{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.1.0","mappingVersion":"2026-07-29.1","changeId":"d20a661b-f4d4-4442-a4a1-1d8a5ddcb491","screeningDate":"2026-10-29T14:38:57.546Z","publicationGate":"published","company":{"id":"db74e904-0a7d-4a0c-a18f-a8270bf3f498","name":"TikTok","slug":"tiktok","industry":"Social Media"},"policy":{"id":"ba9a6eba-2f2e-4b30-8a92-04f7743f0d65","name":"Privacy Policy","type":"privacy","jurisdiction":"EU","sourceUrl":"https://www.tiktok.com/legal/privacy-policy-eea"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-10-29T14:38:57.532Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":3,"sha256":"ee13d9375db8e4f3b8ed278301fc45ea4ffd4965f492286e399580c3983cf39f","capturedAt":"2026-10-24T12:44:00.223Z"},"current":{"version":4,"sha256":"3a6bbd7afaf7b77774d876a3cec3527e25a5b72f6f8556bbb89dc67d69b34a61","capturedAt":"2026-10-29T14:38:57.532Z"}},"analysisLineage":{"status":"verified","requestSha256":"47358317157dd0333dee6ace8bb7f42eff5355abbdbcafec0b95dd528577cca4","responseSha256":"23cbab9e2d7e62f79a6cc9400fa63b934183835edebf669bdfc142f376a2444f","model":"gemini-2.5-flash","promptVersion":"policy-analysis.v3-full-document","schemaVersion":"policy-analysis.schema.v2","inputCoverage":"complete","semanticCoverage":"not_measured","documents":{"old":{"sha256":"ee13d9375db8e4f3b8ed278301fc45ea4ffd4965f492286e399580c3983cf39f","charLength":45616,"byteLength":45769,"rangeUnit":"utf16-code-unit","includedRanges":[[0,45616]],"excludedRanges":[]},"new":{"sha256":"3a6bbd7afaf7b77774d876a3cec3527e25a5b72f6f8556bbb89dc67d69b34a61","charLength":45436,"byteLength":45589,"rangeUnit":"utf16-code-unit","includedRanges":[[0,45436]],"excludedRanges":[]}},"boundary":"Hash verification links retained inputs and the application SDK request. It does not prove provider execution, semantic completeness or legal correctness."},"captureLineage":{"old":{"provenance":"captured","sourceUrl":"https://www.tiktok.com/legal/privacy-policy-eea","requestedUrl":"https://www.tiktok.com/legal/privacy-policy-eea","finalUrl":"https://www.tiktok.com/legal/page/eea/privacy-policy/en","capturedAt":"2026-10-24T12:44:00.223Z","urlDisclosure":"credentials-query-fragment-redacted"},"current":{"provenance":"captured","sourceUrl":"https://www.tiktok.com/legal/privacy-policy-eea","requestedUrl":"https://www.tiktok.com/legal/privacy-policy-eea","finalUrl":"https://www.tiktok.com/legal/page/eea/privacy-policy/en","capturedAt":"2026-10-29T14:38:57.532Z","urlDisclosure":"credentials-query-fragment-redacted"}},"assessment":{"summary":"The updated TikTok policy removes a specific notice about future UK ad changes but keeps all core data collection and sharing practices identical.","overallRisk":"High","overallScore":7,"previousPublicChange":{"id":"2eb47239-1f48-47c7-a109-ed8efb3b7dfd","overallRisk":"Medium","overallScore":5,"screeningDate":"2026-10-24T12:44:00.231Z"},"scoreDelta":2,"direction":"higher","reasons":[{"icon":"warning","textEn":"Removal of specific UK ad policy change notice reduces transparency.","textIt":"La rimozione dell'avviso specifico sui cambiamenti pubblicitari nel Regno Unito riduce la trasparenza.","deltaScore":-1,"evidenceQuote":"We are changing how we show ads to UK users. Our new Privacy Policy for UK users comes into effect on 11 November 2026 or, if you are in the UK, when you make a choice about ads.","evidenceSide":"old","relatedKpi":"kpiRegulatoryCompliance","anchorStatus":"verified"},{"icon":"info","textEn":"No new safeguards or improvements to data collection or sharing practices.","textIt":"Nessuna nuova salvaguardia o miglioramento nelle pratiche di raccolta o condivisione dei dati.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiDataCollection","anchorStatus":"not-recorded"},{"icon":"warning","textEn":"Status of previously announced UK ad policy changes is now unclear.","textIt":"Lo stato dei cambiamenti pubblicitari nel Regno Unito precedentemente annunciati non è chiaro.","deltaScore":-1,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiRegulatoryCompliance","anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"A specific notice about upcoming UK ad policy changes has been removed from the introduction.","textIt":"Un avviso specifico sui prossimi cambiamenti alla politica pubblicitaria nel Regno Unito è stato rimosso dall'introduzione.","sentiment":"neutral"},{"textEn":"No other substantive changes were made to data collection, usage, or sharing practices.","textIt":"Nessun'altra modifica sostanziale è stata apportata alle pratiche di raccolta, utilizzo o condivisione dei dati.","sentiment":"neutral"},{"textEn":"User rights and data retention policies remain consistent with the previous version.","textIt":"I diritti degli utenti e le politiche di conservazione dei dati rimangono coerenti con la versione precedente.","sentiment":"neutral"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"TikTok's joint controller arrangements and reliance on SCCs for transfers require careful oversight for EU businesses. Compliance with GDPR and potential AI Act implications are ongoing.","complianceNoteEn":"GDPR Articles 26, 46"},{"region":"EU","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"The policy's extensive data collection and cross-border transfers remain a concern under GDPR. Users retain rights to access, delete, and object to processing.","complianceNoteEn":"GDPR Articles 13, 14, 44"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises using TikTok must navigate complex international data transfer regulations and ensure compliance across diverse jurisdictions. Data security measures are paramount.","complianceNoteEn":"International Data Transfers"},{"region":"Global","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"Users worldwide face extensive data collection and cross-border transfers, with varying levels of legal protection. Privacy settings are crucial for managing personal data exposure.","complianceNoteEn":"Global Privacy Standards"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses integrating with TikTok must ensure their data handling aligns with US state privacy laws. Third-party sharing practices require due diligence.","complianceNoteEn":"State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"Broad data collection and sharing practices may raise concerns under CCPA/CPRA. Users have rights to know, delete, and opt-out of sales/sharing.","complianceNoteEn":"CCPA/CPRA Rights"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiContentModeration","label":"Content moderation","value":"Partial"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Policy source still match the recorded public snapshot version 4?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/d20a661b-f4d4-4442-a4a1-1d8a5ddcb491","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"85d8c3b627c4d82ac5cb9cb0f9d3e3c715d7ef4a959a7a9b43b393a0bb0d4849"}