{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"f21e62b7-844f-464b-8f11-871c42b3c506","screeningDate":"2026-10-09T02:46:51.974Z","publicationGate":"published","company":{"id":"c0caa75b-cc98-45c5-9b6b-198af2014025","name":"PayPal","slug":"paypal","industry":"FinTech"},"policy":{"id":"c28fb784-5012-4696-8c70-505d4185972a","name":"Privacy Statement","type":"privacy","jurisdiction":"EU","sourceUrl":"https://www.paypal.com/lu/webapps/mpp/ua/privacy-full"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-10-09T02:46:51.958Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":9,"sha256":"5d1465082e494d6c0da8ed291548622a699a561e95bde61e1ccd30ecd490deff","capturedAt":"2026-10-01T19:55:02.546Z"},"current":{"version":10,"sha256":"1883abf1abba82e38280f0f2c62ab83be76a12e93e2c85b319f9c069b557a364","capturedAt":"2026-10-09T02:46:51.964Z"}},"assessment":{"summary":"PayPal collects extensive personal and sensitive data, uses it for AI training and automated decisions, and shares it broadly with third parties.","overallRisk":"High","overallScore":7,"previousPublicChange":{"id":"3a1a0bf1-d724-415b-91bb-85c94f929d1e","overallRisk":"High","overallScore":7,"screeningDate":"2026-10-01T19:55:02.556Z"},"scoreDelta":0,"direction":"unchanged","reasons":[{"icon":"warning","textEn":"Extensive collection of biometric data for authentication.","textIt":"Ampia raccolta di dati biometrici per l'autenticazione.","deltaScore":0,"evidenceQuote":"Biometric data: Such as voice identification, photo identification, or face scans, which we may collect when you consent in the user experience to authenticate you for certain actions related to your account","evidenceSide":"old","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"alert","textEn":"Personal data used for AI model training without explicit opt-out.","textIt":"Dati personali usati per l'addestramento AI senza opt-out esplicito.","deltaScore":0,"evidenceQuote":"We may use Personal Information to train our artificial intelligence (AI) models that power our Services","evidenceSide":"old","relatedKpi":"kpiAiTrainingOptOut","anchorStatus":"verified"},{"icon":"warning","textEn":"Broad sharing of personal information with many third parties.","textIt":"Ampia condivisione di informazioni personali con terze parti.","deltaScore":0,"evidenceQuote":"We disclose your Personal Information with service providers and third parties, including those participating in the payment network, to help us provide Services, protect our customers from risk and fraud, market our products, and comply wi","evidenceSide":"old","relatedKpi":"kpiThirdPartySharing","anchorStatus":"verified"}],"keyPoints":[{"textEn":"PayPal collects extensive personal data, including sensitive biometric and financial details.","textIt":"PayPal raccoglie ampi dati personali, inclusi dettagli biometrici e finanziari sensibili.","sentiment":"negative"},{"textEn":"Your data trains AI models and is used for automated decisions like fraud prevention.","textIt":"I tuoi dati addestrano modelli AI e sono usati per decisioni automatizzate (es. prevenzione frodi).","sentiment":"negative"},{"textEn":"Information is shared broadly with service providers, affiliates, and authorities.","textIt":"Le informazioni sono ampiamente condivise con fornitori, affiliati e autorità.","sentiment":"negative"},{"textEn":"Precise geolocation data is collected with consent for financial services and security.","textIt":"Dati di geolocalizzazione precisa sono raccolti con consenso per servizi finanziari e sicurezza.","sentiment":"negative"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises using PayPal must ensure their data processing agreements align with GDPR requirements, especially regarding third-party sharing and AI data use. Due diligence is crucial for compliance.","complianceNoteEn":"GDPR Articles 28, 32"},{"region":"EU","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"Extensive data collection, AI training, and automated decision-making raise high concerns under GDPR. The lack of explicit opt-out for AI training is a significant privacy risk.","complianceNoteEn":"GDPR Articles 5, 6, 9, 22"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises must navigate varying data protection laws when using PayPal, especially concerning cross-border data transfers and AI governance. Robust internal policies are essential.","complianceNoteEn":"Cross-border data transfer rules"},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The extensive data collection and use for AI training without clear opt-out mechanisms pose global privacy risks. Users should be vigilant about their data rights across jurisdictions.","complianceNoteEn":"Global Privacy Principles"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses integrating PayPal must assess how PayPal's data practices impact their own compliance with US state privacy laws. Managing shared data and consent flows is key.","complianceNoteEn":"CCPA/CPRA, VCDPA, CPA"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Broad collection of personal and sensitive data, including biometrics, raises concerns under state privacy laws like CCPA/CPRA. Users have rights to know, delete, and opt-out of sales/sharing.","complianceNoteEn":"CCPA/CPRA, VCDPA, CPA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Partial"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Statement source still match the recorded public snapshot version 10?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/f21e62b7-844f-464b-8f11-871c42b3c506","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"3f552a608b7d21d2eb8be154a4a6980f6d9717e9a29a7daa5898760190a89c03"}