{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"f3a9bab1-4c7c-4808-9c69-2da6963c3a5b","screeningDate":"2026-09-23T17:22:41.108Z","publicationGate":"published","company":{"id":"fc0a9a77-eb4b-432a-8229-00185c53d30e","name":"Klarna","slug":"klarna","industry":"FinTech"},"policy":{"id":"f0281764-cc55-4db9-b9ed-d6f6ab9811fb","name":"Terms of Service","type":"terms","jurisdiction":"EU","sourceUrl":"https://www.klarna.com/ie/terms-and-conditions/"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-09-23T17:22:41.102Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":3,"sha256":"1e277de0e157880e6d13433b99333f934123289d84ce44646b4a40ae2963ffcf","capturedAt":"2026-08-18T02:27:25.889Z"},"current":{"version":4,"sha256":"6aeed3d9f3d0278053b94f5616d6ae809e05d9925f46a94a81456d36d2c54854","capturedAt":"2026-09-23T17:22:41.104Z"}},"assessment":{"summary":"The updated Klarna Terms of Service include a minor clarification on cashback eligibility, but core data collection and AI personalization practices remain unchanged.","overallRisk":"Medium","overallScore":6,"previousPublicChange":{"id":"4c70bff8-3855-4820-99c0-60218f3c7375","overallRisk":"Medium","overallScore":5,"screeningDate":"2026-07-19T03:56:44.045Z"},"scoreDelta":1,"direction":"higher","reasons":[{"icon":"info","textEn":"Minor clarification on cashback account type, no significant privacy impact.","textIt":"Piccola precisazione sul tipo di conto per il cashback, nessun impatto significativo sulla privacy.","deltaScore":0,"evidenceQuote":"An active Klarna bank account is necessary to receive your earned cashback.","evidenceSide":"new","relatedKpi":null,"anchorStatus":"verified"},{"icon":"warning","textEn":"AI assistant retains user inferences indefinitely for personalization, raising data retention concerns.","textIt":"L'assistente AI conserva le inferenze utente a tempo indeterminato per la personalizzazione, sollevando preoccupazioni sulla conservazione dei dati.","deltaScore":-2,"evidenceQuote":"These inferences are retained in your memory profile for as long as you use the Service.","evidenceSide":"old","relatedKpi":"kpiDataRetention","anchorStatus":"verified"},{"icon":"warning","textEn":"Broad data sharing for autofill and third-party platforms is enabled by user agreement.","textIt":"L'ampia condivisione dei dati per l'autocompilazione e piattaforme terze è abilitata dall'accordo dell'utente.","deltaScore":-2,"evidenceQuote":"By accepting these Terms you agree that Klarna can divulge the fact that you are a customer of Klarna to stores and checkout solutions you shop with.","evidenceSide":"old","relatedKpi":"kpiThirdPartySharing","anchorStatus":"verified"}],"keyPoints":[{"textEn":"Klarna's AI assistant personalizes content and retains user inferences for as long as the service is used.","textIt":"L'assistente AI di Klarna personalizza i contenuti e conserva le inferenze utente per tutta la durata del servizio.","sentiment":"negative"},{"textEn":"Extensive autofill features use stored personal and payment information to simplify the shopping experience.","textIt":"Le ampie funzionalità di autocompilazione utilizzano informazioni personali e di pagamento memorizzate per semplificare lo shopping.","sentiment":"negative"},{"textEn":"Users can manage AI assistant memory, disable autofill, and delete saved payment details.","textIt":"Gli utenti possono gestire la memoria dell'assistente AI, disabilitare l'autocompilazione ed eliminare i dettagli di pagamento salvati.","sentiment":"positive"},{"textEn":"Cashback eligibility now explicitly requires an active Klarna bank account, a minor clarification.","textIt":"L'idoneità al cashback richiede ora esplicitamente un conto bancario Klarna attivo, una piccola precisazione.","sentiment":"neutral"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses using Klarna must ensure their data processing aligns with GDPR, especially concerning broad data sharing and AI-driven profiling. The AI Act may introduce further compliance requirements for AI systems.","complianceNoteEn":"GDPR Art. 28, AI Act"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Extensive data collection and AI personalization raise GDPR concerns regarding data minimization and purpose limitation. Users have rights to deletion and opt-out, but indefinite retention of AI inferences is notable.","complianceNoteEn":"GDPR Art. 5, 17"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises must navigate diverse international data protection regulations when using Klarna's services. Ensuring robust data governance and transparent AI practices is essential for global compliance and trust.","complianceNoteEn":"Cross-border Data Laws"},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The policy's broad data collection and AI personalization practices require users to actively manage their privacy settings. The ability to opt-out and delete data offers some control, but vigilance is needed.","complianceNoteEn":"Global Privacy Norms"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Companies integrating Klarna must manage data flows in compliance with various state privacy laws. Transparency regarding data use and sharing, especially with AI, is crucial to mitigate legal risks.","complianceNoteEn":"State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Users benefit from opt-out options for data sharing and AI personalization, aligning with CCPA/CPRA rights. However, the extensive data collection for autofill and AI still requires careful review.","complianceNoteEn":"CCPA/CPRA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Transparent"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Partial"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Transparent"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"},{"field":"kpiContentModeration","label":"Content moderation","value":"Transparent"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Implicit"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Mentioned"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Terms of Service source still match the recorded public snapshot version 4?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/f3a9bab1-4c7c-4808-9c69-2da6963c3a5b","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"6e78a79ed6ce1b9fdf405da56d48d9eeafeafafe3f17b873f2f166ec767f504b"}