{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"b2e39954-84c1-4843-a490-278f2f4807a0","screeningDate":"2026-08-02T11:29:55.562Z","publicationGate":"published","company":{"id":"c0caa75b-cc98-45c5-9b6b-198af2014025","name":"PayPal","slug":"paypal","industry":"FinTech"},"policy":{"id":"c28fb784-5012-4696-8c70-505d4185972a","name":"Privacy Statement","type":"privacy","jurisdiction":"EU","sourceUrl":"https://www.paypal.com/lu/webapps/mpp/ua/privacy-full"},"sourceConfidence":{"state":"review-required","lastCheckedAt":"2026-07-06T03:59:34.660Z","retrievalChannel":"seeded","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":4,"sha256":"168f01646ad727bfb22632a07b38d4213b1e7ace135386ba18deefa502a85984","capturedAt":"2026-08-01T04:36:34.322Z"},"current":{"version":5,"sha256":"320239c1eb5644bef52632ccf2177de89fd5c2d82de78bab34f0b8c193a41ec7","capturedAt":"2026-08-02T11:29:55.554Z"}},"assessment":{"summary":"This policy details PayPal's extensive data collection, broad sharing, and use of AI for training and automated decisions, with no changes from the previous version.","overallRisk":"Medium","overallScore":7,"previousPublicChange":{"id":"6d94c250-62ab-4f8b-88b6-03573281433f","overallRisk":"High","overallScore":7,"screeningDate":"2026-08-01T04:36:34.328Z"},"scoreDelta":0,"direction":"unchanged","reasons":[{"icon":"warning","textEn":"Extensive collection of sensitive and biometric data raises privacy concerns.","textIt":"L'ampia raccolta di dati sensibili e biometrici solleva preoccupazioni sulla privacy.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiDataCollection","anchorStatus":"not-recorded"},{"icon":"warning","textEn":"Broad sharing of personal data with many third parties increases exposure risk.","textIt":"L'ampia condivisione di dati personali con terze parti aumenta il rischio di esposizione.","deltaScore":0,"evidenceQuote":"We disclose your Personal Information with service providers and third parties, including those participating in the payment network, to help us provide Services, protect our customers from risk and fraud, market our products, and comply wi","evidenceSide":"new","relatedKpi":"kpiThirdPartySharing","anchorStatus":"verified"},{"icon":"warning","textEn":"Use of AI for training and automated decisions lacks specific user opt-out.","textIt":"L'uso dell'IA per formazione e decisioni automatizzate manca di un opt-out specifico per l'utente.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiAiTrainingOptOut","anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"Extensive data collection, including sensitive and biometric data, is detailed in the policy.","textIt":"La politica descrive un'ampia raccolta di dati, inclusi dati sensibili e biometrici.","sentiment":"negative"},{"textEn":"Personal data is broadly shared with various service providers and third parties.","textIt":"I dati personali sono ampiamente condivisi con vari fornitori di servizi e terze parti.","sentiment":"negative"},{"textEn":"AI models are trained using personal data, and automated decisions are made for services and risk.","textIt":"I modelli di IA sono addestrati con dati personali e vengono prese decisioni automatizzate per servizi e rischi.","sentiment":"negative"},{"textEn":"Explicit consent is required for collecting sensitive data like biometrics and precise geolocation.","textIt":"È richiesto il consenso esplicito per la raccolta di dati sensibili come biometrici e geolocalizzazione precisa.","sentiment":"positive"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Medium risk for compliance with GDPR and the AI Act, requiring robust data processing agreements with third parties. Transparency obligations for AI systems are critical.","complianceNoteEn":"GDPR, AI Act"},{"region":"EU","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"High risk due to extensive data collection, AI use, and potential cross-border transfers under GDPR and the upcoming AI Act. Users should verify their rights to deletion and data portability.","complianceNoteEn":"GDPR, AI Act"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Medium risk; managing international data transfers and varying global privacy regulations is complex. Ensuring consistent compliance across all operating regions is a challenge.","complianceNoteEn":null},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Medium risk; users should check local privacy rights given the global nature of data processing and the lack of explicit cross-border transfer details in this snippet.","complianceNoteEn":null},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Medium risk for compliance with diverse state privacy laws regarding data sharing and AI governance. Managing data flows and third-party contracts across states is complex.","complianceNoteEn":"State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Medium risk due to broad data sharing and AI use, impacting rights under CCPA/CPRA and other state privacy laws. Users should actively manage their opt-out preferences.","complianceNoteEn":"CCPA/CPRA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiContentModeration","label":"Content moderation","value":"Opaque"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Explicit Opt-In"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Statement source still match the recorded public snapshot version 5?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/b2e39954-84c1-4843-a490-278f2f4807a0","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"5689fd1e6ac189a3ed7d4263857d1be47848927690d13590a0ae35b67d856d15"}