{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"13282507-aa4e-4157-b3bf-9ecb3c05a06d","screeningDate":"2026-07-19T03:54:19.229Z","publicationGate":"published","company":{"id":"abeee5e5-6930-4e28-995a-552c200bc853","name":"X (Twitter)","slug":"x-twitter","industry":"Social Media"},"policy":{"id":"73b56cdd-595f-4133-a517-b5fa94dc0c97","name":"Privacy Policy","type":"privacy","jurisdiction":"Global","sourceUrl":"https://x.com/en/privacy"},"sourceConfidence":{"state":"review-required","lastCheckedAt":"2026-07-06T03:59:34.662Z","retrievalChannel":"seeded","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":1,"sha256":"e69ef5b135340621d551a77065a52d8c91559e6a4cb3a8268f8e6fb491c28cac","capturedAt":"2026-07-06T07:20:25.162Z"},"current":{"version":2,"sha256":"1236fd7b51eb8a9a11c1df06078f86e64e57da47e4f1d4a4eba6589048f7430a","capturedAt":"2026-07-19T03:54:19.226Z"}},"assessment":{"summary":"X collects extensive personal data, including biometrics, and uses it for AI training, with an opt-out for some third-party sharing, posing high privacy risks.","overallRisk":"High","overallScore":8,"previousPublicChange":null,"scoreDelta":null,"direction":"baseline","reasons":[{"icon":"alert","textEn":"Collection of sensitive biometric data for security and identification purposes.","textIt":"Raccolta di dati biometrici sensibili per sicurezza e identificazione.","deltaScore":3,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"},{"icon":"warning","textEn":"User data, including public content, is used for X's own AI model training.","textIt":"I dati utente, inclusi i contenuti pubblici, sono usati per l'addestramento AI di X.","deltaScore":3,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"},{"icon":"warning","textEn":"Opt-out mechanism for third-party AI training, not an explicit opt-in.","textIt":"Meccanismo di opt-out per l'addestramento AI di terze parti, non opt-in esplicito.","deltaScore":2,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"X collects sensitive biometric information for security and identification purposes with user consent.","textIt":"X raccoglie informazioni biometriche sensibili per sicurezza e identificazione con il consenso dell'utente.","sentiment":"negative"},{"textEn":"User data, including public content, may be used by X to train its own machine learning and AI models.","textIt":"I dati degli utenti, inclusi i contenuti pubblici, possono essere usati da X per addestrare i propri modelli AI.","sentiment":"negative"},{"textEn":"Data can be shared with third-party collaborators for AI training, requiring users to opt-out.","textIt":"I dati possono essere condivisi con terze parti per l'addestramento AI, richiedendo agli utenti di disattivare l'opzione.","sentiment":"negative"},{"textEn":"The policy details extensive collection of usage, device, location, and inferred identity data.","textIt":"La policy descrive una vasta raccolta di dati di utilizzo, dispositivo, posizione e identità inferita.","sentiment":"negative"},{"textEn":"Much of your content and profile information is publicly viewable by default on the platform.","textIt":"Gran parte dei tuoi contenuti e informazioni del profilo sono visibili pubblicamente per impostazione predefinita.","sentiment":"neutral"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"High","impactAnalysisEn":"High risk for businesses using X for marketing or data analysis, due to broad data sharing practices and potential GDPR non-compliance for user data. AI Act compliance is critical for AI models trained with X data.","complianceNoteEn":"GDPR, AI Act"},{"region":"EU","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"High risk due to extensive data collection, biometric data processing, and AI training clauses. GDPR requires explicit consent for sensitive data and robust user rights, while the AI Act impacts data used in AI models.","complianceNoteEn":"GDPR Art. 9, AI Act"},{"region":"Global","perspective":"Enterprise","riskLevel":"High","impactAnalysisEn":"High risk. Companies using X data must navigate a complex landscape of diverse global privacy regulations and ensure their AI practices are ethical and compliant across jurisdictions.","complianceNoteEn":"Global Data Protection"},{"region":"Global","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"High risk. The extensive data collection, use of biometric data, and AI training practices raise general privacy concerns globally, especially regarding sensitive personal information and user control.","complianceNoteEn":"Global Privacy Principles"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Medium risk for businesses relying on X data. They must ensure their data processing and AI practices align with evolving state privacy laws like CCPA/CPRA and other sector-specific regulations.","complianceNoteEn":"CCPA/CPRA"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Medium risk. While CCPA/CPRA grant rights like opting out of data sale/sharing, the broad data collection, biometric data use, and AI training practices still raise significant privacy concerns for users.","complianceNoteEn":"CCPA/CPRA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Partial"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiContentModeration","label":"Content moderation","value":"Opaque"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Implicit"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Policy source still match the recorded public snapshot version 2?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/13282507-aa4e-4157-b3bf-9ecb3c05a06d","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"2da115e877310bd97e4fe5b5f40cdfdfe0aa721aee26820901ec7db3f39201e5"}