alt Hacker NewsClear consent under the GDPR requires that you state the purpose for every different use of data and ask consent separately.
Giving access to photos so that the user can upload a photo is not giving consent to analyze all the photos of the user on a phone.
The main principle of the GDPR is to store and use as little private data as possible and only get/store data when the user explicitly asks for it/consents to it.
(IANAL of course.)
> Giving access to photos so that the user can upload a photo is not giving consent to analyze all the photos of the user on a phone.
What they were found guilty of doing is suggesting to the user they might want to upload a photo. All on-device, not uploading anything.