{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.1.0","mappingVersion":"2026-07-29.1","changeId":"f18cd619-6b84-4c05-9a23-fa7d685d2fc1","screeningDate":"2026-10-22T11:42:18.906Z","publicationGate":"published","company":{"id":"83da1ad9-8891-4372-a9db-bdf82c894d2a","name":"Anthropic","slug":"anthropic","industry":"Tech Giant"},"policy":{"id":"5afd72ff-64d7-411d-823e-3573e2901762","name":"Non-User Privacy Policy","type":"privacy","jurisdiction":"Global","sourceUrl":"https://www.anthropic.com/legal/non-user-privacy-policy"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-10-22T11:42:18.898Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":1,"sha256":"19066135fd31fdae102e079aea2de9ec2e68b32fced9be9f20f06dd2ae78b9ee","capturedAt":"2026-10-02T04:55:23.769Z"},"current":{"version":2,"sha256":"5280b5dd650aa5d07a2b0923b2277b10ae988cf6144542e5012b0d99f9f03ee7","capturedAt":"2026-10-22T11:42:18.898Z"}},"analysisLineage":{"status":"verified","requestSha256":"2fa0292167b9ecc918834ec50fc7178ecadae6280e7e85fc054e9ab6a524f6f0","responseSha256":"8e49a7709051a71cafe49d6acd5d96609bc057f030f2980432d355ed005df3f5","model":"gemini-3.5-flash-lite","promptVersion":"policy-analysis.v3-full-document","schemaVersion":"policy-analysis.schema.v2","inputCoverage":"complete","semanticCoverage":"not_measured","documents":{"old":{"sha256":"19066135fd31fdae102e079aea2de9ec2e68b32fced9be9f20f06dd2ae78b9ee","charLength":20397,"byteLength":20481,"rangeUnit":"utf16-code-unit","includedRanges":[[0,20397]],"excludedRanges":[]},"new":{"sha256":"5280b5dd650aa5d07a2b0923b2277b10ae988cf6144542e5012b0d99f9f03ee7","charLength":20375,"byteLength":20459,"rangeUnit":"utf16-code-unit","includedRanges":[[0,20375]],"excludedRanges":[]}},"boundary":"Hash verification links retained inputs and the application SDK request. It does not prove provider execution, semantic completeness or legal correctness."},"captureLineage":{"old":{"provenance":"unknown","sourceUrl":null,"requestedUrl":null,"finalUrl":null,"capturedAt":"2026-10-02T04:55:23.769Z","urlDisclosure":"credentials-query-fragment-redacted"},"current":{"provenance":"captured","sourceUrl":"https://www.anthropic.com/legal/non-user-privacy-policy","requestedUrl":"https://www.anthropic.com/legal/non-user-privacy-policy","finalUrl":"https://www.anthropic.com/legal/non-user-privacy-policy","capturedAt":"2026-10-22T11:42:18.898Z","urlDisclosure":"credentials-query-fragment-redacted"}},"assessment":{"summary":"Anthropic updated its non-user privacy policy with minor structural and formatting improvements while keeping AI training data practices intact.","overallRisk":"Medium","overallScore":5,"previousPublicChange":null,"scoreDelta":null,"direction":"baseline","reasons":[{"icon":"info","textEn":"Formatting and structural adjustments only with no core privacy alterations.","textIt":"Solo modifiche di formattazione e struttura senza alterazioni della privacy.","deltaScore":0,"evidenceQuote":"### Section 01: What Claude Is","evidenceSide":"new","relatedKpi":"kpiRegulatoryCompliance","anchorStatus":"verified"},{"icon":"warning","textEn":"Continued reliance on legitimate interest for web-scraped AI training data.","textIt":"Continuo affidamento sul legittimo interesse per i dati di addestramento web.","deltaScore":1,"evidenceQuote":"It is in our legitimate interests to train and improve our AI models.","evidenceSide":"new","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"alert","textEn":"Complexity and limits on deleting personal data processed for training.","textIt":"Complessità e limiti nella cancellazione dei dati personali elaborati.","deltaScore":1,"evidenceQuote":"the process by which we may need to action your requests regarding our training dataset are complex","evidenceSide":"new","relatedKpi":"kpiRightToDeletion","anchorStatus":"verified"}],"keyPoints":[{"textEn":"Formatting updates clarify section headers for non-users.","textIt":"Gli aggiornamenti di formattazione chiariscono le intestazioni.","sentiment":"neutral"},{"textEn":"Collection of public data via ClaudeBot continues as before.","textIt":"La raccolta di dati pubblici tramite ClaudeBot continua come prima.","sentiment":"neutral"},{"textEn":"Legal bases for processing remain grounded in legitimate interests.","textIt":"Le basi giuridiche per il trattamento rimangono i legittimi interessi.","sentiment":"neutral"},{"textEn":"Rights to object and access data for training remain complex to action.","textIt":"I diritti di opposizione e accesso ai dati rimangono complessi da attuare.","sentiment":"negative"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses must ensure compliance with EU AI Act transparency requirements and respect data provenance.","complianceNoteEn":"EU AI Act"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"EU residents retain robust data subject rights under GDPR, though exercising them against model training sets remains challenging.","complianceNoteEn":"GDPR Art 17-21"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global companies should implement standard contractual clauses for any cross-border data transfers.","complianceNoteEn":"SCCs"},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Global non-users have limited recourse outside of direct opt-out channels and robots.txt configurations.","complianceNoteEn":"Cross-Border"},{"region":"US","perspective":"Enterprise","riskLevel":"Low","impactAnalysisEn":"Enterprises should monitor evolving state regulations regarding scraped data and intellectual property.","complianceNoteEn":"CCPA / CPRA"},{"region":"US","perspective":"Individual","riskLevel":"Low","impactAnalysisEn":"US individuals rely heavily on state-level privacy laws since federal comprehensive legislation is absent.","complianceNoteEn":"State CPRA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Transparent"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Committed"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Committed"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Mentioned"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Transparent"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Committed"},{"field":"kpiContentModeration","label":"Content moderation","value":"Transparent"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Committed"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Mentioned"}]}]},"humanReviewQuestions":["Does the original Non-User Privacy Policy source still match the recorded public snapshot version 2?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/f18cd619-6b84-4c05-9a23-fa7d685d2fc1","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"1865fc3cb29d5841eff63b85c16d1aa888cd2d7fb3c1115c4c4924461d01f152"}