{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"ff3b694b-c127-40a7-ad9a-147c054b1221","screeningDate":"2026-07-10T01:46:35.696Z","publicationGate":"published","company":{"id":"c0caa75b-cc98-45c5-9b6b-198af2014025","name":"PayPal","slug":"paypal","industry":"FinTech"},"policy":{"id":"c28fb784-5012-4696-8c70-505d4185972a","name":"Privacy Statement","type":"privacy","jurisdiction":"EU","sourceUrl":"https://www.paypal.com/lu/webapps/mpp/ua/privacy-full"},"sourceConfidence":{"state":"review-required","lastCheckedAt":"2026-07-06T03:59:34.660Z","retrievalChannel":"seeded","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":2,"sha256":"168f01646ad727bfb22632a07b38d4213b1e7ace135386ba18deefa502a85984","capturedAt":"2026-07-07T02:33:58.231Z"},"current":{"version":3,"sha256":"320239c1eb5644bef52632ccf2177de89fd5c2d82de78bab34f0b8c193a41ec7","capturedAt":"2026-07-10T01:46:35.687Z"}},"assessment":{"summary":"PayPal collects extensive personal and sensitive data, including biometrics, for services, fraud, and AI training, sharing it broadly with third parties.","overallRisk":"High","overallScore":7,"previousPublicChange":{"id":"858f0ed6-c3a6-4084-a5eb-e7ff9ba238e6","overallRisk":"High","overallScore":8,"screeningDate":"2026-07-07T02:33:58.239Z"},"scoreDelta":-1,"direction":"lower","reasons":[{"icon":"warning","textEn":"Extensive collection of sensitive and biometric data.","textIt":"Ampia raccolta di dati sensibili e biometrici.","deltaScore":2,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"},{"icon":"warning","textEn":"Personal data used for AI training and automated decisions.","textIt":"Dati personali usati per addestramento AI e decisioni automatizzate.","deltaScore":2,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"},{"icon":"warning","textEn":"Broad sharing with many third parties and authorities.","textIt":"Ampia condivisione con terze parti e autorità.","deltaScore":1,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"Extensive data collection: Biometric, precise geolocation, and sensitive financial data are collected.","textIt":"Ampia raccolta dati: Vengono raccolti dati biometrici, geolocalizzazione precisa e dati finanziari sensibili.","sentiment":"negative"},{"textEn":"AI model training: Personal data is used to train AI models and for automated decisions.","textIt":"Addestramento modelli AI: I dati personali sono usati per addestrare modelli AI e per decisioni automatizzate.","sentiment":"negative"},{"textEn":"Broad data sharing: Information is shared with many third parties, including authorities.","textIt":"Ampia condivisione dati: Le informazioni sono condivise con molte terze parti, incluse le autorità.","sentiment":"negative"},{"textEn":"Consent for sensitive data: Biometric and precise geolocation data require user consent.","textIt":"Consenso per dati sensibili: Dati biometrici e di geolocalizzazione precisa richiedono il consenso dell'utente.","sentiment":"positive"},{"textEn":"No clear AI opt-out: Policy lacks explicit options to opt-out of AI training data use.","textIt":"Nessun opt-out AI chiaro: La policy non offre opzioni esplicite per l'opt-out dall'uso dei dati per l'AI.","sentiment":"negative"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises using PayPal must ensure their own compliance aligns with PayPal's broad data practices, especially concerning data transfers and AI governance. The AI Act and DORA may introduce further obligations for financial services.","complianceNoteEn":"GDPR, AI Act, DORA"},{"region":"EU","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"Extensive data collection, broad sharing, and AI use without explicit opt-out for training pose a high risk under GDPR. Users should be aware of their rights regarding sensitive data and automated decision-making.","complianceNoteEn":"GDPR Articles 5, 9, 22"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises must assess PayPal's policy against diverse international data protection laws and their internal policies. Ensuring robust data governance and vendor management is crucial for mitigating compliance risks.","complianceNoteEn":"International Data Laws"},{"region":"Global","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"The extensive collection of personal and sensitive data, coupled with AI training and broad sharing, presents a high global privacy risk. Users worldwide should actively manage their consent and privacy settings.","complianceNoteEn":"Global Privacy Standards"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses integrating with PayPal should review its data handling practices to ensure alignment with their own compliance obligations. This includes adherence to state-specific privacy laws and financial regulations.","complianceNoteEn":"State Privacy Laws, GLBA"},{"region":"US","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"Broad data collection, including sensitive and biometric data, and AI use raise concerns under US state privacy laws. Users have rights to opt-out of data sharing and limit sensitive data use under CCPA/CPRA.","complianceNoteEn":"CCPA/CPRA, BIPA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Partial"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Statement source still match the recorded public snapshot version 3?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/ff3b694b-c127-40a7-ad9a-147c054b1221","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"7f7d8ca7409df47f005902563789c892b7d1ca9ea7484dbaafa7ccf295310817"}