Just asking 'Allow photo access' is not enough under the GDPR, you have to ask consent for every different purpose that you are going to use the data for. The case is exactly about this:

Facebook requested access to users' photo galleries through a single app-wide authorisation. According to the Italian regulator, a preceding notice did not make clear that this would also allow Facebook to generate suggestions based on photos in their gallery.

https://www.bbc.com/news/articles/cwn83gxemk35o

They should have explicitly asked separate consent to generate suggestions based on photos.

They know this. They just made the judgement that they could get away with an 'oopsie' or a fine that is just doing cost of business. These >1B fines are good, make them feel it, so that the next time they won't violate the GDPR.

This isn't the case for me on Android anyway. You can turn off access for media & photos in settings, and then yes, it nags you to enable it, but there's still two ways to send photos:

* either share from an outside app, e.g. the gallery, choose "share", choose "whatsapp". This gives it access only to the photo you shared from the other app.

* and in Android's settings you can give Whatsapp access to a subset of photos, then it works normally on only that subset. Then you can always add more from outside that set, by pressing the paperclip icon when you write the message, there you see the "gallery option", then you see the limited subset of photos you gave access to, at the bottom right you have a folder picker icon which opens the system's gallery picker view (google photos in my case), where you can see all photos, and it can then access that photo too.

* if you chose no access to media at all, but if whatsapp has camera access, click on the paperclip icon in the message box, then, "camera", then the "gallery" icon, there you get a screen prompting for gallery access, but on the bottom right it has the same folder icon that gives access to the system photo picker, which again will only allow access to the photo you pick there.

The first two cases are pretty low-friction.

Hm, at least on iPhone I used to be able to allow only some photos.

> You can't share just one photo, you have to give it access to all photos

Works for me on an alternate Android OS without photos permission, but it's buggy (possibly on purpose) and often requires doing the sharing intent action twice.

WhatsApp only has "Network", "Notifications" and "Sensors" permission on my phone

IME, many, if not most, meta employees (including me) are neutral to negative on the behavior of the company.

> Should there be multiple permissions for every different thing the app might want to do with your camera roll?

Yes? Just because I want to share some pictures through an app doesn't mean I want it to go and do anything it wants with any picture on the device.

If I share a single picture with friends I don’t want the app to then go through all the photos I’ve ever taken in my life.

Or, you know, just don't aim to go through user's photos by default and just ask consent in the case a user enables/uses a feature that requires a photo to be sent to Facebook?

When all you have is a huge hole in your national budget, everything looks like a finable offence.

Only for Facebook, lmao. Smaller apps without deep pockets aren't held to this standard.