With the introduction of the Instagram Map feature, Meta expands the scope of sharing by including, in a more direct and structured way, the dimension of geolocation. The idea, at least on a narrative level, is to make the experience more "social", allowing people and content to be displayed on a shared map. The problem, as is often the case with personal data, is not so much the innovation itself, but the way in which it is presented, implemented, and above all understood by users.

Meta insists that the feature is disabled by default and can only be activated with prior consent. Formally, this statement is correct. Substantially, the matter is far more complex. The map is built upon an ecosystem of already granted permissions, geolocated content, and settings layered over time. In this context, many users end up appearing on the map without having a clear awareness of having activated location sharing, or without fully understanding who is able to see it and with what degree of precision.

Here the first legally relevant issue emerges: consent. In personal data protection law, consent is not a mere click, but must be free, specific, informed, and unambiguous. When the user is not truly aware of the extent of the sharing, consent risks becoming an act that is only formally valid, but substantially fragile. The issue is not so much whether the user has "accepted", but whether they were effectively able to understand what they were accepting.

Geolocation, moreover, is not data like any other. It is high-density information, capable of revealing far more than appears on the surface. Through location data, habits, frequently visited places, times of presence and absence, personal relationships, and life contexts can be inferred. For this reason, within the European regulatory framework, location data is considered particularly sensitive and requires enhanced protection. Treating it as just another "social" feature means underestimating its real impact.
‍

A further critical aspect concerns the design of the user experience. Design choices are not neutral, especially when they affect the understanding of privacy settings. If the interface does not immediately clarify the difference between the geolocation of content and that of a person, or if it does not make clear when and to whom the location is visible, the risk is one of only apparent transparency. From a legal standpoint, an opaque user experience directly affects the quality of consent and, ultimately, the compliance of the processing with the principles of fairness and accountability.

‍

The issue becomes even more sensitive when looking at minors. The possibility that young users may be locatable on a social map raises serious questions from the perspective of the enhanced protection provided for by regulations. In this area, relying on settings or user awareness is not sufficient. If a feature is not inherently safe for minors, responsibility cannot be shifted onto individual choices, but must be assumed upstream by the data controller.

‍

Criticism alone, however, is not enough. Solutions exist and do not require technological revolutions. A genuinely expressed consent, built on clear and comprehensible information, greater visibility of the sharing status, a reduction in the precision of the data displayed, and a clear exclusion of minors would be measures perfectly compatible with the platform's architecture. This should be accompanied by greater transparency on the use of location data, especially when it contributes to profiling or monetisation logic.

Ultimately, Instagram Map is not simply a new product feature. It is a test of Meta's credibility on the already heavily undermined ground of personal data protection. Once again, the impression is that the technology was launched before its legal and social implications had been fully addressed. In privacy law, however, the "launch first and fix later" approach is showing its limitations ever more clearly.

Geolocation is neither a detail nor a social game. It is information that exposes and renders people vulnerable. And when protection depends on the user's ability to navigate poorly intuitive settings, the problem is not the user: it is the system.