgono e condividono dati sui cookie per i propri scopi, incluso il miglioramento dei prodotti.","sentiment":"negative"},{"textEn":"Users can manage cookie preferences via browser settings or a specific Cookie Tool, if available.","textIt":"Gli utenti possono gestire le preferenze dei cookie tramite le impostazioni del browser o uno Strumento Cookie specifico, se disponibile.","sentiment":"positive"},{"textEn":"Data processing relies on various legal bases, including legitimate interests and user consent.","textIt":"Il trattamento dei dati si basa su varie basi giuridiche, inclusi interessi legittimi e consenso dell'utente.","sentiment":"neutral"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Companies operating in the EU must ensure their cookie consent banners and mechanisms provide explicit opt-in for non-essential cookies to comply with GDPR and ePrivacy Directive.","complianceNoteEn":"GDPR Art. 6, ePrivacy Directive"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The policy's reliance on 'legitimate interests' for some cookie processing may not fully align with GDPR's strict explicit consent requirements for non-essential cookies. Users should actively manage preferences.","complianceNoteEn":"GDPR Art. 6, Art. 7"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Companies must implement flexible cookie management systems to adapt to diverse and evolving global data protection regulations and consent standards, which vary significantly by region.","complianceNoteEn":null},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The policy highlights broad data collection and sharing, requiring individuals worldwide to be proactive in managing their online privacy settings and understanding third-party data use.","complianceNoteEn":null},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses need to ensure their cookie practices support consumer opt-out rights for data sharing and targeted advertising across various state privacy laws. Compliance complexity is high.","complianceNoteEn":"CCPA/CPRA, VCDPA, CPA"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Users have options to manage cookies via browser settings, aligning with opt-out rights under state laws like CCPA/CPRA for data sharing. However, broad third-party sharing remains a concern.","complianceNoteEn":"CCPA/CPRA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Partial"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Cookie Notice source still match the recorded public snapshot version 2?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/86ef6b02-beb3-4e84-9f41-8a5a94004114","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"65ccf1a98af31b2c81c352a756831e7221496997667a888c16965b024169fcd0"}