{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"b31dce3e-ce3e-49d8-8009-5e1d6297bbd4","screeningDate":"2026-08-06T03:51:17.428Z","publicationGate":"published","company":{"id":"c0caa75b-cc98-45c5-9b6b-198af2014025","name":"PayPal","slug":"paypal","industry":"FinTech"},"policy":{"id":"9e09108f-4041-4c64-8e16-88543e1b7e43","name":"Privacy Statement","type":"privacy","jurisdiction":"US","sourceUrl":"https://www.paypal.com/us/webapps/mpp/ua/privacy-full"},"sourceConfidence":{"state":"review-required","lastCheckedAt":"2026-07-06T03:59:34.660Z","retrievalChannel":"seeded","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":6,"sha256":"06b8d9b74879230525e3aad0c15e820f38dba6d2c41a3a99c9baac8c95465ef6","capturedAt":"2026-08-02T12:50:33.846Z"},"current":{"version":7,"sha256":"454b2ac83b0b91a71efa67e3f19979294f3439aec17b937619690174e02bf9bb","capturedAt":"2026-08-06T03:51:17.421Z"}},"assessment":{"summary":"The PayPal Privacy Statement has not changed; it still outlines extensive data collection, AI use for training and automated decisions, and broad data sharing.","overallRisk":"Medium","overallScore":7,"previousPublicChange":{"id":"07af8187-6856-489f-9d19-4058d9120405","overallRisk":"Medium","overallScore":6,"screeningDate":"2026-08-02T12:50:33.854Z"},"scoreDelta":1,"direction":"higher","reasons":[{"icon":"warning","textEn":"Extensive collection of sensitive and biometric data.","textIt":"Ampia raccolta di dati sensibili e biometrici.","deltaScore":0,"evidenceQuote":"Biometric data: Such as voice identification, photo identification, or face scans, which we may collect when you consent in the user experience","evidenceSide":"old","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"warning","textEn":"Personal data used for AI model training and automated decisions.","textIt":"Dati personali usati per l'addestramento di modelli AI e decisioni automatizzate.","deltaScore":0,"evidenceQuote":"We may use Personal Information to train our artificial intelligence (AI) models that power our Services and help us deliver more secure, efficient, and personalized services. PayPal also uses Automated Decision Making to provide our produc","evidenceSide":"old","relatedKpi":"kpiAiTrainingOptOut","anchorStatus":"verified"},{"icon":"warning","textEn":"Broad sharing of data with third parties, including AI providers.","textIt":"Ampia condivisione di dati con terze parti, inclusi fornitori di AI.","deltaScore":0,"evidenceQuote":"We may disclose Personal Information with our service providers that operate at our direction and on our behalf to perform services we outsource to them, such as AI providers","evidenceSide":"old","relatedKpi":"kpiThirdPartySharing","anchorStatus":"verified"}],"keyPoints":[{"textEn":"No changes were detected between the old and new versions of the PayPal Privacy Statement.","textIt":"Nessuna modifica è stata rilevata tra la vecchia e la nuova versione della Dichiarazione sulla Privacy di PayPal.","sentiment":"neutral"},{"textEn":"PayPal collects extensive personal data, including sensitive and biometric information, with user consent for some uses.","textIt":"PayPal raccoglie ampi dati personali, inclusi informazioni sensibili e biometriche, con il consenso dell'utente per alcuni usi.","sentiment":"negative"},{"textEn":"Personal information is used to train AI models and for automated decision-making processes.","textIt":"Le informazioni personali vengono utilizzate per addestrare modelli di intelligenza artificiale e per processi decisionali automatizzati.","sentiment":"negative"},{"textEn":"Data is shared broadly with service providers, including AI providers, and other third parties.","textIt":"I dati sono ampiamente condivisi con fornitori di servizi, inclusi fornitori di IA, e altre terze parti.","sentiment":"negative"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"PayPal's broad data processing and AI use for financial services require robust GDPR compliance, especially for cross-border transfers and vendor management. The upcoming AI Act will add further obligations for high-risk AI systems.","complianceNoteEn":"GDPR Art. 28, AI Act"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Extensive data collection, including sensitive data and AI training, raises GDPR concerns regarding consent, transparency, and data subject rights. Automated decision-making requires clear explanations and the right to human intervention.","complianceNoteEn":"GDPR Art. 9, 22"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Operating globally with extensive data and AI use demands a robust, adaptable privacy framework to navigate diverse regulations. Ensuring consistent data protection standards across jurisdictions is a significant challenge.","complianceNoteEn":"Cross-Jurisdictional Compliance"},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Users globally face risks from extensive data collection, AI training, and automated decisions without clear opt-out mechanisms. The broad sharing of data with third parties also increases potential exposure.","complianceNoteEn":"Global Privacy Norms"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"PayPal's data practices, including AI use, must align with evolving US state privacy laws like CCPA/CPRA. Managing extensive data and third-party sharing requires careful vendor contracts and compliance frameworks.","complianceNoteEn":"US State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The collection of sensitive and biometric data, along with AI-driven profiling, impacts consumer privacy rights under CCPA/CPRA. Users may have rights to opt-out of sales/sharing and limit sensitive data use.","complianceNoteEn":"CCPA/CPRA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Partial"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Statement source still match the recorded public snapshot version 7?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/b31dce3e-ce3e-49d8-8009-5e1d6297bbd4","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"e3a04433eb6c30525434e817f6cde891fb96d93deca59264ae43a764bd873709"}