{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.1.0","mappingVersion":"2026-07-29.1","changeId":"ddb0b72a-2ef2-40b6-914a-29c04fcf6a9c","screeningDate":"2026-11-05T18:39:42.546Z","publicationGate":"published","company":{"id":"c0caa75b-cc98-45c5-9b6b-198af2014025","name":"PayPal","slug":"paypal","industry":"FinTech"},"policy":{"id":"b1c25854-aa4d-44bb-8c48-9009cf8a9d6a","name":"User Agreement","type":"terms","jurisdiction":"US","sourceUrl":"https://www.paypal.com/us/legalhub/paypal/useragreement-full"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-11-05T18:39:42.528Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":2,"sha256":"ddd4bfc008e4bbfae36517a15cd6539326e349a05cb709da7817c213d8eeaf1a","capturedAt":"2026-09-24T16:39:09.474Z"},"current":{"version":3,"sha256":"13406b96a49e25da9601ac934d8367ae34f44b887e8c988aa647c2e04f83cb38","capturedAt":"2026-11-05T18:39:42.528Z"}},"analysisLineage":{"status":"verified","requestSha256":"fb84d68a700f8c17fc922b2aa04cd698fd02db56e6066fea1edada35dd4927d6","responseSha256":"d4d005a76cab52e5abe552abc5caae54668f4f1af1a9f622f092e8d7fb1b46e9","model":"gemini-2.5-flash","promptVersion":"policy-analysis.v3-full-document","schemaVersion":"policy-analysis.schema.v2","inputCoverage":"complete","semanticCoverage":"not_measured","documents":{"old":{"sha256":"ddd4bfc008e4bbfae36517a15cd6539326e349a05cb709da7817c213d8eeaf1a","charLength":188157,"byteLength":188420,"rangeUnit":"utf16-code-unit","includedRanges":[[0,188157]],"excludedRanges":[]},"new":{"sha256":"13406b96a49e25da9601ac934d8367ae34f44b887e8c988aa647c2e04f83cb38","charLength":188319,"byteLength":188582,"rangeUnit":"utf16-code-unit","includedRanges":[[0,188319]],"excludedRanges":[]}},"boundary":"Hash verification links retained inputs and the application SDK request. It does not prove provider execution, semantic completeness or legal correctness."},"captureLineage":{"old":{"provenance":"unknown","sourceUrl":null,"requestedUrl":null,"finalUrl":null,"capturedAt":"2026-09-24T16:39:09.474Z","urlDisclosure":"credentials-query-fragment-redacted"},"current":{"provenance":"captured","sourceUrl":"https://www.paypal.com/us/legalhub/paypal/useragreement-full","requestedUrl":"https://www.paypal.com/us/legalhub/paypal/useragreement-full","finalUrl":"https://www.paypal.com/us/legalhub/paypal/useragreement-full","capturedAt":"2026-11-05T18:39:42.528Z","urlDisclosure":"credentials-query-fragment-redacted"}},"assessment":{"summary":"PayPal's updated User Agreement expands prohibited activities to include more types of false information, increasing user responsibility for data accuracy.","overallRisk":"Medium","overallScore":6,"previousPublicChange":{"id":"9c8fbee4-be50-4b08-9134-255d00b28cd0","overallRisk":"High","overallScore":8,"screeningDate":"2026-09-24T16:39:09.487Z"},"scoreDelta":-2,"direction":"lower","reasons":[{"icon":"warning","textEn":"Expanded definition of \"misleading information\" increases user liability.","textIt":"La definizione estesa di \"informazioni fuorvianti\" aumenta la responsabilità dell'utente.","deltaScore":-2,"evidenceQuote":"Provide false, inaccurate or misleading information regarding your identity, account or business, goods or services offered or purchased, transaction details, or other information related to your use of our services;","evidenceSide":"new","relatedKpi":"kpiRegulatoryCompliance","anchorStatus":"verified"},{"icon":"warning","textEn":"Broader grounds for PayPal to impose account limitations or suspensions.","textIt":"Motivi più ampi per PayPal per imporre limitazioni o sospensioni dell'account.","deltaScore":-1,"evidenceQuote":"If we believe that you’ve engaged in any of these activities, we may take a number of actions to protect PayPal, its customers and others at any time in our sole discretion.","evidenceSide":"new","relatedKpi":"kpiAutomatedDecision","anchorStatus":"verified"},{"icon":"warning","textEn":"Users must be more diligent in providing accurate and complete information.","textIt":"Gli utenti devono essere più diligenti nel fornire informazioni accurate e complete.","deltaScore":-1,"evidenceQuote":"Provide false, inaccurate or misleading information regarding your identity, account or business, goods or services offered or purchased, transaction details, or other information related to your use of our services;","evidenceSide":"new","relatedKpi":"kpiDataCollection","anchorStatus":"verified"}],"keyPoints":[{"textEn":"PayPal now explicitly prohibits providing false information about identity, business, goods, or transaction details.","textIt":"PayPal ora proibisce esplicitamente di fornire informazioni false su identità, attività, beni o dettagli delle transazioni.","sentiment":"negative"},{"textEn":"This broadens PayPal's ability to impose account limitations or suspensions based on user-provided data.","textIt":"Ciò amplia la capacità di PayPal di imporre limitazioni o sospensioni dell'account basate sui dati forniti dall'utente.","sentiment":"negative"},{"textEn":"Users must ensure all account and transaction-related information is accurate to avoid potential penalties.","textIt":"Gli utenti devono assicurarsi che tutte le informazioni relative all'account e alle transazioni siano accurate per evitare potenziali sanzioni.","sentiment":"neutral"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Low","impactAnalysisEn":"As a U.S.-specific policy, direct impact on EU enterprises is minimal. Indirectly, it highlights a global trend towards stricter data integrity requirements.","complianceNoteEn":"GDPR Art. 5(1)(d)"},{"region":"EU","perspective":"Individual","riskLevel":"Low","impactAnalysisEn":"This policy is explicitly for U.S. PayPal accounts, so it does not directly impact EU individuals. However, the emphasis on data accuracy aligns with GDPR principles.","complianceNoteEn":"GDPR Art. 5(1)(d)"},{"region":"Global","perspective":"Enterprise","riskLevel":"Low","impactAnalysisEn":"Global businesses operating with U.S. PayPal accounts must adhere to these stricter data accuracy standards, potentially influencing internal data governance policies across regions.","complianceNoteEn":"Cross-border Operations"},{"region":"Global","perspective":"Individual","riskLevel":"Low","impactAnalysisEn":"While specific to the U.S., this update reflects a general tightening of terms around data accuracy in financial services globally. Users worldwide should anticipate similar trends.","complianceNoteEn":"Global Data Integrity"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses must ensure all identity, account, and transaction information is meticulously accurate to avoid potential penalties and service disruptions. This expands compliance obligations.","complianceNoteEn":"Business Compliance"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Individuals now face broader grounds for account limitations if any information provided, including transaction details, is deemed false or misleading. This increases user responsibility.","complianceNoteEn":"Consumer Protection"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Partial"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiContentModeration","label":"Content moderation","value":"Opaque"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Implicit"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original User Agreement source still match the recorded public snapshot version 3?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/ddb0b72a-2ef2-40b6-914a-29c04fcf6a9c","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"c4d88ac7ed7e455bf0385e61250e7f656283c7a712eebc4216c76c392d6ecd3e"}