{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"494ffd08-1c2e-43ae-b332-5d4b316fbaa2","screeningDate":"2026-08-01T04:33:29.487Z","publicationGate":"published","company":{"id":"9bffb74f-0f91-46a9-a635-74b5e91623e1","name":"Microsoft","slug":"microsoft","industry":"Tech Giant"},"policy":{"id":"f7958007-438b-4240-ba2d-2a48dbb9f661","name":"Privacy Statement","type":"privacy","jurisdiction":"EU","sourceUrl":"https://www.microsoft.com/en-gb/privacy/privacystatement"},"sourceConfidence":{"state":"review-required","lastCheckedAt":"2026-07-06T09:39:08.870Z","retrievalChannel":"other","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":1,"sha256":"31390510da4eb9e948bbd71d045e274379ab853432487860ffba5669fbd188b5","capturedAt":"2026-07-06T09:42:50.055Z"},"current":{"version":2,"sha256":"ebb4c380a7ff6968ecdf966c968efd3dbf3248f73f4bb5f5a14735d7a84f5730","capturedAt":"2026-08-01T04:33:29.474Z"}},"assessment":{"summary":"The updated policy now explicitly allows sharing your age group information with third-party apps, increasing data sharing and potential privacy risks.","overallRisk":"Medium","overallScore":7,"previousPublicChange":null,"scoreDelta":null,"direction":"baseline","reasons":[{"icon":"warning","textEn":"Reduced user control over age data sharing with third parties.","textIt":"Controllo utente ridotto sulla condivisione dei dati sull'età con terze parti.","deltaScore":1,"evidenceQuote":"We may share age group information with Microsoft apps and services, as well as third-party apps","evidenceSide":"new","relatedKpi":"kpiConsentMechanism","anchorStatus":"verified"},{"icon":"warning","textEn":"Potential for broader data exposure due to expanded sharing of age data.","textIt":"Potenziale per una maggiore esposizione dei dati a causa della condivisione estesa dei dati sull'età.","deltaScore":1,"evidenceQuote":"We may share age group information with Microsoft apps and services, as well as third-party apps","evidenceSide":"new","relatedKpi":"kpiDataCollection","anchorStatus":"verified"}],"keyPoints":[{"textEn":"Age group data can now be shared with third-party apps for tailored experiences.","textIt":"I dati sul gruppo di età possono ora essere condivisi con app di terze parti per esperienze personalizzate.","sentiment":"negative"},{"textEn":"This expanded sharing aims to provide more age-appropriate experiences across services.","textIt":"Questa condivisione estesa mira a fornire esperienze più appropriate all'età attraverso i servizi.","sentiment":"neutral"},{"textEn":"Users should review their Microsoft account privacy settings for age-related data.","textIt":"Gli utenti dovrebbero rivedere le impostazioni sulla privacy del proprio account Microsoft per i dati relativi all'età.","sentiment":"negative"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises using Microsoft services must ensure their data processing agreements and internal policies account for this expanded third-party sharing of age data, especially for EU users, to maintain GDPR compliance.","complianceNoteEn":"GDPR Art. 28"},{"region":"EU","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"The new clause on sharing age group data with third-party apps raises GDPR concerns, particularly regarding explicit consent for sensitive data and transparency. This could lead to higher scrutiny from data protection authorities.","complianceNoteEn":"GDPR Art. 6, 9"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises must evaluate how this change affects their compliance with diverse international data protection regulations and their vendor management strategies, especially for age-related data processing.","complianceNoteEn":null},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Users worldwide face increased sharing of age-related data with third-party apps, potentially without clear, granular consent mechanisms, impacting personal data control and increasing general privacy risk.","complianceNoteEn":null},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses leveraging Microsoft products need to assess if this new sharing aligns with their obligations under US state privacy laws, particularly regarding children's data and third-party disclosures, to avoid compliance gaps.","complianceNoteEn":"COPPA, State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Expanded sharing of age group data with third parties could impact privacy rights under state laws like CCPA/CPRA, especially concerning data of minors. Users should review their settings for potential opt-out options.","complianceNoteEn":"CCPA/CPRA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Partial"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiContentModeration","label":"Content moderation","value":"Partial"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Implicit"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Statement source still match the recorded public snapshot version 2?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/494ffd08-1c2e-43ae-b332-5d4b316fbaa2","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"3ac7ee16901c7056980378648920f7cab43dfb5e3d9157f589712cb02a7d7786"}