{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"488db3ea-38f7-4aac-9bc8-cc765f73ae86","screeningDate":"2026-08-02T12:50:08.318Z","publicationGate":"published","company":{"id":"c0caa75b-cc98-45c5-9b6b-198af2014025","name":"PayPal","slug":"paypal","industry":"FinTech"},"policy":{"id":"c28fb784-5012-4696-8c70-505d4185972a","name":"Privacy Statement","type":"privacy","jurisdiction":"EU","sourceUrl":"https://www.paypal.com/lu/webapps/mpp/ua/privacy-full"},"sourceConfidence":{"state":"review-required","lastCheckedAt":"2026-07-06T03:59:34.660Z","retrievalChannel":"seeded","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":5,"sha256":"320239c1eb5644bef52632ccf2177de89fd5c2d82de78bab34f0b8c193a41ec7","capturedAt":"2026-08-02T11:29:55.554Z"},"current":{"version":6,"sha256":"168f01646ad727bfb22632a07b38d4213b1e7ace135386ba18deefa502a85984","capturedAt":"2026-08-02T12:50:08.312Z"}},"assessment":{"summary":"This PayPal Privacy Statement outlines extensive data collection and sharing practices, including sensitive and biometric data, with a focus on service provision and fraud prevention.","overallRisk":"Medium","overallScore":7,"previousPublicChange":{"id":"b2e39954-84c1-4843-a490-278f2f4807a0","overallRisk":"Medium","overallScore":7,"screeningDate":"2026-08-02T11:29:55.562Z"},"scoreDelta":0,"direction":"unchanged","reasons":[{"icon":"warning","textEn":"Extensive collection of sensitive data like biometrics and precise location.","textIt":"Ampia raccolta di dati sensibili come biometrici e posizione precisa.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiDataCollection","anchorStatus":"not-recorded"},{"icon":"warning","textEn":"Personal data is used for AI model training and automated decision-making.","textIt":"I dati personali sono usati per l'addestramento AI e decisioni automatizzate.","deltaScore":0,"evidenceQuote":"We may use Personal Information to train our artificial intelligence (AI) models that power our Services and help us deliver more secure, efficient, and personalized services.","evidenceSide":"new","relatedKpi":"kpiAiTrainingOptOut","anchorStatus":"verified"},{"icon":"warning","textEn":"Broad sharing of data with various third parties, including AI providers.","textIt":"Ampia condivisione di dati con terze parti, inclusi fornitori AI.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiThirdPartySharing","anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"PayPal collects extensive personal data, including sensitive biometric and precise location information.","textIt":"PayPal raccoglie dati personali estesi, inclusi dati biometrici sensibili e informazioni sulla posizione precisa.","sentiment":"negative"},{"textEn":"Your data is used to train AI models for services, security, and personalized experiences.","textIt":"I tuoi dati sono usati per addestrare modelli AI per servizi, sicurezza ed esperienze personalizzate.","sentiment":"neutral"},{"textEn":"Data is broadly shared with service providers, affiliates, and authorities for various purposes.","textIt":"I dati sono ampiamente condivisi con fornitori di servizi, affiliati e autorità per vari scopi.","sentiment":"negative"},{"textEn":"Consent is required for collecting biometric and precise geolocation data.","textIt":"Il consenso è richiesto per la raccolta di dati biometrici e di geolocalizzazione precisa.","sentiment":"positive"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"PayPal's broad data processing and sharing, including with AI providers, necessitates robust data processing agreements (DPAs) and compliance with GDPR for businesses using PayPal services.","complianceNoteEn":"GDPR Art. 28"},{"region":"EU","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"Extensive data collection and AI training raise concerns under GDPR, requiring explicit consent for sensitive data and transparency on automated decisions. Individuals have strong rights to data access and deletion.","complianceNoteEn":"GDPR Art. 6, 9, 22"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises using PayPal must navigate diverse international data protection laws, ensuring their operations and data flows with PayPal are compliant across jurisdictions.","complianceNoteEn":"International Data Laws"},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Users worldwide face broad data collection and AI use. Understanding local privacy rights and managing consent for sensitive data is crucial.","complianceNoteEn":"Global Privacy Norms"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses integrating PayPal must ensure their own privacy practices align with PayPal's data handling, especially concerning third-party sharing and AI use, to meet state-specific privacy laws.","complianceNoteEn":"State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Users should review consent for biometric and geolocation data. While CCPA/CPRA grant rights, the policy's broad data use for AI and marketing warrants attention.","complianceNoteEn":"CCPA/CPRA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Explicit Opt-In"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Statement source still match the recorded public snapshot version 6?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/488db3ea-38f7-4aac-9bc8-cc765f73ae86","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"d9f3ba84ee3b8ce7afe583372d12f4791dfc6235b0cf443d6b47ebff45573680"}