1. United States
2. Texas
3. Letter

Recent reporting in The Standard (Evening Standard) describes a Facebook feature that, when active, analyzes people, objects, and dates in users’ camera roll photos (including photos not explicitly uploaded) to generate collages, recap posts, or AI versions. Users reported discovering two “camera roll sharing suggestions” toggles enabled and claimed they had not seen a permission prompt, while the guidance focused on how to turn the settings off. Regardless of disputed consent flows, this episode underscores the core problem: features that reach into local, private content and settings should be off by default and must never be enabled (or re-enabled) without explicit, granular, revocable opt-in. I am writing to urge Congress to act decisively to protect Americans’ privacy and autonomy by prohibiting companies and organizations from (1) introducing unnecessarily, highly privacy-invasive features and (2) switching or re-enabling settings on users’ devices, apps, and accounts without the users’ explicit, informed, and revocable consent. Even when a notice is shown, companies have no business changing people’s configurations for them. Users (and only users) should control their device, app, and account settings. The Problems Unnecessary, highly privacy-invasive features: Platforms have rolled out features that scan or upload local content, expand cross-app tracking, or continuously collect sensitive telemetry, often unrelated to the core service and offering marginal value relative to the privacy risk. Unilateral changes to user settings: Vendors sometimes flip toggles, migrate defaults, re-enable previously disabled features after updates, or run A/B tests that alter data-sharing and permissions, frequently without clear, up-front, per-setting consent or with notices that are easy to miss. This undermines user intent and creates real risks for families, professionals bound by confidentiality, and vulnerable communities. “Notice” is not ownership: Regardless of whether a popup or email was sent, the principle must be simple: configuration belongs to the user. A company should not change settings on a person’s behalf. At most, it may ask, clearly and specifically, and only proceed if the user explicitly opts in. Americans deserve technology that respects their choices. The path forward is clear: prohibit unilateral configuration changes; require explicit, granular consent; and enshrine the principle that users (and only users) control their device, app, and account settings. I respectfully urge you to hold hearings, advance legislation, and ensure strong oversight to restore user control and trust. Thank you for your attention to this urgent matter.