{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"be2f44f8-2b14-4c73-bfa4-15d44d157c04","screeningDate":"2026-09-23T17:16:57.208Z","publicationGate":"published","company":{"id":"9bffb74f-0f91-46a9-a635-74b5e91623e1","name":"Microsoft","slug":"microsoft","industry":"Tech Giant"},"policy":{"id":"f7958007-438b-4240-ba2d-2a48dbb9f661","name":"Privacy Statement","type":"privacy","jurisdiction":"EU","sourceUrl":"https://www.microsoft.com/en-gb/privacy/privacystatement"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-09-23T17:16:57.185Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":2,"sha256":"ebb4c380a7ff6968ecdf966c968efd3dbf3248f73f4bb5f5a14735d7a84f5730","capturedAt":"2026-08-01T04:33:29.474Z"},"current":{"version":3,"sha256":"d07ae52134ab19eff68fa322c7d3f8e07e051f8000455c5e793590653cb3576c","capturedAt":"2026-09-23T17:16:57.194Z"}},"assessment":{"summary":"Microsoft's updated policy clarifies device data collection, but still allows extensive data use, including biometrics and AI training, without explicit opt-out.","overallRisk":"High","overallScore":7,"previousPublicChange":{"id":"494ffd08-1c2e-43ae-b332-5d4b316fbaa2","overallRisk":"Medium","overallScore":7,"screeningDate":"2026-08-01T04:33:29.487Z"},"scoreDelta":0,"direction":"unchanged","reasons":[{"icon":"info","textEn":"Device data collection scope clarified to include website/app interactions.","textIt":"Ambito di raccolta dati del dispositivo chiarito per includere interazioni web/app.","deltaScore":1,"evidenceQuote":"Device and usage data. Data about your device and product features you use, hardware and software details, product performance, your interactions with our websites and apps, and your settings.","evidenceSide":"new","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"warning","textEn":"Extensive collection of personal data, including biometric identifiers.","textIt":"Ampia raccolta di dati personali, inclusi identificatori biometrici.","deltaScore":2,"evidenceQuote":"Biometric data. Unique data about you from specific technical processing related to your physical, physiological, or behavioural characteristics to verify or confirm your identity.","evidenceSide":"old","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"alert","textEn":"User data may be used to train AI models, including LLMs, without clear opt-out.","textIt":"I dati utente possono essere usati per addestrare modelli AI, inclusi LLM, senza opt-out chiaro.","deltaScore":3,"evidenceQuote":"As part of our efforts to improve and develop our products, we may use your data to develop, train, and fine-tune our AI models, including large language models (LLMs).","evidenceSide":"old","relatedKpi":"kpiAiTrainingOptOut","anchorStatus":"verified"}],"keyPoints":[{"textEn":"Device and usage data collection now explicitly covers interactions with Microsoft websites and apps.","textIt":"La raccolta dei dati del dispositivo e di utilizzo ora include esplicitamente le interazioni con siti web e app Microsoft.","sentiment":"neutral"},{"textEn":"Microsoft collects extensive personal data, including sensitive biometric information, depending on product use.","textIt":"Microsoft raccoglie dati personali estesi, incluse informazioni biometriche sensibili, a seconda dell'uso del prodotto.","sentiment":"negative"},{"textEn":"User data may be used to develop and train AI models, including large language models (LLMs).","textIt":"I dati degli utenti possono essere utilizzati per sviluppare e addestrare modelli AI, inclusi i modelli linguistici di grandi dimensioni (LLM).","sentiment":"negative"},{"textEn":"The policy confirms compliance with EU-U.S., UK Extension, and Swiss-U.S. Data Privacy Frameworks.","textIt":"La politica conferma la conformità con i Data Privacy Frameworks UE-USA, Estensione UK e Svizzera-USA.","sentiment":"positive"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises using Microsoft products must ensure their own compliance, especially regarding data processed for AI training. Cross-border transfers rely on DPF, which requires careful validation.","complianceNoteEn":"GDPR Art. 28, AI Act"},{"region":"EU","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"The policy's extensive data collection, especially biometric data and AI training use, raises concerns under GDPR. Lack of explicit opt-out for AI training could be problematic for individual rights.","complianceNoteEn":"GDPR Art. 5, 6, 9, 22"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises must assess Microsoft's data practices against diverse international privacy regulations. The use of data for AI training and broad third-party sharing requires robust internal governance.","complianceNoteEn":"Cross-border Data Laws"},{"region":"Global","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"Individuals globally face risks from extensive data collection, including biometrics, and the use of data for AI training without clear consent or opt-out. Privacy settings are key for control.","complianceNoteEn":"Global Privacy Norms"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses using Microsoft services need to understand how data is handled for AI training and third-party sharing. Compliance with various state privacy laws is crucial for data processing.","complianceNoteEn":"State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The policy's broad data collection and AI training use may impact consumer privacy rights under state laws like CCPA/CPRA. Users should review the U.S. State Data Privacy Notice.","complianceNoteEn":"CCPA/CPRA, VCDPA, CPA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiContentModeration","label":"Content moderation","value":"Partial"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Implicit"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Statement source still match the recorded public snapshot version 3?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/be2f44f8-2b14-4c73-bfa4-15d44d157c04","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"55a7045e3e5d69b24ba5594076f846fbaec0abae407d93f8f71ba3649fffec29"}