{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"36648bad-1292-4f57-8b69-47df3f84c652","screeningDate":"2026-08-06T03:51:47.292Z","publicationGate":"published","company":{"id":"c0caa75b-cc98-45c5-9b6b-198af2014025","name":"PayPal","slug":"paypal","industry":"FinTech"},"policy":{"id":"dc8f08a1-4c7e-4b31-a1cd-c3f8597c965a","name":"User Agreement","type":"terms","jurisdiction":"EU","sourceUrl":"https://www.paypal.com/lu/legalhub/paypal/useragreement-full"},"sourceConfidence":{"state":"review-required","lastCheckedAt":"2026-07-06T03:59:34.661Z","retrievalChannel":"seeded","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":6,"sha256":"3e217da9e7ae7a1db9b349adc236cadeadd301a3ed9218ab56117447e2280894","capturedAt":"2026-08-02T12:50:57.172Z"},"current":{"version":7,"sha256":"dcc651853121f39a69abe965fdc1aa7b74abee98a7ce2a4a039a11821a93bea1","capturedAt":"2026-08-06T03:51:47.284Z"}},"assessment":{"summary":"No changes were found in the PayPal User Agreement; the policy continues to govern payment services for EEA residents with standard terms.","overallRisk":"Medium","overallScore":6,"previousPublicChange":{"id":"f14dc990-fe46-4292-9702-48471a26ad97","overallRisk":"Medium","overallScore":4,"screeningDate":"2026-08-02T12:50:57.183Z"},"scoreDelta":2,"direction":"higher","reasons":[{"icon":"warning","textEn":"PayPal can close accounts with 2 months' notice or immediately for breaches.","textIt":"PayPal può chiudere gli account con 2 mesi di preavviso o subito per violazioni.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiRightToDeletion","anchorStatus":"not-recorded"},{"icon":"alert","textEn":"Users are fully liable for actions of third parties granted account access.","textIt":"Gli utenti sono pienamente responsabili per le azioni di terzi con accesso all'account.","deltaScore":0,"evidenceQuote":"You are liable to us for the actions that you authorise the third parties to carry out.","evidenceSide":"old","relatedKpi":"kpiThirdPartySharing","anchorStatus":"verified"},{"icon":"info","textEn":"Electronic money does not earn interest and lacks deposit protection.","textIt":"La moneta elettronica non genera interessi e non ha protezione dei depositi.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiRegulatoryCompliance","anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"No changes detected between the old and new policy versions.","textIt":"Nessuna modifica rilevata tra le vecchie e nuove versioni della politica.","sentiment":"neutral"},{"textEn":"PayPal operates as a bank in Luxembourg, supervised by the CSSF.","textIt":"PayPal opera come banca in Lussemburgo, supervisionata dalla CSSF.","sentiment":"neutral"},{"textEn":"Users are liable for actions of third parties granted account access.","textIt":"Gli utenti sono responsabili per le azioni di terzi con accesso all'account.","sentiment":"negative"},{"textEn":"Electronic money held in accounts does not earn interest and is not deposit-protected.","textIt":"La moneta elettronica non genera interessi e non è protetta da garanzia sui depositi.","sentiment":"negative"},{"textEn":"PayPal can close accounts with two months' notice or immediately for breaches.","textIt":"PayPal può chiudere gli account con due mesi di preavviso o subito per violazioni.","sentiment":"negative"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Low","impactAnalysisEn":"Businesses operating in the EEA benefit from a regulated payment service provider. They must ensure compliance with Commercial Entity Agreements if transaction thresholds are met.","complianceNoteEn":"PSD2, GDPR"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The policy, being for EEA residents and supervised by Luxembourg's CSSF, aligns with EU financial regulations. However, the lack of interest and deposit protection for e-money is a key point for users.","complianceNoteEn":"PSD2, E-Money Directive"},{"region":"Global","perspective":"Enterprise","riskLevel":"Low","impactAnalysisEn":"Global enterprises using PayPal must adhere to the specific user agreement applicable to their region of registration. The Luxembourg policy highlights PayPal's regulated nature in the EEA.","complianceNoteEn":"Local Regulations"},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"While this policy is region-specific, the principles of e-money, third-party liability, and account closure are common across PayPal's global operations. Users outside EEA should check their local agreements.","complianceNoteEn":"Global Payment Standards"},{"region":"US","perspective":"Enterprise","riskLevel":"Low","impactAnalysisEn":"The policy does not directly affect US businesses as it's specific to Luxembourg/EEA. US businesses would operate under PayPal's US-specific terms and regulations.","complianceNoteEn":"N/A"},{"region":"US","perspective":"Individual","riskLevel":"Low","impactAnalysisEn":"This specific user agreement applies only to Luxembourg residents, so it has no direct impact on US individuals. US users are governed by separate PayPal US agreements.","complianceNoteEn":"N/A"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Implicit"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original User Agreement source still match the recorded public snapshot version 7?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/36648bad-1292-4f57-8b69-47df3f84c652","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"0967c559969c57628916ffb7913aa2aa7efb7a547fb479c00419991dd4fa8b4b"}