{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"c401c830-2b20-475a-908c-8c4d762bda1e","screeningDate":"2026-07-10T01:47:05.644Z","publicationGate":"published","company":{"id":"c0caa75b-cc98-45c5-9b6b-198af2014025","name":"PayPal","slug":"paypal","industry":"FinTech"},"policy":{"id":"9e09108f-4041-4c64-8e16-88543e1b7e43","name":"Privacy Statement","type":"privacy","jurisdiction":"US","sourceUrl":"https://www.paypal.com/us/webapps/mpp/ua/privacy-full"},"sourceConfidence":{"state":"review-required","lastCheckedAt":"2026-07-06T03:59:34.660Z","retrievalChannel":"seeded","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":2,"sha256":"06b8d9b74879230525e3aad0c15e820f38dba6d2c41a3a99c9baac8c95465ef6","capturedAt":"2026-07-07T02:34:31.385Z"},"current":{"version":3,"sha256":"454b2ac83b0b91a71efa67e3f19979294f3439aec17b937619690174e02bf9bb","capturedAt":"2026-07-10T01:47:05.636Z"}},"assessment":{"summary":"PayPal collects extensive personal and sensitive data, including for AI training and automated decisions, sharing it broadly, but lacks clear AI opt-out and data retention specifics.","overallRisk":"High","overallScore":8,"previousPublicChange":{"id":"121a92db-3af8-48da-8b5e-fa953a94d08b","overallRisk":"High","overallScore":8,"screeningDate":"2026-07-07T02:34:31.393Z"},"scoreDelta":0,"direction":"unchanged","reasons":[{"icon":"warning","textEn":"Extensive data collection, including sensitive and biometric types.","textIt":"Ampia raccolta di dati, inclusi tipi sensibili e biometrici.","deltaScore":3,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"},{"icon":"alert","textEn":"Personal data used for AI model training without clear opt-out.","textIt":"Dati personali usati per addestramento AI senza chiaro opt-out.","deltaScore":3,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"},{"icon":"warning","textEn":"Broad data sharing with many third parties, including AI providers.","textIt":"Ampia condivisione dati con terze parti, inclusi fornitori AI.","deltaScore":2,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"Extensive data collection, including sensitive and biometric data, is detailed in the policy.","textIt":"La politica descrive un'ampia raccolta di dati, inclusi dati sensibili e biometrici.","sentiment":"negative"},{"textEn":"Personal data is explicitly used for AI model training and automated decision-making processes.","textIt":"I dati personali sono usati esplicitamente per l'addestramento AI e decisioni automatizzate.","sentiment":"negative"},{"textEn":"Data is broadly shared with many third parties, including AI providers and other financial institutions.","textIt":"I dati sono ampiamente condivisi con terze parti, inclusi fornitori AI e istituzioni finanziarie.","sentiment":"negative"},{"textEn":"Consent is required for collecting precise geolocation and biometric data, offering some user control.","textIt":"Il consenso è richiesto per la geolocalizzazione precisa e i dati biometrici, offrendo controllo.","sentiment":"positive"},{"textEn":"The policy lacks clear opt-out options for AI training and specific data retention periods.","textIt":"La politica non specifica opt-out per l'addestramento AI né periodi di conservazione dei dati.","sentiment":"negative"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Broad data sharing with service providers, including AI providers, necessitates robust Data Processing Agreements (DPAs) under GDPR. The upcoming AI Act will impose new obligations on AI systems, including those used for fraud detection.","complianceNoteEn":"GDPR Art 28, EU AI Act"},{"region":"EU","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"Extensive data collection and AI training without clear opt-out raise significant GDPR concerns. Automated decision-making processes require greater transparency and user control under EU law.","complianceNoteEn":"GDPR Articles 5, 6, 22"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Managing extensive data across diverse jurisdictions with varying privacy laws and emerging AI regulations is complex. Ensuring consistent compliance and transparency across all regions is a significant operational challenge.","complianceNoteEn":"International Data Transfer"},{"region":"Global","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"Users worldwide face extensive data collection, AI training, and broad sharing without universal opt-out or retention clarity. This creates varying levels of protection depending on local regulations and user awareness.","complianceNoteEn":"Global Privacy Standards"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Extensive data processing and sharing require careful vendor management and compliance with a patchwork of state privacy laws. The use of AI for fraud and risk management needs to align with emerging AI governance frameworks.","complianceNoteEn":"State Privacy Laws, NIST AI RMF"},{"region":"US","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"Broad data collection and sharing, especially sensitive data like biometrics, raise concerns under CCPA/CPRA and other state privacy laws. The lack of explicit AI training opt-out is a notable privacy risk for users.","complianceNoteEn":"CCPA/CPRA, State Privacy Laws"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Explicit Opt-In"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Statement source still match the recorded public snapshot version 3?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/c401c830-2b20-475a-908c-8c4d762bda1e","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"5e9f9bdf958ddfe74d28cb7f466b6bc5e32a1ae107067322fb51537dffd3bd49"}