{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"b163d841-2b1c-4d03-8b6e-3d80a7d4cb27","screeningDate":"2026-08-18T03:00:38.185Z","publicationGate":"published","company":{"id":"c0caa75b-cc98-45c5-9b6b-198af2014025","name":"PayPal","slug":"paypal","industry":"FinTech"},"policy":{"id":"9e09108f-4041-4c64-8e16-88543e1b7e43","name":"Privacy Statement","type":"privacy","jurisdiction":"US","sourceUrl":"https://www.paypal.com/us/webapps/mpp/ua/privacy-full"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-08-21T19:02:06.303Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":7,"sha256":"454b2ac83b0b91a71efa67e3f19979294f3439aec17b937619690174e02bf9bb","capturedAt":"2026-08-06T03:51:17.421Z"},"current":{"version":8,"sha256":"20524cc00c4056093b9bfa5192fece3a1d4087a0b2aad844bbcd8bf6fe6f70f8","capturedAt":"2026-08-18T03:00:38.178Z"}},"assessment":{"summary":"The PayPal Privacy Statement is unchanged, detailing extensive data collection, AI training, and broad sharing, with some user opt-out options.","overallRisk":"Medium","overallScore":6,"previousPublicChange":{"id":"b31dce3e-ce3e-49d8-8009-5e1d6297bbd4","overallRisk":"Medium","overallScore":7,"screeningDate":"2026-08-06T03:51:17.428Z"},"scoreDelta":-1,"direction":"lower","reasons":[{"icon":"warning","textEn":"Extensive collection of sensitive and biometric data.","textIt":"Ampia raccolta di dati sensibili e biometrici.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiDataCollection","anchorStatus":"not-recorded"},{"icon":"warning","textEn":"Personal data is used for AI model training and automated decisions.","textIt":"I dati personali sono usati per l'addestramento AI e decisioni automatizzate.","deltaScore":0,"evidenceQuote":"We may use Personal Information to train our artificial intelligence (AI) models that power our Services and help us deliver more secure, efficient, and personalized services. PayPal also uses Automated Decision Making to provide our produc","evidenceSide":"new","relatedKpi":"kpiAiTrainingOptOut","anchorStatus":"verified"},{"icon":"warning","textEn":"Broad sharing of personal information with various third parties.","textIt":"Ampia condivisione di informazioni personali con terze parti.","deltaScore":0,"evidenceQuote":"We disclose your Personal Information with service providers and third parties, including those participating in the payment network, to help us provide Services, protect our customers from risk and fraud, market our products, and comply wi","evidenceSide":"new","relatedKpi":"kpiThirdPartySharing","anchorStatus":"verified"}],"keyPoints":[{"textEn":"PayPal collects extensive personal data, including sensitive and biometric information, for various services.","textIt":"PayPal raccoglie ampi dati personali, incluse informazioni sensibili e biometriche, per vari servizi.","sentiment":"negative"},{"textEn":"Personal data is used to train AI models and for automated decision-making in fraud prevention.","textIt":"I dati personali sono usati per addestrare modelli AI e per decisioni automatizzate nella prevenzione frodi.","sentiment":"negative"},{"textEn":"Data is broadly shared with service providers, corporate group members, and authorities.","textIt":"I dati sono ampiamente condivisi con fornitori di servizi, membri del gruppo aziendale e autorità.","sentiment":"negative"},{"textEn":"Users can opt-out of certain data uses, such as precise geolocation tracking and some features.","textIt":"Gli utenti possono disattivare alcuni usi dei dati, come il tracciamento della geolocalizzazione precisa e alcune funzionalità.","sentiment":"positive"},{"textEn":"Biometric data collection requires explicit user consent for authentication purposes.","textIt":"La raccolta di dati biometrici richiede il consenso esplicito dell'utente per scopi di autenticazione.","sentiment":"positive"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses using PayPal must ensure their own data processing aligns with PayPal's policy and GDPR, especially regarding third-party sharing and AI use. Due diligence on data flows is crucial.","complianceNoteEn":"GDPR Art. 28, 32"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The policy's extensive data collection and AI training raise concerns under GDPR, despite mentions of opt-out rights. Users should exercise their rights to data access and deletion.","complianceNoteEn":"GDPR Art. 5, 6, 9"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises using PayPal need to assess cross-border data transfer implications and ensure their operations align with PayPal's data handling practices and international regulations.","complianceNoteEn":null},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The policy's global applicability means users worldwide face similar data collection and AI training practices. Understanding local privacy rights is essential.","complianceNoteEn":null},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses must manage data sharing with PayPal in compliance with US state privacy laws, particularly concerning consumer consent and data processing agreements.","complianceNoteEn":"CCPA/CPRA"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Users have rights under CCPA/CPRA regarding data collection, sharing, and the use of sensitive personal information. Opt-out options are available for some data uses.","complianceNoteEn":"CCPA/CPRA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Explicit Opt-In"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Statement source still match the recorded public snapshot version 8?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/b163d841-2b1c-4d03-8b6e-3d80a7d4cb27","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"a07ff452a3779d46a5232a238823041b55b8f99ec84afdf7cd17194f1a9bc178"}