{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"b6f77d48-bc9c-4085-bf97-702fd935ce2e","screeningDate":"2026-09-24T16:32:08.374Z","publicationGate":"published","company":{"id":"2c5bac29-0643-4196-be90-4b5b2767b6ed","name":"OpenAI","slug":"openai","industry":"AI Provider"},"policy":{"id":"9e7ca672-d487-4edc-92b9-8567f4c1adcf","name":"Privacy Policy","type":"privacy","jurisdiction":"EU","sourceUrl":"https://openai.com/policies/eu-privacy-policy"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-09-24T16:32:08.337Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":1,"sha256":"dc376ab3044722cf242980ae7c4d3de5fbbd0234dd08ccd0ed1314500b3051eb","capturedAt":"2026-07-06T07:19:16.903Z"},"current":{"version":2,"sha256":"2f2f693d8e75320f5079f1160cb3ed5343f2f9bec082c4afea1762928ea09e32","capturedAt":"2026-09-24T16:32:08.367Z"}},"assessment":{"summary":"OpenAI now collects ad history and interests for 'Free and Go' users, sharing data with advertisers to personalize ads, increasing privacy risk.","overallRisk":"High","overallScore":7,"previousPublicChange":null,"scoreDelta":null,"direction":"baseline","reasons":[{"icon":"alert","textEn":"New collection of ad history and interests for 'Free and Go' users.","textIt":"Nuova raccolta di cronologia annunci e interessi per utenti 'Free e Go'.","deltaScore":2,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiDataCollection","anchorStatus":"not-recorded"},{"icon":"alert","textEn":"Receiving data from advertisers and partners for ad personalization.","textIt":"Ricezione di dati da inserzionisti e partner per la personalizzazione degli annunci.","deltaScore":2,"evidenceQuote":"We receive information from advertisers and other data partners, which we use for purposes described in this Policy including to help us measure and improve the effectiveness of our Services, including to help us show more relevant ads to F","evidenceSide":"new","relatedKpi":"kpiThirdPartySharing","anchorStatus":"verified"},{"icon":"warning","textEn":"Increased data processing for personalized advertising purposes.","textIt":"Aumento del trattamento dati per finalità di pubblicità personalizzata.","deltaScore":1,"evidenceQuote":"For Free and Go users, to the extent it is available to you, to personalise the ads you see on our Services (subject to your choices and controls), and to measure the effectiveness of ads shown on our Services.","evidenceSide":"new","relatedKpi":"kpiAutomatedDecision","anchorStatus":"verified"}],"keyPoints":[{"textEn":"New data collection for 'Free and Go' users, including ad history and interests, is now explicitly stated.","textIt":"È ora esplicitamente indicata la nuova raccolta dati per gli utenti 'Free e Go', inclusa la cronologia degli annunci e gli interessi.","sentiment":"negative"},{"textEn":"OpenAI will receive data from advertisers and partners to measure ad effectiveness and personalize ads.","textIt":"OpenAI riceverà dati da inserzionisti e partner per misurare l'efficacia degli annunci e personalizzare la pubblicità.","sentiment":"negative"},{"textEn":"New advertising controls are introduced for 'Free and Go' users to manage ad personalization.","textIt":"Vengono introdotti nuovi controlli pubblicitari per gli utenti 'Free e Go' per gestire la personalizzazione degli annunci.","sentiment":"neutral"},{"textEn":"References to 'Sora' and 'Atlas browser' have been removed or generalized, simplifying the policy.","textIt":"I riferimenti a 'Sora' e 'browser Atlas' sono stati rimossi o generalizzati, semplificando la policy.","sentiment":"neutral"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises using OpenAI's free or 'Go' services for employees should assess the implications of increased data collection for advertising. This could impact internal privacy policies and compliance with GDPR if employee data is involved.","complianceNoteEn":"GDPR Article 28"},{"region":"EU","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"The new ad-related data collection and processing for 'Free and Go' users raises concerns under GDPR, particularly regarding the legal basis for processing and transparency. Users should be aware of increased profiling for advertising purposes.","complianceNoteEn":"GDPR Articles 6, 13, 22"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises must consider the implications of these changes for their data protection strategies and employee usage policies. Ensuring compliance across diverse regulatory landscapes becomes more complex with expanded ad data practices.","complianceNoteEn":"Cross-border Data Governance"},{"region":"Global","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"Globally, individuals face increased privacy risks due to the expanded collection and use of personal data for advertising. Users should actively manage their privacy settings and be aware of how their interactions contribute to profiling.","complianceNoteEn":"Global Privacy Principles"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"US enterprises should review how their employees' use of OpenAI's 'Free and Go' services might expose data to advertising practices. This requires careful consideration for internal data governance and compliance with state privacy laws.","complianceNoteEn":"State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"The expanded data collection for advertising, including third-party data, increases privacy risks for US individuals. This could trigger consumer privacy rights under laws like CCPA/CPRA regarding targeted advertising and the right to opt-out of sharing.","complianceNoteEn":"CCPA/CPRA Right to Opt-Out"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Partial"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiContentModeration","label":"Content moderation","value":"Opaque"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Policy source still match the recorded public snapshot version 2?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/b6f77d48-bc9c-4085-bf97-702fd935ce2e","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"105b75b1612414a3aa77bbd26ef2addbc6674e853edb1cc709bb01b55b5a3e22"}