{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.1.0","mappingVersion":"2026-07-29.1","changeId":"fd21e168-2c42-42df-bbfa-460fb195c71a","screeningDate":"2026-10-18T07:42:57.206Z","publicationGate":"published","company":{"id":"3e20dca5-ce3f-4e7e-930c-7aa4753a789d","name":"Google","slug":"google","industry":"Tech Giant"},"policy":{"id":"11539eab-9c04-4d21-8496-ac21de3bc7e2","name":"Privacy Policy","type":"privacy","jurisdiction":"US","sourceUrl":"https://policies.google.com/privacy"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-10-22T11:38:42.436Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":4,"sha256":"db08325ace1e8979a4ff707d93b4f53a581848d15b0ddb5ce57d5f26c4150293","capturedAt":"2026-10-14T03:41:43.646Z"},"current":{"version":5,"sha256":"563fbdb6e85d5f4ae9a7cb859f6144daf2d9baecc0f1b5a4b40138ea210da578","capturedAt":"2026-10-18T07:42:57.190Z"}},"analysisLineage":{"status":"verified","requestSha256":"d035f7ee9437f59952ee5f3f9e3a6ffd3cd97748aa14a05fd0d4ebecd543d54b","responseSha256":"8706c85055aab15a19cd8a7ed8af84e83079091461c1de3babe7a8e9b0d406d1","model":"gemini-2.5-flash","promptVersion":"policy-analysis.v3-full-document","schemaVersion":"policy-analysis.schema.v2","inputCoverage":"complete","semanticCoverage":"not_measured","documents":{"old":{"sha256":"db08325ace1e8979a4ff707d93b4f53a581848d15b0ddb5ce57d5f26c4150293","charLength":103491,"byteLength":103883,"rangeUnit":"utf16-code-unit","includedRanges":[[0,103491]],"excludedRanges":[]},"new":{"sha256":"563fbdb6e85d5f4ae9a7cb859f6144daf2d9baecc0f1b5a4b40138ea210da578","charLength":104542,"byteLength":104934,"rangeUnit":"utf16-code-unit","includedRanges":[[0,104542]],"excludedRanges":[]}},"boundary":"Hash verification links retained inputs and the application SDK request. It does not prove provider execution, semantic completeness or legal correctness."},"captureLineage":{"old":{"provenance":"unknown","sourceUrl":null,"requestedUrl":null,"finalUrl":null,"capturedAt":"2026-10-14T03:41:43.646Z","urlDisclosure":"credentials-query-fragment-redacted"},"current":{"provenance":"captured","sourceUrl":"https://policies.google.com/privacy","requestedUrl":"https://policies.google.com/privacy","finalUrl":"https://policies.google.com/privacy","capturedAt":"2026-10-18T07:42:57.190Z","urlDisclosure":"credentials-query-fragment-redacted"}},"assessment":{"summary":"Google's updated policy now allows your data from Gmail, Drive, and Photos to be used for personalized ads if you opt-in, a major shift from previous exclusions.","overallRisk":"High","overallScore":8,"previousPublicChange":{"id":"1baf2615-ab0f-4173-9dd9-d540c02b8bce","overallRisk":"High","overallScore":7,"screeningDate":"2026-10-14T03:41:43.653Z"},"scoreDelta":1,"direction":"higher","reasons":[{"icon":"alert","textEn":"Expanded internal data use for personalized ads from sensitive services.","textIt":"Uso interno esteso dei dati per annunci personalizzati da servizi sensibili.","deltaScore":3,"evidenceQuote":"We don’t show you personalized ads based on your content from Drive, Gmail, or Google Photos, unless you choose to make data from these services available to other Google services that support personalized ads.","evidenceSide":"new","relatedKpi":"kpiThirdPartySharing","anchorStatus":"verified"},{"icon":"warning","textEn":"AI services like Gemini Apps can now access data from private services for personalization.","textIt":"I servizi AI come Gemini Apps possono ora accedere ai dati dei servizi privati per la personalizzazione.","deltaScore":2,"evidenceQuote":"You may choose to allow certain Google services, including services like Search or Gemini Apps, to access data from other Google services you use, such as Google Photos and Workspace apps like Gmail and Drive, in order to provide you with a","evidenceSide":"new","relatedKpi":"kpiAiTrainingOptOut","anchorStatus":"verified"},{"icon":"info","textEn":"Users must actively manage new settings to prevent broader data use for ads.","textIt":"Gli utenti devono gestire attivamente le nuove impostazioni per prevenire un uso più ampio dei dati per gli annunci.","deltaScore":1,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiConsentMechanism","anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"Google now allows data from Gmail, Drive, and Photos to be used by other Google services for personalization.","textIt":"Google consente ora l'uso dei dati di Gmail, Drive e Foto da parte di altri servizi Google per la personalizzazione.","sentiment":"negative"},{"textEn":"This expanded data use includes content from these services for personalized advertising, if you opt-in.","textIt":"Questo uso esteso dei dati include i contenuti di questi servizi per la pubblicità personalizzata, se si acconsente.","sentiment":"negative"},{"textEn":"AI services like Gemini Apps are explicitly mentioned as potential recipients of this cross-service data.","textIt":"Servizi AI come Gemini Apps sono esplicitamente menzionati come potenziali destinatari di questi dati tra servizi.","sentiment":"negative"},{"textEn":"Users must actively manage new privacy settings to control this broader data usage.","textIt":"Gli utenti devono gestire attivamente le nuove impostazioni sulla privacy per controllare questo uso più ampio dei dati.","sentiment":"neutral"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises using Google Workspace must assess how this new data sharing impacts their data processing agreements and compliance with GDPR. They need to ensure employee data remains protected and that internal policies align with Google's updated terms.","complianceNoteEn":"GDPR Data Processing"},{"region":"EU","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"This change increases privacy risk for EU individuals as it allows more personal data, including from private services, to be used for personalized ads. GDPR requires explicit consent for such processing, and the 'unless you choose' clause must ensure clear, informed opt-in.","complianceNoteEn":"GDPR Consent Requirements"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises must re-evaluate their data protection frameworks and vendor agreements with Google. Ensuring compliance across diverse regulatory landscapes, especially concerning employee and customer data, becomes more complex with expanded internal data sharing.","complianceNoteEn":"Data Governance Frameworks"},{"region":"Global","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"Globally, individuals face a reduction in expected privacy as Google now allows data from private services to be used for personalized ads. While requiring user choice, this change broadens the scope of data exploitation for commercial purposes.","complianceNoteEn":"Global Privacy Standards"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"US enterprises must review their internal privacy policies and data governance strategies to ensure they account for Google's expanded data use. This is particularly relevant for employee data and compliance with state-specific privacy laws.","complianceNoteEn":"State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"US individuals face increased risk as more personal data can be used for targeted advertising, even with an opt-in. While CCPA/CPRA offer opt-out rights for sharing for cross-context behavioral advertising, the default settings and clarity of choice are crucial.","complianceNoteEn":"CCPA/CPRA Opt-Out Rights"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiContentModeration","label":"Content moderation","value":"Partial"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Explicit Opt-In"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Policy source still match the recorded public snapshot version 5?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/fd21e168-2c42-42df-bbfa-460fb195c71a","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"cab8f93b9b2d81d43389dc6f9eaeb83174c2100dfc5d3e71370d38a29d2b5c31"}