{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"2f0b054a-9ea4-45fc-bed4-8a5dda769caf","screeningDate":"2026-07-24T20:57:08.679Z","publicationGate":"published","company":{"id":"3e20dca5-ce3f-4e7e-930c-7aa4753a789d","name":"Google","slug":"google","industry":"Tech Giant"},"policy":{"id":"c287880a-4512-4dc0-a8bd-cdf7d4f33e15","name":"Privacy Policy","type":"privacy","jurisdiction":"Global","sourceUrl":"https://policies.google.com/privacy"},"sourceConfidence":{"state":"review-required","lastCheckedAt":"2026-07-06T03:59:34.659Z","retrievalChannel":"seeded","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":1,"sha256":"8a70bdc1fa80efce5dfbc4342c511a2f1f5cfd194fb1b7e48868da91ccd3d903","capturedAt":"2026-07-06T07:19:26.160Z"},"current":{"version":2,"sha256":"61d74aa5731363bb1caa708128349f2d4096a6b1ebbce23bf55268c71461a29a","capturedAt":"2026-07-24T20:57:08.674Z"}},"assessment":{"summary":"Google's Privacy Policy remains largely unchanged in content, with new table of contents entries suggesting future clarity on data transfers and partners.","overallRisk":"Medium","overallScore":6,"previousPublicChange":null,"scoreDelta":null,"direction":"baseline","reasons":[{"icon":"warning","textEn":"Broad data collection practices persist across various services and devices.","textIt":"Persistono ampie pratiche di raccolta dati su vari servizi e dispositivi.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"},{"icon":"warning","textEn":"Extensive data sharing with trusted partners for processing and advertising.","textIt":"Ampia condivisione dati con partner fidati per elaborazione e pubblicità.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"},{"icon":"info","textEn":"No explicit AI training opt-out or specific AI governance details provided.","textIt":"Nessun opt-out esplicito per l'addestramento AI o dettagli specifici sulla governance AI.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"Policy content provided is nearly identical to the old version, indicating no major immediate shifts in data practices.","textIt":"Il contenuto della policy fornito è quasi identico alla versione precedente, indicando nessuna modifica immediata nelle pratiche sui dati.","sentiment":"neutral"},{"textEn":"New table of contents entries hint at future details on data transfer frameworks and partner relationships.","textIt":"Nuove voci nell'indice suggeriscono futuri dettagli sui framework di trasferimento dati e relazioni con i partner.","sentiment":"neutral"},{"textEn":"Users retain existing privacy controls for activity, ads, and data deletion, as outlined in the previous policy.","textIt":"Gli utenti mantengono i controlli sulla privacy esistenti per attività, annunci e cancellazione dati, come nella policy precedente.","sentiment":"positive"},{"textEn":"Extensive data collection for personalization, service improvement, and advertising continues to be a core practice.","textIt":"L'ampia raccolta dati per personalizzazione, miglioramento servizi e pubblicità continua ad essere una pratica centrale.","sentiment":"negative"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises using Google services must ensure their own compliance, especially regarding data transfers. The new 'Data transfer frameworks' section in the TOC suggests future clarity on mechanisms like SCCs, relevant for GDPR compliance.","complianceNoteEn":"GDPR Art. 44-49"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The policy maintains existing data collection for personalization, which can raise concerns under GDPR's data minimization principles. Users retain rights to access and delete data, aligning with GDPR Articles 15-17.","complianceNoteEn":"GDPR Art. 5, 15-17"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises operating globally must consider the policy's implications for cross-border data flows and partner agreements. The new TOC entries suggest Google is preparing to address these complexities more explicitly.","complianceNoteEn":"International Data Transfers"},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The policy offers global controls for managing personal data and activity, providing a baseline for user privacy. However, the broad scope of data collection and processing requires users to actively manage their settings.","complianceNoteEn":"Global Privacy Standards"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses integrating Google services should review data sharing clauses, especially with partners, to ensure compliance with state-specific privacy laws. The policy's general nature requires careful due diligence.","complianceNoteEn":"State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Users benefit from explicit rights to access and delete data, aligning with CCPA/CPRA. However, extensive data collection and sharing for advertising purposes remain a key aspect of the policy.","complianceNoteEn":"CCPA/CPRA Rights"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Partial"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiContentModeration","label":"Content moderation","value":"Opaque"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Policy source still match the recorded public snapshot version 2?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/2f0b054a-9ea4-45fc-bed4-8a5dda769caf","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"b9d163b7189d90df24aa3a102439d4b2edda8c32accfdfbef09575514a97e641"}