PPC Land is now also on WhatsApp, with a new PPC Land channel carrying its stories.
On Saturday, November 14, 2026, a European regulator put a price on something most smartphone owners never think about: what an app does with the photos it can technically see. Italy's data protection authority fined Meta EUR805 million for letting the Facebook app on Android read pictures, videos and their metadata for a suggestions feature without proper consent.
A day earlier, OpenAI had given its AI agents a way to pay for things without ever seeing a real card number, and published a playbook telling merchants to stop their bot defences from turning those agents away.
Between those two stories sat a busy weekend of smaller changes, most of them from Amazon and Google, that adjust who can see what inside the systems advertisers depend on: a new first-party cookie, tighter rules for holiday storefronts, a paused partner programme, a vanished help page and new ways to wire creators into video campaigns. The common thread was access.
Regulators, platforms and browser makers are each redrawing the line between data that is available and data that may be used.
The Landline newsletter can also be heard. Marketing Is Calling reads each edition aloud every day, on Spotify, Apple Podcasts and YouTube. Marketing Rodeo picks the most controversial advertising story of each day, weekends included, and has some fun with it, on Spotify, Apple Podcasts and YouTube.
Italy's Garante fined Meta EUR805m over Facebook's access to Android photo galleries, concluding that the app read photos, videos and metadata from users' phones for a gallery suggestions feature, available since 2023, "without obtaining specific consent and without properly informing them." About 20 million Android users in Italy were affected.
The case began with a July 2025 report from the Centro Tutela Consumatori Utenti di Bolzano, a consumer group, and the proceedings ran for about 16 months. The Garante found that a single app-wide permission, a vague notice and a setting switched on by default did not add up to valid consent.
The remedies are as notable as the fine. Meta must ask for separate, specific consent, keep the feature off by default even for users who had already granted the system permission, and report back after one, two and three months. If the two-month deadline is missed, the feature cannot be switched on for anyone without valid consent.
The authority framed the case in terms that reach well beyond Facebook, saying the law "protects the smartphone as part of a person's private sphere." It also refused to hand the file to Ireland's Data Protection Commission, which normally leads cases against Meta in Europe, because "the ePrivacy rules do not provide for the 'one-stop shop' mechanism." The violation falls under Article 122 of the Italian Privacy
Code, which implements the ePrivacy rules on accessing information stored on a device.
The Garante counted the scale, the ongoing duration, a 2019 measure against the company and limited cooperation as aggravating factors, and Meta's late changes after the complaint as a mitigating one. The fine works out at about 0.47% of Meta's worldwide turnover.
Whether gallery content was used to train AI, which Meta denies, was not examined, and a newer gallery feature that processes images in the cloud will be assessed separately.
Meta's handling of photos drew a technical response on the same weekend. PPC Land reported that Brave now cuts the hidden ID Meta stamps on Facebook and Instagram photos. From desktop version 1.98, the browser strips a string beginning "FBMD" that Meta writes into the IPTC "Special Instructions" field of images.
On download, Brave deletes the value before the file finishes saving; on upload, it sends a cleaned copy and leaves the original untouched. "Meta hasn't revealed exactly what it uses this identifier for or why it is added to image metadata," Brave wrote, conceding the value may not be meant for tracking.
Its concern is that the identifier stayed the same when a second user re-uploaded a photo, which could let the same image be linked across accounts. "This removal makes it harder for Meta to link the same photo across accounts and sites," the company said.
The IPTC documented the behaviour in July 2019, and the GitHub issue asking Brave to deal with it stayed open for more than seven years before it was closed in October 2026. Mobile versions are planned, without dates.
OpenAI took a different view of access, one where the machine is invited in but kept away from the sensitive parts. On November 13, it handed its AI agents a wallet without the real card number in it. ChatGPT Wallet lets the company's agents buy online while every purchase needs a check such as Face ID or a fingerprint, after which the card network supplies a stand-in credential.
"It's the first wallet that lets agents pay without access to users' actual card details," OpenAI said. It was built with American Express, Mastercard and Visa, and at launch it is limited to US ChatGPT Pro subscribers aged 18 and over with eligible US-issued cards. Luke Gebb of American Express called it the company's "first American Express Agentic Commerce Experiences integration."
The companion document matters as much as the wallet. OpenAI's Commerce Partner Playbook tells merchants: "To accept payment from ChatGPT Wallet, websites need to ensure agents are not inadvertently blocked." It asks them to recognise signed…