{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"e4f3732c-92f2-4a5d-a9b2-716fd9ebf183","screeningDate":"2026-10-01T19:55:28.950Z","publicationGate":"published","company":{"id":"c0caa75b-cc98-45c5-9b6b-198af2014025","name":"PayPal","slug":"paypal","industry":"FinTech"},"policy":{"id":"9e09108f-4041-4c64-8e16-88543e1b7e43","name":"Privacy Statement","type":"privacy","jurisdiction":"US","sourceUrl":"https://www.paypal.com/us/webapps/mpp/ua/privacy-full"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-10-01T19:55:28.939Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":8,"sha256":"20524cc00c4056093b9bfa5192fece3a1d4087a0b2aad844bbcd8bf6fe6f70f8","capturedAt":"2026-08-18T03:00:38.178Z"},"current":{"version":9,"sha256":"514f87b3a545a9dc2574a6a25f91556dd7e774bdedf318aba1e1be31a0473cba","capturedAt":"2026-10-01T19:55:28.943Z"}},"assessment":{"summary":"PayPal's updated policy broadens data collection from third-party payment sources for non-account holders and introduces new data use for 'PayPal World transactions'.","overallRisk":"High","overallScore":8,"previousPublicChange":{"id":"b163d841-2b1c-4d03-8b6e-3d80a7d4cb27","overallRisk":"Medium","overallScore":6,"screeningDate":"2026-08-18T03:00:38.185Z"},"scoreDelta":2,"direction":"higher","reasons":[{"icon":"alert","textEn":"Expanded third-party data collection for non-account holders.","textIt":"Raccolta dati estesa da terze parti per i non titolari di conto.","deltaScore":2,"evidenceQuote":"or when you receive a payment from a PayPal account holder (through the Visa+ service or other third party wallets, payment networks, and processors) or a payment from a payor using the Hyperwallet services.","evidenceSide":"new","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"alert","textEn":"New clause for 'PayPal World transactions' involving third-party data.","textIt":"Nuova clausola per 'transazioni PayPal World' con dati di terze parti.","deltaScore":2,"evidenceQuote":"We will use information from third parties, including third-party wallets, payment networks, and processors, to process PayPal World transactions.","evidenceSide":"new","relatedKpi":"kpiThirdPartySharing","anchorStatus":"verified"},{"icon":"warning","textEn":"Increased scope of third-party data sharing for payment processing.","textIt":"Ambito ampliato di condivisione dati con terze parti per l'elaborazione dei pagamenti.","deltaScore":1,"evidenceQuote":"We will use information from third parties, including third-party wallets, payment networks, and processors, to process PayPal World transactions.","evidenceSide":"new","relatedKpi":"kpiThirdPartySharing","anchorStatus":"verified"}],"keyPoints":[{"textEn":"PayPal now explicitly collects data from more third-party wallets and payment networks for non-account holders.","textIt":"PayPal raccoglie ora esplicitamente dati da più wallet e reti di pagamento di terze parti per i non titolari di conto.","sentiment":"negative"},{"textEn":"A new clause details the use of third-party information for 'PayPal World transactions'.","textIt":"Una nuova clausola descrive l'uso di informazioni di terze parti per le 'transazioni PayPal World'.","sentiment":"negative"},{"textEn":"The policy indicates an increased reliance on external payment processors for various transaction types.","textIt":"La politica indica una maggiore dipendenza da processori di pagamento esterni per vari tipi di transazioni.","sentiment":"negative"},{"textEn":"Users can still opt-out of AI model training for certain features.","textIt":"Gli utenti possono ancora disattivare l'addestramento dei modelli AI per alcune funzionalità.","sentiment":"positive"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"PayPal's broader data sharing with third parties for 'PayPal World transactions' increases the complexity of data processing agreements and compliance obligations under GDPR. Enterprises using PayPal must ensure their own data handling aligns with these expanded practices.","complianceNoteEn":"GDPR Article 28"},{"region":"EU","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"The expanded data collection and sharing with third parties, especially for non-account holders, raises concerns under GDPR regarding transparency and consent. Individuals may have less control over their data when processed by multiple external entities.","complianceNoteEn":"GDPR Articles 6, 13, 14"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises using PayPal must enhance their due diligence on third-party data processors and ensure robust data governance frameworks. The expanded data ecosystem necessitates a comprehensive approach to international data transfer and compliance.","complianceNoteEn":"Cross-Border Data Transfer"},{"region":"Global","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"Globally, individuals face increased exposure of their personal data to a wider network of third parties. This expansion of data sources and sharing partners can complicate exercising data rights and understanding the full scope of data processing.","complianceNoteEn":"Global Privacy Principles"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses integrating with PayPal's services, especially for 'PayPal World transactions,' need to assess their compliance with evolving US state privacy laws. The expanded data flows require careful vendor management and data mapping.","complianceNoteEn":"State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"The expanded collection from third-party wallets and networks could impact consumer privacy rights under state laws like CCPA/CPRA. Users might find it harder to track how their data is shared and used across various platforms.","complianceNoteEn":"CCPA/CPRA Right to Know"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Statement source still match the recorded public snapshot version 9?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/e4f3732c-92f2-4a5d-a9b2-716fd9ebf183","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"9cc1851f914b42ffc872f17eaacd792ceb7221e014acaa5e69df4bfdbec8122c"}