{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"a5804b9f-61b2-43cc-9cba-67391d428238","screeningDate":"2026-08-01T04:37:27.848Z","publicationGate":"published","company":{"id":"c0caa75b-cc98-45c5-9b6b-198af2014025","name":"PayPal","slug":"paypal","industry":"FinTech"},"policy":{"id":"dc8f08a1-4c7e-4b31-a1cd-c3f8597c965a","name":"User Agreement","type":"terms","jurisdiction":"EU","sourceUrl":"https://www.paypal.com/lu/legalhub/paypal/useragreement-full"},"sourceConfidence":{"state":"review-required","lastCheckedAt":"2026-07-06T03:59:34.661Z","retrievalChannel":"seeded","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":3,"sha256":"dcc651853121f39a69abe965fdc1aa7b74abee98a7ce2a4a039a11821a93bea1","capturedAt":"2026-07-10T01:47:41.622Z"},"current":{"version":4,"sha256":"3e217da9e7ae7a1db9b349adc236cadeadd301a3ed9218ab56117447e2280894","capturedAt":"2026-08-01T04:37:27.841Z"}},"assessment":{"summary":"No changes were found between the old and new versions of the PayPal User Agreement; the policy remains consistent.","overallRisk":"Medium","overallScore":5,"previousPublicChange":{"id":"ab33f12c-223c-4045-89ac-0ea091eb21c3","overallRisk":"Medium","overallScore":6,"screeningDate":"2026-07-10T01:47:41.631Z"},"scoreDelta":-1,"direction":"lower","reasons":[{"icon":"warning","textEn":"Extended data retention post-closure for legal and risk management purposes.","textIt":"Conservazione estesa dei dati post-chiusura per scopi legali e di gestione del rischio.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiDataRetention","anchorStatus":"not-recorded"},{"icon":"warning","textEn":"Users are liable for actions of authorized third-party service providers.","textIt":"Gli utenti sono responsabili per le azioni dei fornitori di servizi terzi autorizzati.","deltaScore":0,"evidenceQuote":"You are liable to us for the actions that you authorise the third parties to carry out. You will not hold us responsible for, and you will indemnify us from, any liability arising from the actions or inactions of such third parties in conne","evidenceSide":"old","relatedKpi":"kpiThirdPartySharing","anchorStatus":"verified"},{"icon":"info","textEn":"PayPal may automatically update funding source information using third-party data.","textIt":"PayPal può aggiornare automaticamente le informazioni sulla fonte di finanziamento usando dati di terzi.","deltaScore":0,"evidenceQuote":"If this information changes, we may update it using information and third-party sources available to us without any action on your part.","evidenceSide":"old","relatedKpi":"kpiDataCollection","anchorStatus":"verified"}],"keyPoints":[{"textEn":"The policy outlines terms for opening and managing personal and business PayPal accounts.","textIt":"La politica definisce i termini per l'apertura e la gestione degli account PayPal personali e aziendali.","sentiment":"neutral"},{"textEn":"PayPal is regulated as a bank in Luxembourg by the CSSF, ensuring financial oversight.","textIt":"PayPal è regolamentata come banca in Lussemburgo dalla CSSF, garantendo la supervisione finanziaria.","sentiment":"positive"},{"textEn":"Users grant continuous permission to charge linked funding sources for payments and top-ups.","textIt":"Gli utenti concedono un'autorizzazione continua per addebitare le fonti di finanziamento collegate per pagamenti e ricariche.","sentiment":"neutral"},{"textEn":"Account closure is possible at any time, but data retention applies post-closure.","textIt":"La chiusura dell'account è possibile in qualsiasi momento, ma la conservazione dei dati si applica dopo la chiusura.","sentiment":"negative"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses using PayPal must ensure their own data handling practices align with GDPR and PSD2. They bear liability for third-party actions authorized through their accounts.","complianceNoteEn":"GDPR, PSD2"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The policy's data retention clauses post-closure may limit full GDPR deletion rights. Users should be aware of their liability when authorizing third-party access under PSD2.","complianceNoteEn":"GDPR, PSD2"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises must ensure their use of PayPal aligns with international data protection standards and financial regulations. Managing third-party access is a key consideration.","complianceNoteEn":null},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Globally, users face similar implications regarding data retention and third-party liability. Understanding these terms is crucial for managing personal financial data.","complianceNoteEn":null},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"US businesses should consider how these terms interact with state-specific privacy laws like CCPA/CPRA regarding data sharing and retention. Financial regulations also apply.","complianceNoteEn":"CCPA/CPRA"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"While primarily EU-focused, US users should note the broad data retention and third-party liability clauses. These aspects align with general consumer protection principles.","complianceNoteEn":null}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Explicit Opt-In"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original User Agreement source still match the recorded public snapshot version 4?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/a5804b9f-61b2-43cc-9cba-67391d428238","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"d6cab6e96157716666f87c16050f77db4ca11bb1eeae063b2d16fec9148ed06e"}