{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"9dd157b3-34d5-4710-bcef-0d0368693145","screeningDate":"2026-10-09T02:47:13.625Z","publicationGate":"published","company":{"id":"c0caa75b-cc98-45c5-9b6b-198af2014025","name":"PayPal","slug":"paypal","industry":"FinTech"},"policy":{"id":"9e09108f-4041-4c64-8e16-88543e1b7e43","name":"Privacy Statement","type":"privacy","jurisdiction":"US","sourceUrl":"https://www.paypal.com/us/webapps/mpp/ua/privacy-full"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-10-09T02:47:13.609Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":9,"sha256":"514f87b3a545a9dc2574a6a25f91556dd7e774bdedf318aba1e1be31a0473cba","capturedAt":"2026-10-01T19:55:28.943Z"},"current":{"version":10,"sha256":"4594897afb9c019070eab6f20914b54c3b15bd2ed19d39e6591bd521840b944f","capturedAt":"2026-10-09T02:47:13.615Z"}},"assessment":{"summary":"PayPal's policy involves extensive data collection, including sensitive and biometric data, used for AI and shared broadly, with some opt-out options.","overallRisk":"High","overallScore":7,"previousPublicChange":{"id":"e4f3732c-92f2-4a5d-a9b2-716fd9ebf183","overallRisk":"High","overallScore":8,"screeningDate":"2026-10-01T19:55:28.950Z"},"scoreDelta":-1,"direction":"lower","reasons":[{"icon":"alert","textEn":"Extensive collection of sensitive and biometric data.","textIt":"Ampia raccolta di dati sensibili e biometrici.","deltaScore":0,"evidenceQuote":"Biometric data: Such as voice identification, photo identification, or face scans, which we may collect when you consent in the user experience","evidenceSide":"old","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"warning","textEn":"Broad sharing of personal data with many third parties and affiliates.","textIt":"Ampia condivisione di dati personali con terze parti e affiliati.","deltaScore":0,"evidenceQuote":"We disclose your Personal Information with service providers and third parties, including those participating in the payment network","evidenceSide":"old","relatedKpi":"kpiThirdPartySharing","anchorStatus":"verified"},{"icon":"warning","textEn":"Use of personal data for AI training and automated decision-making.","textIt":"Uso di dati personali per l'addestramento dell'IA e decisioni automatizzate.","deltaScore":0,"evidenceQuote":"We may use Personal Information to train our artificial intelligence (AI) models that power our Services and help us deliver more secure, efficient, and personalized services. PayPal also uses Automated Decision Making","evidenceSide":"old","relatedKpi":"kpiAiTrainingOptOut","anchorStatus":"verified"}],"keyPoints":[{"textEn":"Extensive personal data collection, including sensitive and biometric information, is detailed in the policy.","textIt":"La politica descrive una raccolta estesa di dati personali, incluse informazioni sensibili e biometriche.","sentiment":"negative"},{"textEn":"Personal data is used for training AI models and for automated decision-making processes.","textIt":"I dati personali sono utilizzati per addestrare modelli di IA e per processi decisionali automatizzati.","sentiment":"negative"},{"textEn":"Data is broadly shared with service providers, corporate affiliates, and authorities.","textIt":"I dati sono ampiamente condivisi con fornitori di servizi, affiliati aziendali e autorità.","sentiment":"negative"},{"textEn":"Users can withdraw consent for certain data uses and features, and some opt-out options are available.","textIt":"Gli utenti possono revocare il consenso per alcuni usi dei dati e funzionalità, e sono disponibili opzioni di opt-out.","sentiment":"positive"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises using PayPal must ensure their own data processing activities align with GDPR, especially regarding data shared with PayPal and its sub-processors. The AI Act will also introduce new compliance requirements for AI systems.","complianceNoteEn":"GDPR Articles 28, AI Act"},{"region":"EU","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"The extensive data collection, including sensitive and biometric data, and its use for AI training and automated decisions, raises significant concerns under GDPR. While consent is mentioned, the broad sharing practices require careful review.","complianceNoteEn":"GDPR Articles 5, 6, 9, 22"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises must navigate a complex web of international privacy regulations when using PayPal. Due diligence on data flows, AI governance, and third-party sharing is crucial to mitigate compliance risks.","complianceNoteEn":null},{"region":"Global","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"Globally, individuals face high privacy risks due to the extensive collection of sensitive data, AI training, and broad sharing. Users should be vigilant about their consent and opt-out options across all services.","complianceNoteEn":null},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"US enterprises integrating PayPal must ensure their data handling practices comply with various state privacy laws. The broad data sharing and AI use require careful vendor assessment and contractual safeguards.","complianceNoteEn":"State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"Extensive data collection, including sensitive and biometric data, and broad sharing, pose high risks for US individuals. State privacy laws like CCPA/CPRA grant rights, but users must actively manage their preferences.","complianceNoteEn":"CCPA/CPRA, BIPA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiContentModeration","label":"Content moderation","value":"Opaque"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Explicit Opt-In"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Statement source still match the recorded public snapshot version 10?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/9dd157b3-34d5-4710-bcef-0d0368693145","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"6b5e74795158dfdafb4cfeb1ec3b4a6ca09832a8fdf8e82882796be6b607531e"}