{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"51f2b3f2-6628-48c3-b4d1-be840ce4a0a6","screeningDate":"2026-08-06T03:50:43.558Z","publicationGate":"published","company":{"id":"c0caa75b-cc98-45c5-9b6b-198af2014025","name":"PayPal","slug":"paypal","industry":"FinTech"},"policy":{"id":"c28fb784-5012-4696-8c70-505d4185972a","name":"Privacy Statement","type":"privacy","jurisdiction":"EU","sourceUrl":"https://www.paypal.com/lu/webapps/mpp/ua/privacy-full"},"sourceConfidence":{"state":"review-required","lastCheckedAt":"2026-07-06T03:59:34.660Z","retrievalChannel":"seeded","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":6,"sha256":"168f01646ad727bfb22632a07b38d4213b1e7ace135386ba18deefa502a85984","capturedAt":"2026-08-02T12:50:08.312Z"},"current":{"version":7,"sha256":"320239c1eb5644bef52632ccf2177de89fd5c2d82de78bab34f0b8c193a41ec7","capturedAt":"2026-08-06T03:50:43.551Z"}},"assessment":{"summary":"No changes were found in the PayPal Privacy Statement, which details extensive data collection, AI training, and broad sharing, with some user controls.","overallRisk":"Medium","overallScore":7,"previousPublicChange":{"id":"488db3ea-38f7-4aac-9bc8-cc765f73ae86","overallRisk":"Medium","overallScore":7,"screeningDate":"2026-08-02T12:50:08.318Z"},"scoreDelta":0,"direction":"unchanged","reasons":[{"icon":"warning","textEn":"Extensive collection of personal and sensitive data, including biometrics.","textIt":"Ampia raccolta di dati personali e sensibili, inclusi i dati biometrici.","deltaScore":0,"evidenceQuote":"Biometric data: Such as voice identification, photo identification, or face scans, which we may collect when you consent in the user experience","evidenceSide":"new","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"warning","textEn":"User data is used for AI model training without explicit opt-out mechanism.","textIt":"I dati utente sono usati per l'addestramento AI senza un meccanismo di opt-out esplicito.","deltaScore":0,"evidenceQuote":"We may use Personal Information to train our artificial intelligence (AI) models that power our Services","evidenceSide":"new","relatedKpi":"kpiAiTrainingOptOut","anchorStatus":"verified"},{"icon":"warning","textEn":"Broad sharing of personal data with various third parties and authorities.","textIt":"Ampia condivisione di dati personali con varie terze parti e autorità.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiThirdPartySharing","anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"No changes were introduced in this policy update, maintaining existing data practices.","textIt":"Nessuna modifica è stata introdotta in questo aggiornamento, mantenendo le pratiche di dati esistenti.","sentiment":"neutral"},{"textEn":"PayPal collects extensive personal and sensitive data, including biometrics, with user consent.","textIt":"PayPal raccoglie ampi dati personali e sensibili, inclusi i dati biometrici, con il consenso dell'utente.","sentiment":"negative"},{"textEn":"Personal data may be used to train AI models for service improvement and security purposes.","textIt":"I dati personali possono essere usati per addestrare modelli AI per migliorare i servizi e la sicurezza.","sentiment":"negative"},{"textEn":"Data is broadly shared with service providers, corporate group members, and authorities.","textIt":"I dati sono ampiamente condivisi con fornitori di servizi, membri del gruppo aziendale e autorità.","sentiment":"negative"},{"textEn":"The policy acknowledges jurisdiction-specific privacy rights and offers some opt-out options.","textIt":"La politica riconosce i diritti sulla privacy specifici per giurisdizione e offre alcune opzioni di opt-out.","sentiment":"positive"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises using PayPal must ensure their own data processing aligns with PayPal's practices and GDPR requirements. Due diligence on third-party data sharing is crucial for compliance.","complianceNoteEn":"GDPR Art. 28"},{"region":"EU","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"Extensive data collection and AI training raise concerns under GDPR, especially for sensitive data. Users should exercise their rights to access and potentially restrict processing.","complianceNoteEn":"GDPR Art. 5, 6, 9"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises using PayPal must ensure their data handling practices are consistent with PayPal's policy and international data transfer rules. Compliance with various regulatory frameworks is complex.","complianceNoteEn":"Cross-border data transfer"},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Users worldwide face extensive data collection and AI training, requiring careful review of local privacy rights and policy details. Consent mechanisms and data subject rights vary globally.","complianceNoteEn":"Global Privacy Laws"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses integrating PayPal should review data flows to ensure compliance with US state privacy laws regarding third-party sharing. Transparency about data practices is essential.","complianceNoteEn":"CCPA/CPRA"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Broad data collection and sharing, including biometrics, may impact privacy rights under state laws like CCPA/CPRA. Users should be aware of their rights to know, delete, and opt-out.","complianceNoteEn":"CCPA/CPRA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiContentModeration","label":"Content moderation","value":"Opaque"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Statement source still match the recorded public snapshot version 7?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/51f2b3f2-6628-48c3-b4d1-be840ce4a0a6","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"0147997a3ac8650704fc4dd376e5c913b6f8ecf0e3598f6a4d5c6331fea5497a"}