{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"a551ca11-952d-4a8a-b79a-0c1df7462093","screeningDate":"2026-08-01T04:35:55.981Z","publicationGate":"published","company":{"id":"9bffb74f-0f91-46a9-a635-74b5e91623e1","name":"Microsoft","slug":"microsoft","industry":"Tech Giant"},"policy":{"id":"cda59c99-32eb-4c5d-aae6-a269c7b681f6","name":"Privacy Statement","type":"privacy","jurisdiction":"US","sourceUrl":"https://www.microsoft.com/en-us/privacy/privacystatement"},"sourceConfidence":{"state":"review-required","lastCheckedAt":"2026-07-06T09:39:08.873Z","retrievalChannel":"other","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":1,"sha256":"bf0d42255d66ccdd9b9b1707cc4454904d107469c0ab3627af72d5b6fc3fc8b2","capturedAt":"2026-07-06T09:42:55.851Z"},"current":{"version":2,"sha256":"0d69136f4c89eac5a2a6b57f1c5f81fb68e1acc289f939d66e158406f74ab54e","capturedAt":"2026-08-01T04:35:55.968Z"}},"assessment":{"summary":"Microsoft's updated policy now allows sharing user age group information with third-party apps, increasing data sharing scope and privacy concerns.","overallRisk":"High","overallScore":9,"previousPublicChange":null,"scoreDelta":null,"direction":"baseline","reasons":[{"icon":"alert","textEn":"New clause permits sharing age group data with third-party apps.","textIt":"Nuova clausola consente la condivisione di dati sull'età con app di terze parti.","deltaScore":2,"evidenceQuote":"We may share age group information with Microsoft apps and services, as well as third-party apps, so that they can apply appropriate safeguards, tailor experiences, and comply with applicable laws and regulations.","evidenceSide":"new","relatedKpi":"kpiThirdPartySharing","anchorStatus":"verified"},{"icon":"warning","textEn":"Potential for broader use of age data by external parties.","textIt":"Potenziale per un uso più ampio dei dati sull'età da parte di terzi.","deltaScore":1,"evidenceQuote":"We may share age group information with Microsoft apps and services, as well as third-party apps","evidenceSide":"new","relatedKpi":"kpiThirdPartySharing","anchorStatus":"verified"},{"icon":"warning","textEn":"Increased sensitivity of shared data due to age group information.","textIt":"Aumentata sensibilità dei dati condivisi a causa delle informazioni sull'età.","deltaScore":1,"evidenceQuote":"We may share age group information with Microsoft apps and services, as well as third-party apps","evidenceSide":"new","relatedKpi":"kpiDataCollection","anchorStatus":"verified"}],"keyPoints":[{"textEn":"New clause permits sharing user age group information with third-party applications.","textIt":"Nuova clausola consente la condivisione dei dati sul gruppo di età con app di terze parti.","sentiment":"negative"},{"textEn":"This expands the scope of data sharing beyond Microsoft's direct services.","textIt":"Ciò espande l'ambito della condivisione dei dati oltre i servizi diretti di Microsoft.","sentiment":"negative"},{"textEn":"The stated purpose is to apply safeguards, tailor experiences, and ensure compliance.","textIt":"Lo scopo dichiarato è applicare salvaguardie, personalizzare le esperienze e garantire la conformità.","sentiment":"neutral"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises using Microsoft services must ensure their own compliance with GDPR regarding data processing agreements with Microsoft and any third parties. Clear consent mechanisms for sharing age data may be required, especially for children's data.","complianceNoteEn":"GDPR Art. 28, 30"},{"region":"EU","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"The sharing of age group information with third parties raises concerns under GDPR, particularly regarding the legal basis for processing and transparency. Users should be aware of potential profiling and targeted experiences based on this shared data.","complianceNoteEn":"GDPR Art. 6, 9, 13, 14"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises operating globally must consider the implications of this expanded data sharing on their overall privacy strategy and vendor management. Ensuring consistent data protection standards across all jurisdictions becomes more complex.","complianceNoteEn":null},{"region":"Global","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"Globally, users face increased potential for their age group data to be used by a wider array of third-party applications. This could lead to more tailored content, but also raises general privacy concerns about data control and secondary uses.","complianceNoteEn":null},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses relying on Microsoft's platform need to assess how this change impacts their compliance with various US state privacy laws. They must ensure their data handling practices align with the new sharing scope and any associated consumer rights.","complianceNoteEn":"US State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"Under US state privacy laws like CCPA/CPRA, sharing age group information could be considered 'sharing' of personal information. This may trigger opt-out rights for cross-context behavioral advertising, requiring users to actively manage preferences.","complianceNoteEn":"CCPA/CPRA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Partial"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiContentModeration","label":"Content moderation","value":"Partial"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Implicit"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Statement source still match the recorded public snapshot version 2?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/a551ca11-952d-4a8a-b79a-0c1df7462093","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"b93d34cb11a8ea8f3dd3b76278d8f2bd783b4d5b9ebdc5ae1b3714c0d4ac0ec7"}