{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.1.0","mappingVersion":"2026-07-29.1","changeId":"8fee8965-4f52-4d9e-86b4-33dc60fdadd7","screeningDate":"2026-11-12T22:40:20.638Z","publicationGate":"published","company":{"id":"db74e904-0a7d-4a0c-a18f-a8270bf3f498","name":"TikTok","slug":"tiktok","industry":"Social Media"},"policy":{"id":"ba9a6eba-2f2e-4b30-8a92-04f7743f0d65","name":"Privacy Policy","type":"privacy","jurisdiction":"EU","sourceUrl":"https://www.tiktok.com/legal/privacy-policy-eea"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-11-12T22:40:20.627Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":4,"sha256":"3a6bbd7afaf7b77774d876a3cec3527e25a5b72f6f8556bbb89dc67d69b34a61","capturedAt":"2026-10-29T14:38:57.532Z"},"current":{"version":5,"sha256":"ee13d9375db8e4f3b8ed278301fc45ea4ffd4965f492286e399580c3983cf39f","capturedAt":"2026-11-12T22:40:20.627Z"}},"analysisLineage":{"status":"verified","requestSha256":"e283f2f681a2c51d9f5766218c0b13798092278811b1d6e615112bf604dde551","responseSha256":"92694910fe65e77bde831ac8d1b7d7e83b288c8a1244fe142054e4304b05b54f","model":"gemini-3.5-flash-lite","promptVersion":"policy-analysis.v3-full-document","schemaVersion":"policy-analysis.schema.v2","inputCoverage":"complete","semanticCoverage":"not_measured","documents":{"old":{"sha256":"3a6bbd7afaf7b77774d876a3cec3527e25a5b72f6f8556bbb89dc67d69b34a61","charLength":45436,"byteLength":45589,"rangeUnit":"utf16-code-unit","includedRanges":[[0,45436]],"excludedRanges":[]},"new":{"sha256":"ee13d9375db8e4f3b8ed278301fc45ea4ffd4965f492286e399580c3983cf39f","charLength":45616,"byteLength":45769,"rangeUnit":"utf16-code-unit","includedRanges":[[0,45616]],"excludedRanges":[]}},"boundary":"Hash verification links retained inputs and the application SDK request. It does not prove provider execution, semantic completeness or legal correctness."},"captureLineage":{"old":{"provenance":"captured","sourceUrl":"https://www.tiktok.com/legal/privacy-policy-eea","requestedUrl":"https://www.tiktok.com/legal/privacy-policy-eea","finalUrl":"https://www.tiktok.com/legal/page/eea/privacy-policy/en","capturedAt":"2026-10-29T14:38:57.532Z","urlDisclosure":"credentials-query-fragment-redacted"},"current":{"provenance":"captured","sourceUrl":"https://www.tiktok.com/legal/privacy-policy-eea","requestedUrl":"https://www.tiktok.com/legal/privacy-policy-eea","finalUrl":"https://www.tiktok.com/legal/page/eea/privacy-policy/en","capturedAt":"2026-11-12T22:40:20.627Z","urlDisclosure":"credentials-query-fragment-redacted"}},"assessment":{"summary":"TikTok introduced a UK-specific update concerning how ads are displayed, taking effect in November 2026 or upon user choice.","overallRisk":"Low","overallScore":3,"previousPublicChange":{"id":"d20a661b-f4d4-4442-a4a1-1d8a5ddcb491","overallRisk":"High","overallScore":7,"screeningDate":"2026-10-29T14:38:57.546Z"},"scoreDelta":-4,"direction":"lower","reasons":[{"icon":"info","textEn":"Introduced targeted updates for UK ad personalization and consent triggers.","textIt":"Introotti aggiornamenti mirati per la personalizzazione degli annunci e i consensi nel Regno Unito.","deltaScore":0,"evidenceQuote":"We are changing how we show ads to UK users. Our new Privacy Policy for UK users comes into effect on 11 November 2026 or, if you are in the UK, when you make a choice about ads.","evidenceSide":"new","relatedKpi":"kpiConsentMechanism","anchorStatus":"verified"},{"icon":"info","textEn":"Broad data collection practices via device and third-party sources remain unchanged.","textIt":"Le ampie pratiche di raccolta dati tramite dispositivi e terze parti rimangono invariate.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiDataCollection","anchorStatus":"not-recorded"},{"icon":"info","textEn":"Cross-border data transfers to the US, Malaysia, and Singapore continue under SCCs.","textIt":"I trasferimenti di dati transfrontalieri verso USA, Malesia e Singapore continuano tramite SCC.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiCrossBorderTransfer","anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"Added a new introductory clause specifically addressing ad delivery for UK users.","textIt":"Aggiunta una nuova clausola introduttiva specifica per la visualizzazione degli annunci agli utenti del Regno Unito.","sentiment":"neutral"},{"textEn":"Established an effective date of 11 November 2026 for the UK ad policy changes.","textIt":"Stabilita la data di entrata in vigore dell'11 novembre 2026 per le modifiche alla policy annunci nel Regno Unito.","sentiment":"neutral"},{"textEn":"Retained existing data collection, sharing, and retention terms across all other regions.","textIt":"Mantenuti i termini esistenti di raccolta, condivisione e conservazione dei dati in tutte le altre regioni.","sentiment":"neutral"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Low","impactAnalysisEn":"No new enterprise obligations or data sharing adjustments apply within the EU.","complianceNoteEn":"GDPR Compliant"},{"region":"EU","perspective":"Individual","riskLevel":"Low","impactAnalysisEn":"EU users see no changes in this update, retaining existing GDPR rights.","complianceNoteEn":"GDPR Art 6"},{"region":"Global","perspective":"Enterprise","riskLevel":"Low","impactAnalysisEn":"Global corporate partners retain their existing integration and data processing frameworks.","complianceNoteEn":"Global Operations"},{"region":"Global","perspective":"Individual","riskLevel":"Low","impactAnalysisEn":"Global users outside the UK experience zero changes to their privacy terms.","complianceNoteEn":"Standard Baseline"},{"region":"US","perspective":"Enterprise","riskLevel":"Low","impactAnalysisEn":"Enterprise advertisers experience no operational shifts under this specific UK revision.","complianceNoteEn":"Standard Terms"},{"region":"US","perspective":"Individual","riskLevel":"Low","impactAnalysisEn":"US individual users are unaffected by the UK-specific ad policy update.","complianceNoteEn":"CCPA Baseline"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"},{"field":"kpiContentModeration","label":"Content moderation","value":"Partial"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Policy source still match the recorded public snapshot version 5?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/8fee8965-4f52-4d9e-86b4-33dc60fdadd7","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"bfcef92dc9dc224d188bda4c628562dd921cb8438bc5094a32d517f264b5b2fd"}