In Europe, unlike the US, consent has to be real. It's bad faith to offer ten pages of stuff no one reads and no one understands and interpret a click as consent. EU law generally requires a good faith offer and informed consent.

▲

loeg an hour ago | parent [-]

Do you think the "allow photo access? yes/no" dialogue has ten pages of legalese? I promise, it does not. Really unclear what Meta should do differently.

	▲	microtonal 5 minutes ago \| parent [-]
		Just asking 'Allow photo access' is not enough under the GDPR, you have to ask consent for every different purpose that you are going to use the data for. The case is exactly about this: Facebook requested access to users' photo galleries through a single app-wide authorisation. According to the Italian regulator, a preceding notice did not make clear that this would also allow Facebook to generate suggestions based on photos in their gallery. https://www.bbc.com/news/articles/cwn83gxemk35o They should have explicitly asked separate consent to generate suggestions based on photos. They know this. They just made the judgement that they could get away with an 'oopsie' or a fine that is just doing cost of business. These >1B fines are good, make them feel it, so that the next time they won't violate the GDPR.