Italy's privacy regulator fines Meta a record €805 million for using Android users' photos without specific consent

The stories

10 on this beat today.

Every story told the same way: what happened, who is involved, why it matters, how it works, the truth and the good news.

1. 01

   Italy's privacy regulator fines Meta a record €805 million for using Android users' photos without specific consent

   €805 million

   fine on Meta, the largest Italy's privacy regulator has imposed

   Meta says it will appeal [1]

   20 million

   Android users in Italy who may have been affected

   the photo suggestions were on by default [4]

   60 days

   for Meta to switch the feature off and ask again

   even people who already agreed must be asked [3]

   What happened

   • Italy's privacy regulator fined Meta €805 million on Saturday for using Android users' photos without their specific consent. [3]
   • The regulator, known as the Garante, says the Facebook app on Android accessed photos and videos without informing users. [4]
   • Up to about 20 million Android users in Italy may have been affected, the regulator said. [4]
   • Meta said "we strongly disagree" with the decision and plans to appeal. [1]
   • The feature offers photos and videos from a phone's gallery as ideas for new Facebook posts. [3]
   • Facebook asked for gallery access once, with one permission for the whole app. [3] That one permission covered several features with different needs, the regulator said. [3]
   • The notice shown first did not make clear that the photos would feed suggestions, the regulator said. [1]
   • The suggestions were also switched on by default. [4]
   • Meta must now switch the feature off by default, even for people who already agreed. [3]
   • The regulator says the breach is "still ongoing for those who have not updated the app". [1]
   • It is the largest fine the Italian privacy regulator has ever imposed. [3]
   • DW, Germany's international broadcaster, puts the fine at 0.4% of Meta's yearly sales. [2] Al Jazeera puts it at about 0.47%. [4]
   • The regulator opened the case in July 2025 and says Meta did not cooperate. [2]
   • It also counted an earlier violation by Meta that led to a 2019 fine. [4]

   Who is involved

   • The Garante Italy's data protection authority; it set the fine and the 60-day order
   • Meta the company that owns Facebook, Instagram and WhatsApp; fined, and appealing
   • Photo suggestions switched on before anyone chose

   How it unfolded

   1. July 2025 Italy's regulator opens its case against Meta [2]
   2. Saturday the €805 million fine is announced [3]
   3. Saturday the fine
   4. Within 60 days Meta must switch the feature off and ask users again [3]

   Why it matters

   Facebook users in Italy must now be asked a separate question before the app uses their photos for suggestions. [3]

   Think it through

   1. 1

      Didn't people already tap allow?

      Yes, Meta says people must give permission on their phone first. [1] The regulator says the way it asked was too generic. [4]

      Metausers gave permission

      vsvs

      The regulatortoo generic
   2. 2

      Why does one tap matter so much?

      A full permission lets the app read the whole photo archive, usually for good, the regulator says. [3] Neither the user nor the authorities can check which photos are actually used. [3]

      One tap on allow→Whole archive open→Nobody can check the use
   3. 3

      So why is Italy fining Meta, not Ireland?

      Meta's European headquarters is in Ireland, and Meta argued Ireland's regulator should decide. [2] Italy rejected that, saying the rules it used have no "one-stop shop" handing the case to Ireland. [3]

   4. 4

      How big is this fine for Meta?

      In dollars the fine is $887 million. [1] Last month a US judge in New Mexico ordered Meta to pay $25bn. [1]

      $887 millionItaly's fine

      vsvs

      $25bnNew Mexico order
   5. 5

      Is this about training Meta's AI?

      No, the case did not look at AI training, which Meta denies. [4]

      AI trainingnot examined

      vsvs

      Photo suggestionsfined
   6. 6

      So who holds the power here?

      Italy's regulator has ordered the feature off for every user in Italy at once. [3] Meta's answer is an appeal, which it has promised. [1]

   How it works

   Data protection lawyers call this specific consent: a yes counts only for the use it was asked for.

   Facebook asked once for the whole gallery, then used it for suggestions its notice did not make clear. [1]

   Seen it before

   Letting a friend borrow a phone to make one call is not letting them read every message on it.

   The truth

   • What is really going on Italy's privacy regulator fined Meta €805 million because one tap of allow let the Facebook app use phone photos for post suggestions that, the regulator says, users were not clearly told about. [3][1]
   • Meta calls the level of the fine "disproportionate". [1] The regulator says it weighed "the high number of people affected". [1]
   • Nobody knows yet

     How many of the up to 20 million people in Italy actually had their photos used for suggestions.

     The regulator gave the number who may have been affected, not how many used the feature. [4]

   • Nobody knows yet

     What share of Meta's sales the fine really is.

     DW puts it at 0.4% and Al Jazeera at about 0.47%, and neither says which year's sales it used; we print both. [2][4]

   Good news

   • Italy's regulator ordered Meta to switch photo suggestions off for everyone in Italy, including people who already agreed, until each is asked separately.

   What comes next

   Meta has 60 days to make the changes. [3] It says it will appeal. [1]

   Learn the idea behind it

   • Who really owns your Cybercab? Start the 14-minute course →

1. 02

   Cursor traces its breach to a stolen key

   What happened

   • Cursor, an AI app for writing code, published a report on its break-in on Friday. [5]
   • Hackers first took a key stored at Fireworks AI, a company that runs AI models for others. [5]
   • The key opened a store of old coding sessions, mostly from 2025, that Cursor shared with Fireworks. [5]
   • On 29 October they used a stolen login to put fake copies of Claude Code in Cursor's add-on store. [5] Claude Code is Anthropic's coding helper. [5]
   • The fakes were up for about 11 hours, and up to 5,000 users may have received them. [5]
   • The fakes tried to plant a hidden way back into each computer. [5] Coding errors probably stopped that on many. [5]
   • The hackers also took support emails and logins customers had shared with Cursor's support team. [5]

   Who is involved

   • Claude Code Anthropic's coding helper, faked

   Why it matters

   Developers who installed or updated Claude Code in Cursor in those hours are told to follow Cursor's clean-up steps. [5]

   Think it through

   1. 1

      How did a supplier's key reach the store?

      Some old sessions held logins for Cursor's other tools. [5] One stolen login then opened the add-on store. [5]

   2. 2

      Who else did the Fireworks break-in reach?

      Uber says drivers' licence details were taken through Fireworks. [7] Notion says some of its users' AI chats were taken too. [6]

   3. 3

      What were the hackers after?

      Fireworks blames criminals who sell stolen access to AI models. [6] At Railway, another host, stolen keys ran up about $740,000 of AI use. [9]

      $740,000of AI use run up with keys stolen at Railway

   4. 4

      So what is really going on?

      A break-in at one supplier spills over into its customers, TechCrunch notes. [6] Fireworks has more than 10,000 customers. [8]

      10,000customers of Fireworks, and more

   How it works

   Security engineers call this a supply-chain attack: break into one supplier to reach everyone who relies on it.

   Cursor shared old sessions with Fireworks, so a key stolen at Fireworks became a way into Cursor. [5]

   Seen it before

   If a friend keeps a spare key to a house and their bag is stolen, that door is open too.

   Why a yes to one use of your data is not a yes to every use

   Data protection lawyers call it specific consent: a permission counts only for the use it was asked for, so each new use needs its own yes.

   The twist

   Saying yes once does not hand data over for good. Each new use needs its own question, and a use the person was never asked about has no consent behind it.

   The picture

   One tap on allowwhole gallery

   ↓→

   The noticeunclear on use

   ↓→

   Photo suggestionson by default

   Step by step

   1. 1 A company asks for one permission
   2. 2 The person says yes to what the notice told them
   3. 3 The company uses the data for something more
   4. 4 A regulator rules the extra use had no yes of its own

   The same force, elsewhere today

   Where this chain is also running, in today's other stories.

   • Cursor traces its breach to a stolen key

     Cursor kept coding sessions for training from users who had not switched Privacy Mode on, and that stored data is where the thieves found logins.

   • Apple explains how it walls off cameras

     Apple's chip hands camera data to an app only after the on-screen light has shown, so the person sees each use as it starts.

   • Pakistan raids two scam call centres, 154 held

     Victims installed an app to get a small loan, the app opened their photo gallery, and scammers used those photos for blackmail.

   Where you've seen this

   Hospitals

   a signature for one operation does not cover a second one

   School photos

   a parent's yes to a class photo is not a yes to an advert

   Map apps

   location for directions is not location for adverts

   The catch

   Asking separately for every use can bury people in pop-ups, and people who see too many start tapping yes without reading.

   And the whole of it

   Up to 20 million people in Italy pressed one button, and the regulator says the notice before it did not explain what it opened. Most people with a phone have pressed buttons like it, on apps they barely remember installing.

   The truth

   • What is really going on Separately, Cursor says one key stolen at Fireworks AI let attackers climb from a supplier into its own add-on store. [5]
   • Cursor says its main systems, and users with Privacy Mode on, were not touched. [5] That finding comes from Cursor's own report. [5]
   • Nobody knows yet

     How many Cursor users ended up with the hidden way back in.

     Coding errors probably stopped it on many Windows and Mac computers, and Cursor gave no count of where it worked. [5]

   Good news

   • Cursor has moved its AI work away from Fireworks and rebuilt its add-on store. [5]

1. 03

   Pakistan raids two scam call centres, 154 held

   What happened

   • Pakistan's National Cyber Crime Investigation Agency raided two scam call centres in Islamabad and Rawalpindi over three days. [16]
   • It arrested 143 people in Islamabad and 11 in Rawalpindi, the agency said on Saturday. [16]
   • The centres ran scams across borders, aimed at countries in South Asia. [16]
   • In Rawalpindi, callers told victims they were being watched or were on a hit list. [16] Fake Bangladesh police then demanded money. [16]
   • In Islamabad, victims were talked into installing a loan app that opened their photo gallery. [16]
   • Scammers turned victims' selfies into fake sexual images, then blackmailed them. [16]

   Who is involved

   • NCCIA Pakistan's cyber crime police; led the raids

   Why it matters

   Students take these jobs because the pay is above average, the agency said. [16] An arrest record can count against them later when they apply for a government job. [16]

   Think it through

   1. 1

      Why did a loan app want the photos?

      The loan was small; the real target was the victim's details, family contacts and pictures, the agency said. [16]

      Small loan→Details and photos taken→Blackmail
   2. 2

      How does the money move?

      Fake companies registered with weak checks get bank accounts, and the scammers plug those into their apps. [16]

      Fake companyweak checks

      ↓→

      Bank accountplugged into apps
   3. 3

      Who is behind these centres?

      Bosses were arrested at both centres, the agency said. [16] It is still tracing which country built the app, and who runs it. [16]

   How it works

   Fraud investigators call this sextortion: threatening to spread sexual images, real or faked, unless the victim pays.

   Even fabricated pictures worked, because victims feared they would reach their family or community, the agency said. [16]

   Seen it before

   A bully who threatens to spread a made-up rumour can scare a classmate even though it is false.

   Victims installed an app to get a small loan, the app opened their photo gallery, and scammers used those photos for blackmail.

   The idea, in story 02: Why a yes to one use of your data is not a yes to every use →

   The truth

   • The agency's officer said he had no exact number of foreigners involved. [16] He said only that the number in prison is in the hundreds. [16]
2. 04

   Pro-Iran news-style accounts reach millions

   What happened

   • DW, Germany's international broadcaster, checked accounts posting about the Iran war under names like Iran Military. [11]
   • It found signs of content farms: networks that pump out large amounts of cheap posts fast. [11]
   • One account, Iran Military Media, has posted more than 1,600 times on X since late 2025. [11] Those posts drew over 150 million views. [11]
   • Moustafa Ayad of the Institute for Strategic Dialogue, a London research group, studied 10 similar accounts. [11] Together they drew 353 million views. [11]
   • Many posts start with the word BREAKING and use AI-made videos. [11]

   Why it matters

   People following the war may struggle to tell the real account from copies with the same look. [11]

   Think it through

   1. 1

      Is Iran's government running these accounts?

      An ISD study of one pro-Iran network on X found no links to the state. [11] Iranian state media say only one Iran Military account is genuine. [11]

      ISD studyno state links found

      vsvs

      Iranian state mediaone account is real
   2. 2

      Why post so much, so cheaply?

      Content farms can be driven by money or by political influence, DW says. [11] Repeated, formulaic posts are cheaper and easier to make. [11]

      Cheap formulaic posts→Little cost→Money or influence
   3. 3

      Has anyone stopped them?

      X has suspended several since March, including one with close to 2 million followers. [11]

      2 millionfollowers of one account X removed

   How it works

   Researchers of online influence call this coordination: separate-looking accounts posting the same thing at the same time.

   DW found two of the accounts posting the same image, with the same caption, on the same day. [11]

   Seen it before

   One fan running ten accounts can make a post look far more popular than it is.

   The truth

   • Nobody knows yet

     Who owns most of the Iran Military accounts.

     DW says ownership cannot always be verified, and one study of a pro-Iran network found no state links. [11]

   Good news

   • X has suspended several fake Iran Military accounts since March, including one with close to 2 million followers.
3. 05

   Ransomware claims jump as lone attackers multiply

   What happened

   • Ransomware gangs scramble a victim's systems or steal its data, then demand payment. [12]
   • Gangs listed nearly 3,000 claimed attacks on their leak sites over the summer, some researchers count. [12]
   • That would be a rise of 20 to 40% since spring, by some estimates. [12]
   • Halcyon, a security firm, counts about 111 groups claiming attacks from July to September. [12]
   • One new group, Storm, listed 71 victims in just 20 days, Wired reports. [12]

   Why it matters

   Halcyon says most of the recent rise came from attacks outside the United States. [12]

   Think it through

   1. 1

      Is AI running these attacks now?

      Recorded Future's Allan Liska says AI helps write phishing emails and negotiate. [12] Successful gangs are "still largely human operated," he says. [12]

   2. 2

      Then why are there so many new gangs?

      Researchers see more lone attackers starting their own groups instead of renting a gang's tools. [12] One teenager made more than $800,000 in under two weeks. [12]

      $800,000made by one teenager in under two weeks

   3. 3

      Will these newcomers last?

      Halcyon's Cynthia Kaiser, a former FBI cyber deputy director, suspects many will surge and then burn out. [12]

      New group appears→Quick burst of claims→Many burn out

   How it works

   Economists call this a fall in barriers to entry: when starting costs drop, more newcomers join a trade.

   AI tools help lone attackers trick targets and check their code, so fewer need an established gang. [12]

   Seen it before

   When phone cameras got good, far more people started making their own films.

   The truth

   • Leak-site counts are claims, and attackers "wildly inflate their claims," Wired says. [12]
4. 06

   Video-call scam reached 677 targets in 58 countries

   What happened

   • Researchers at Arctic Wolf, a security firm, counted 677 targets of FaceStealer across 58 countries. [10]
   • FaceStealer is a North Korean scam that stole more than $400 million in crypto over 18 months. [10]
   • The US government seized the cloud servers behind it. [10]
   • Many targets were company founders and senior bosses. [10]
   • Arctic Wolf links the scam to BlueNoroff, a North Korean hacking group. [10]
   • Hackers invite a victim to a video call and show recordings of people the victim knows. [10] Then they fake a technical fault. [10]
   • The "fix" they offer is malware that steals crypto and logins. [10]

   Who is involved

   • Founders and bosses many of the targets

   Why it matters

   The FBI says attackers sometimes waited months, likely for victims' crypto to grow. [10]

   Think it through

   1. 1

      Why show faces the victim knows?

      The FBI says showing several familiar people adds pressure on the next victim. [10]

   2. 2

      Was it only after crypto holders?

      The FBI says it also went after people who keep free, open-source code. [10] One keeps a JavaScript library downloaded tens of millions of times a week. [10]

      Code keeper fooled→Popular library→Millions of users

   How it works

   Security trainers call this social engineering: tricking a person, not a machine, into opening the door.

   The faked fault made running the hackers' fix feel like the helpful next step. [10]

   Seen it before

   A fake delivery driver who says just sign here often gets the door opened.

   Good news

   • One attack on a JavaScript library's keeper was stopped thanks to quick detection, the FBI says. [10]
5. 07

   Dubai Police break up a bank-account fraud gang

   What happened

   • Dubai Police said they broke up a gang running an investment fraud. [13]
   • The gang paid people to open bank accounts and digital wallets in their own names. [13]
   • Once recruits handed over their logins, gang members took control of the accounts. [13]
   • The gang moved fraud money through the accounts to hide who really received it. [13]
   • Police found the network through intelligence gathering and arrested its members. [13]

   Why it matters

   People who let others run their accounts risk legal trouble if fraud passes through them, police warned. [13]

   Think it through

   1. 1

      Why pay strangers for their bank accounts?

      Money in an account under someone else's name is harder to trace to the real owner. [13]

      Stolen money→Stranger's account→Real owner hidden
   2. 2

      Who does the gang recruit?

      People in financial need, police said. [13] The gang offered them money in exchange for their banking logins. [13]

   How it works

   Anti-money-laundering investigators call people like these recruits money mules: account holders who move criminals' cash for a fee.

   Each recruit's account made the fraud money look like an ordinary person's money. [13]

   Seen it before

   Lending a friend a school locker means anything found in it is linked to the locker's owner.

   Good news

   • Dubai Police broke up a gang that hid fraud money in bank accounts opened by paid recruits.
6. 08

   Apple explains how it walls off cameras

   What happened

   • Apple published how Secure Exclaves keep camera and microphone data apart from the rest of its devices. [14]
   • An exclave is a sealed-off area that handles camera and microphone data on its own. [14]
   • Apple says data handled there cannot be read by the main system, by apps, or by Apple. [14]
   • On its HomeView smart display, only a person's ID, position and a confidence score leave the exclave. [14]
   • An app gets the camera only once the on-screen light has been showing long enough. [14]

   Who is involved

   • Main system cannot read it
   • Apps cannot read it
   • Apple cannot read it

   Why it matters

   It guards the camera and microphone lights on the iPhone 18 Pro, iPhone Duo and MacBook Neo. [14]

   Think it through

   1. 1

      Why check the light at all?

      Apple's rule is that users must be able to tell when a sensor is on. [14] The main system must not be able to interfere. [14]

      Light switches on→Light shown long enough→Then the app gets the camera
   2. 2

      Is the software behind it flawless?

      No: Apple says its mathematical proofs found serious flaws early. [14] It does not claim the proofs cover every part. [14]

      Flaws foundearly

      vsvs

      Every part coverednot claimed

   How it works

   Security engineers call this isolation: doing sensitive work in a separate space other software cannot reach.

   The main system must not be able to pull out or change data in an exclave, Apple says. [14]

   Seen it before

   A diary kept in a locked box stays private even if someone gets into the room.

   Apple's chip hands camera data to an app only after the on-screen light has shown, so the person sees each use as it starts.

   The idea, in story 02: Why a yes to one use of your data is not a yes to every use →
7. 09

   Nigeria's election body sets up an AI-fakes unit

   What happened

   • Nigeria holds a general election in just over two months. [15]
   • Its draft voter list reportedly holds images believed to be made with AI. [15] INEC, the commission that runs Nigeria's elections, published it. [15]
   • Reported signs include exaggerated faces, duplicate names and people who have died since the last vote. [15]
   • INEC's chairman, Joash Amupitan, says a new unit will watch for AI threats and detect deepfakes. [15] Deepfakes are faked video or audio. [15]

   Who is involved

   • INEC runs Nigeria's elections

   How it unfolded

   Before the 2023 election, deepfakes falsely linked candidates to terror activities on social media. [15]

   1. 2023 deepfakes target candidates
   2. Now a unit to catch them

   Why it matters

   More than 103 million Nigerians are registered to vote in the coming election. [15]

   Think it through

   1. 1

      Is the worry fakes, or doubt?

      Akintunde Babatunde, who heads an Abuja journalism centre, says real evidence can now be dismissed as AI fakes. [15] He cites a lawmaker who called clips of his own remarks manipulated. [15]

      Real clipcalled fake

      ↓→

      Lawmakerdenies it
   2. 2

      Is AI itself the threat?

      Chibuike Mgbeahuruike of the Centre for Democracy and Development says the threat is "the absence of effective accountability". [15]

   How it works

   Researchers of disinformation call this the liar's dividend: once fakes are common, real proof can be waved away.

   Because convincing fakes exist, the lawmaker in Nigeria could call real clips of himself manipulated. [15]

   Seen it before

   Once a class knows fake sick notes exist, even a real one gets doubted.

   The truth

   • Nobody knows yet

     Whether Nigeria's draft voter list really holds AI-made images.

     The images are only believed to be AI-made, and the election commission is still investigating. [15]

8. 10

   AI firms hire spy-catchers to guard secrets

   What happened

   • OpenAI, Anthropic and Nvidia are hiring counterintelligence staff to protect their trade secrets from spies, Fortune reports. [17]
   • Anthropic hired 33 people for this work this year, Revelio Labs data shows. [17] It hired 14 last year and 9 in 2024. [17]
   • OpenAI's counterintelligence hiring rose to 22 this year, from 9 last year. [17] Nvidia hired 16 this year. [17]
   • Most such jobs pay $200,000 to $500,000, Revelio Labs says. [17]

   Who is involved

   • OpenAI hiring spy-catchers
   • Anthropic hiring spy-catchers
   • Nvidia hiring spy-catchers
   • Jensen Huang resigned as Nvidia's boss
   • China denies any spying

   How it unfolded

   Nvidia's chief executive, Jensen Huang, resigned after admitting an affair with a woman suspected of spying for China. [17] China denies any spying. [17]

   Why it matters

   AI is now treated as a matter of national security, so protecting its secrets has become especially critical. [17]

   Think it through

   1. 1

      How does a spy usually get close?

      Rarely by asking for secrets, says Eric O'Neill, a former FBI counterintelligence officer. [17] It may start at a conference, over drinks or on a dating app. [17]

      A friendly meeting→Trust builds→Questions about secrets
   2. 2

      Why is a boss hard to protect?

      Warning signs are harder to see in someone the boss trusts, O'Neill says. [17] By then the boss "may already be emotionally invested". [17]

   3. 3

      Are there enough people to hire?

      No: "Demand outstrips the supply of people with relevant experience," says Christopher Falkenberg, a former US Secret Service agent. [17]

   How it works

   Security professionals call this counterintelligence: finding and stopping people sent to steal secrets.

   Firms teach staff the warning signs, O'Neill says: a friendship that moves fast, or pushy questions about sensitive work. [17]

   Seen it before

   A new friend who keeps asking about tomorrow's test may want the answers, not the friendship.

   The truth

   • Nvidia's board says it does not think company secrets were compromised. [17] The suspicions about the woman come from US officials, as reported in the press. [17]