Italy fines Meta EUR805m over photo galleries as OpenAI hands agents a wallet

PPC Land is now also on WhatsApp, with a new PPC Land channel carrying its stories.

On Saturday, November 14, 2026, a European regulator put a price on something most smartphone owners never think about: what an app does with the photos it can technically see. Italy's data protection authority fined Meta EUR805 million for letting the Facebook app on Android read pictures, videos and their metadata for a suggestions feature without proper consent. A day earlier, OpenAI had given its AI agents a way to pay for things without ever seeing a real card number, and published a playbook telling merchants to stop their bot defences from turning those agents away. Between those two stories sat a busy weekend of smaller changes, most of them from Amazon and Google, that adjust who can see what inside the systems advertisers depend on: a new first-party cookie, tighter rules for holiday storefronts, a paused partner programme, a vanished help page and new ways to wire creators into video campaigns. The common thread was access. Regulators, platforms and browser makers are each redrawing the line between data that is available and data that may be used.

The Landline newsletter can also be heard. Marketing Is Calling reads each edition aloud every day, on Spotify, Apple Podcasts and YouTube. Marketing Rodeo picks the most controversial advertising story of each day, weekends included, and has some fun with it, on Spotify, Apple Podcasts and YouTube.

The phone as private space

Italy's Garante fined Meta EUR805m over Facebook's access to Android photo galleries, concluding that the app read photos, videos and metadata from users' phones for a gallery suggestions feature, available since 2023, "without obtaining specific consent and without properly informing them." About 20 million Android users in Italy were affected. The case began with a July 2025 report from the Centro Tutela Consumatori Utenti di Bolzano, a consumer group, and the proceedings ran for about 16 months. The Garante found that a single app-wide permission, a vague notice and a setting switched on by default did not add up to valid consent.

The remedies are as notable as the fine. Meta must ask for separate, specific consent, keep the feature off by default even for users who had already granted the system permission, and report back after one, two and three months. If the two-month deadline is missed, the feature cannot be switched on for anyone without valid consent. The authority framed the case in terms that reach well beyond Facebook, saying the law "protects the smartphone as part of a person's private sphere." It also refused to hand the file to Ireland's Data Protection Commission, which normally leads cases against Meta in Europe, because "the ePrivacy rules do not provide for the 'one-stop shop' mechanism." The violation falls under Article 122 of the Italian Privacy Code, which implements the ePrivacy rules on accessing information stored on a device. The Garante counted the scale, the ongoing duration, a 2019 measure against the company and limited cooperation as aggravating factors, and Meta's late changes after the complaint as a mitigating one. The fine works out at about 0.47% of Meta's worldwide turnover. Whether gallery content was used to train AI, which Meta denies, was not examined, and a newer gallery feature that processes images in the cloud will be assessed separately.

Meta's handling of photos drew a technical response on the same weekend. PPC Land reported that Brave now cuts the hidden ID Meta stamps on Facebook and Instagram photos. From desktop version 1.98, the browser strips a string beginning "FBMD" that Meta writes into the IPTC "Special Instructions" field of images. On download, Brave deletes the value before the file finishes saving; on upload, it sends a cleaned copy and leaves the original untouched. "Meta hasn't revealed exactly what it uses this identifier for or why it is added to image metadata," Brave wrote, conceding the value may not be meant for tracking. Its concern is that the identifier stayed the same when a second user re-uploaded a photo, which could let the same image be linked across accounts. "This removal makes it harder for Meta to link the same photo across accounts and sites," the company said. The IPTC documented the behaviour in July 2019, and the GitHub issue asking Brave to deal with it stayed open for more than seven years before it was closed in October 2026. Mobile versions are planned, without dates.

Agents with wallets

OpenAI took a different view of access, one where the machine is invited in but kept away from the sensitive parts. On November 13, it handed its AI agents a wallet without the real card number in it. ChatGPT Wallet lets the company's agents buy online while every purchase needs a check such as Face ID or a fingerprint, after which the card network supplies a stand-in credential. "It's the first wallet that lets agents pay without access to users' actual card details," OpenAI said. It was built with American Express, Mastercard and Visa, and at launch it is limited to US ChatGPT Pro subscribers aged 18 and over with eligible US-issued cards. Luke Gebb of American Express called it the company's "first American Express Agentic Commerce Experiences integration."

The companion document matters as much as the wallet. OpenAI's Commerce Partner Playbook tells merchants: "To accept payment from ChatGPT Wallet, websites need to ensure agents are not inadvertently blocked." It asks them to recognise signed requests through Web Bot Auth and to work with fraud and payment providers, naming Forter, Riskified, Sardine and Signifyd on one side and Adyen, Checkout.com and Stripe on the other. The user still deals directly with the merchant, keeping card rewards and dispute protections. This is OpenAI's second try at checkout: Instant Checkout launched in September 2025 and shut in March 2026. The pitch lands in a market where retailers are wary. A test by Blend found bot protection turned away an AI shopping agent at 29 of 200 retailers, and OpenAI says ChatGPT now has 1.2 billion weekly users, a number large enough to make merchants reconsider their defences.

Agents are also creeping into the auction itself. PPC Land reported that Lunio now cuts Google brand bids when no rival is in the auction. The invalid-click specialist announced a partnership with Revvim on November 12 and a product called Agentic Bid Optimization, which lowers brand bids on Google Search and Shopping when no other advertiser is competing and restores them when a rival appears. The engine is Revvim's AdAi, and customers pay a share of what they save, though Lunio has not disclosed that share or how savings are measured. "Our core mission is to reduce wasted ad spend for our customers," said Chester Scott, Lunio's chief strategy officer. The headline case is an unnamed food delivery company that reclaimed more than $6.4 million in 2025 with 76% lower cost per click across 15 brand terms, with 31% of its traffic uncontested. There was no baseline or control in the case study, and PPC Land noted that Google's own pricing rules suggest a lone advertiser should already be paying close to the reserve price.

Amazon redraws its edges

Amazon's advertising business made four changes in a single day, each small, together a picture of a platform tightening its grip on the data and rules around its ads. The most consequential is that the Amazon Ad Tag adds a 30-day first-party cookie to advertiser websites in North America. The cookie, called aatSession, holds a session identifier linking a visitor's page views, sign-ups and purchases, and it expires a month after the last page view. It is on by default and set "only when the visitor's consent signals allow it," with support for TCF, GPP and Amazon's own consent signal. Advertisers who want out must add a line of code to the base tag on every page before the first event. PPC Land noted that the documentation does not explain what the identifier contains, how the cookie behaves when no consent signal is present, which countries "North America" covers, or how Safari's seven-day limit on cookies written by JavaScript applies. Amazon's third-quarter advertising revenue reached $19.64 billion, up 11%, so even small measurement changes travel far.

Holiday storefronts face sharper rules. Updated guidance shows that Amazon Brand Stores face rejection over "Prime Day" wording, even in images. Amazon trademarks such as Prime, Prime Day, Prime Video and Amazon Music are barred at all times, including in page names, navigation tabs and text inside hero images. Urgency language, specific savings figures, unverifiable price claims and superlatives are out too. "Promotional messaging is only allowed with the Featured Deals widget," the guidance says, and that widget must sit directly under the header and show at least four products with active deals. For Black Friday and Cyber Monday, Stores may start no more than seven days before an event, must come down within 24 hours after, and must be submitted at least 48 hours ahead. Moderation "usually takes 24 hours but can take up to 3 business days," so PPC Land calculated that a Store submitted 48 hours before a November 19 start could still be in review on November 20. US Black Friday Week runs from November 19 to 30.

Agencies learned that Amazon has halted partner status decisions through Q4 2026. "The current program and partner statuses will remain unchanged through 2026," the Ads Support Center says, and a new structure with new criteria will be published before the programme relaunches, with no date given. The pause affects Scorecard, a self-service tool that compares a partner's Amazon Ads results with an anonymised peer median across growth measures such as active advertisers and capability measures such as certified staff and clean room use. "There is no composite score," Amazon notes, and the benchmark tracks the median rate of change rather than raw size. How cohorts are built and what earns Advanced status remain undisclosed.

Some changes come as subtractions. PPC Land found that Amazon Ads dropped the help page for its account audit log, the Account Transparency Log that shows which user made certain changes to a sponsored ads account. The page was listed in the US, UK and German help centres on November 13 and gone on November 14. It had described how admins could view events, filter by user email and export to CSV, with a caveat: "Keep in mind that only events from actions taken in the ads console will be published on this page." Amazon has not said whether the tool was discontinued, moved or renamed. The question matters more now that changes can be made through Amazon's API and its MCP server, actions a console-only log would never have recorded.

Google wires up video

Google spent the weekend connecting more of its video advertising to code. PPC Land reported that Google's DV360 API v5 can now create responsive YouTube ads. "Today we're updating Display & Video 360 API v5 to add the ability to create, delete, and update responsive YouTube ads!" the developer blog announced on November 12. Coverage is limited to four of the 11 YouTube and partners line item types: efficient reach, non-skippable reach, target frequency and video views. Line items, ad groups and targeting still have to be built in the interface or uploaded as Structured Data Files, so the API changes what an ad says but not where it runs. "Display & Video 360 API v5 remains in public beta, we might still make breaking changes to it," Google cautioned.

Creators are being drawn into the same plumbing. Google's DV360 will let YouTube creators link videos to advertisers by code, skipping manual channel searches and approvals. "Display & Video 360 will soon support shared codes for brand partner access," Google said on November 13, without a launch date. Today, advertisers either send a link request that a creator accepts in YouTube Studio, or a creator who marks a video as a paid placement names the brand and the link is accepted automatically. Linked videos give advertisers view counts, enable boosted creator formats and, once approved, remarketing audiences. Only creators can remove a link they started. Google's claimed conversion lift for creator partnership boosts rose from 20% to 30% on the same data window between May and October, a revision PPC Land noted without explanation from Google.

The Google Ads API moved too. PPC News Feed reported that Google Ads API v26.2 brings new features and updates, with release notes dated November 11. The main addition lets text from associated assets overlay video assets in Demand Gen video responsive ads, and new ads are opted in by default in this version. Seasonality adjustments now cover Demand Gen, Multi-Party Authorization error codes support approval processes, and "unique reach metrics now support additional segmentation." On policy, Google clarified its personalized ad targeting policy: "Advertisers are not allowed to target users based on interests that fall under categories prohibited" across its network, an update labelled for November 2026. And in Merchant Center, the carrier shipping attribute limit per product increased from 10 to 100 entries, a change spotted by Hana Kobzova that helps merchants with complex carrier-calculated rates.

YouTube's creator tools are learning to explain themselves. On November 13, YouTube Studio's numbers learned to talk as Analytics became Insights on desktop, a plain-language layer at the top of the analytics page, alongside a Research tab that replaces Trends and surfaces "outlier" videos. "YouTube analytics is becoming insights shifting from dense raw data to clear plain language takeaways," a Creator Insider presenter said. A score of 5x means a video drew five times the views of the channel's earlier uploads in the same format. Ask Studio arrived on Android and iPhone the same day and can read up to 10 uploaded images at once; the images are deleted after a month, though conversations may be read by human reviewers.

Apple closes one door and opens another

Apple is shutting a fixture of its own web. PPC Land reported that Apple kills its 28-year-old Support Community forums on November 20. "The Apple Support Community will permanently close on November 20, 2026," the notice reads. The user-to-user forum, running under several names since 1998, stopped accepting posts on November 10. Apple told MacRumors the decision followed "a careful evaluation of strategy and customer needs." The notice says nothing about archived threads, accounts or earned points, and whether old pages will redirect is unknown. PPC Land placed the closure alongside the decline of open forums more broadly, citing Stack Overflow's drop to 1,442 new questions in July 2026 from 207,204 in March 2014, while stressing that Apple has not linked its decision to any of that.

At the same time, Apple moved further into the home. Apple's $299 HomeView went on sale with Siri AI still in beta on November 13 in seven markets: Australia, Canada, India, New Zealand, Singapore, the UK and the US. The smart display has a 7-inch screen, an A18 chip and a camera that recognises up to six people by face. "Siri AI is available in beta in HomeView software version 27.2," Apple said, and expanded server-side features will cost extra later, at a price not yet set. The wall model needs a separately sold mount, which puts the cheapest wall setup at $358.95. "Even when the whole household shares HomeView, personal content stays private to each person," Apple said. It is not sold in the EU, and Apple has said nothing about advertising or how face data is stored.

Balance sheets under strain

Two large consumer businesses reported numbers that show how advertising growth and accounting losses can sit side by side. Rakuten lost 62.7 billion yen in the third quarter even as ad sales climbed 11%. Revenue rose 10.9% to 697.1 billion yen and non-GAAP operating income rose 25.9%, but a 48.8 billion yen tax charge, much of it tied to a financial services reorganisation, and a derivative valuation loss pushed the bottom line deep into the red. Domestic advertising revenue grew 11.1% to 67.1 billion yen, slowing from 15.6% in the second quarter. An AI decision model and a new search engine lifted conversion on its Ichiba marketplace by 32.3% in an October test. "So, we get the understanding of an LLM at the cost and speed of traditional search," said Ting Cai, its chief AI and data officer.

In Europe, Vodafone lost EUR3.6bn as a German goodwill write-down hit EUR4.85bn for the six months to September 30. A higher discount rate and a revised plan for Vodafone Germany drove the impairment, while revenue rose 11.4% to EUR21.9 billion and the company raised its full-year guidance. "I am very happy about our overall Group performance, but Germany is not yet where it needs to be," said chief executive Margherita Della Valle. A court decision on an injunction in Dusseldorf is due on November 26, linked to price rises after a ruling by the EU's top court.

What business buyers read

Business buyers are leaning on AI to read vendor material, and they still reward substance. An Edelman and LinkedIn survey of 1,135 executives in seven countries found that 82% of B2B buyers value thought leadership more as AI spreads. Some 84% of decision-makers used AI tools to summarise vendor thought leadership, and 59% said poor or missing thought leadership contributed to a vendor being dropped from consideration. Only 46% of the 495 suppliers surveyed optimise content for AI answers. Sharing happens mostly in private: 89% of sharers used private channels against 67% public ones, which suggests likes and comments undercount impact. "In an AI-driven world, information is everywhere. Credible insight grounded in real expertise carries greater weight," said Victoria Whitney of Ecolab. PPC Land noted that both authors sell related services and that the report gives no margins of error.

LinkedIn, meanwhile, is testing how much buyers and sellers should know about each other. LinkedIn is testing a label for the profile visitors who keep coming back, a "Frequent Viewer" tag visible to some Premium subscribers, first reported by WIRED on November 11. LinkedIn confirmed the test but not the visit threshold, the time window or whether tagged visitors are told. Krista Mollion, a brand consultant who spotted the tag in October, told WIRED: "I called it the 'stalker alert.'" Andrew Hutchinson of Social Media Today was blunter: "For most users, this is fairly useless information."

Where the money goes in the UK says something similar about attention and spend. In an ExchangeWire podcast episode written up by PPC Land, EMARKETER principal analyst Bill Fisher said mobile takes over 75% of UK ad spend on under half of media time, about 47%, a gap he tied mainly to social media and Meta. He argued the industry confuses measurement with effectiveness: "The stuff that we can measure ... easily is the stuff that we tend to measure because it's easy." On generative creative, he warned of sameness: "AI is probabilistic. It gives us the answers that we want and it gives us the creative that it thinks we want." His remedy was human: "Humans cause friction and friction is good sometimes." PPC Land noted that several of his figures were recalled without named studies.

The weekend's stories describe the same negotiation from different sides. Italy says a phone's gallery is private even when an app has permission to look. Brave says a photo should not carry an identifier its owner never asked for. OpenAI says an agent can pay without holding the card, and asks merchants to let it in. Amazon sets a new cookie by default and removes a page that showed who changed what. Each move redraws who can see what, and the regulators are now pricing the mistakes.

Did you know

Conversion source is the Amazon Ads reporting field that names the system that reported a conversion, such as a tag, a server feed or a data upload, which is where the new Ad Tag cookie's events end up. Amazon's dimensions page, updated November 11, 2026, lists 156 attributes in 11 categories, of which 85 apply to Sponsored Products.

Sponsored Display, Amazon's self-service display product, launched in US beta in September 2019 and was priced on cost per click only at first. On April 4, 2025, Amazon moved all active Reach and Page Visit campaigns to the conversion objective.

Total ROAS adds sales of other products from the same brand to the sales of the promoted item before dividing by ad cost. Amazon's August 2022 DSP reporting guide documented this brand halo attribution with a 14-day last-touch lookback, and halo sales show association rather than proof of incremental effect.

A managed service is the buying model in which a platform's own staff run campaigns for a fee. Amazon's managed tier typically requires a minimum spend of $50,000, and in May 2025 Criteo disclosed that its largest retail media client would stop using its managed services.

Under-delivery is the gap between what an ad order promised and what it served. Guaranteed buys trigger makegoods when they fall short, while auction campaigns owe nothing, and in December 2022 Netflix let advertisers reclaim money for ads that had not run.