The investigation, launched in 2025, established that access to a user’s camera roll is requested with a single permission for the entire app, which the authority said covers multiple features with different needs. The authorization request was preceded by a generic warning that didn’t allow users to understand that they were authorizing picture and video suggestions, the authority said.
“If granted in full, this type of permission allows the app to read the device’s entire photo archive, usually permanently, without the user or the authorities being able to verify which information is actually being used,” the statement reads.
The authority also said it “rejected the objection of lack of jurisdiction raised by the company in favor of the Irish authority, because the ePrivacy regulation does not provide for the ‘one-stop-shop’ mechanism.”
Meta has 60 days to get consent separately and specifically for the feature, clearly explain what it does and how it can be disabled, the authority said. It also must be disabled by default, including for those who have already authorized it.
Meta didn’t immediately respond to a request for comment. It has the right to appeal the decision.