Italy Fines Meta €805 Million Over Facebook Access to Android Photo Galleries

Italy’s data protection authority fined Meta Platforms Ireland €805 million on November 14 after finding that Facebook’s Android app accessed users’ photographs, videos and related metadata without specific, informed consent. The regulator ordered Meta to switch the gallery-suggestion feature off by default and obtain separate consent within 60 days.

The decision concerns “Get suggestions from gallery when browsing Facebook,” a feature available since 2023. It offers users images and videos from their phone galleries as possible Facebook posts. According to the authority’s formal announcement, Facebook relied on a single Android permission that covered several app functions with different purposes. A generic notice about enabling additional features did not tell people clearly that the gallery-suggestion system was included, while the option itself was preset as active.

That distinction is the heart of the case. A person may allow an app to reach device storage without knowingly agreeing to a particular, continuing use of the entire photo archive and its metadata. Italy’s Garante said the arrangement could expose the full gallery, normally on a permanent basis, without giving either users or the authority a way to see which information Facebook actually used.

The regulator estimated that roughly 20 million Android users in Italy were affected. It said the fine equals about 0.47 percent of Meta’s worldwide group revenue. The Associated Press independently reported the decision and the regulator’s finding that the feature violated the European ePrivacy rules incorporated into Italian law.

Meta disputes that account. A company spokesperson told Reuters that Meta would appeal, called the penalty disproportionate and said the feature simply helps people share photos and videos. The spokesperson argued that users must grant device permission before it operates and can change that permission in their settings. The regulator’s answer is that a general operating-system permission does not replace the specific and informed consent required for this particular function.

FILE — An early Facebook Android app on a smartphone, photographed August 4, 2010. Photo: Johan Larsson / Wikimedia Commons, CC BY 2.0. Cropped for display; the image does not show the gallery-suggestion feature at issue.

The investigation began in July 2025 after a referral from a consumer-protection center in Bolzano and included a technical analysis by the authority. In setting the penalty, the Garante cited the number of people involved, the duration of the conduct, an earlier 2019 decision and what it described as Meta’s limited cooperation. It treated changes made after the referral as mitigating, but said they came late and applied only to people who updated the app.

The case did not determine whether Meta used gallery content to train artificial-intelligence systems. Meta denies doing so, and the authority explicitly kept that question outside this proceeding. It also reserved judgment on a separate feature introduced in 2026 that allows gallery content to be processed in the cloud. That boundary matters: a large penalty is not a license to attach unproven AI claims to the decision.

The ruling instead exposes a more basic conflict over how consent is designed. Platforms often present permissions as a single gateway to a bundle of services, while regulators increasingly insist that access be tied to a specific purpose a user can understand and refuse. Italy grounded its action in Article 122 of its privacy code, which implements the EU’s ePrivacy directive and treats the smartphone as part of a person’s private sphere.

Meta also argued that the matter belonged with Ireland’s regulator because its European headquarters are there. The Italian authority rejected that jurisdictional objection, saying the ePrivacy framework does not use the same one-stop-shop mechanism associated with other European data-protection enforcement. The result is a direct national challenge to a U.S. platform whose technical choices operate across borders.

That challenge sits beside Europe’s broader attempt to shape digital development, including the recent EU agenda on AI safety, technological sovereignty and employment. But the Italian order is unusually concrete: change the default, separate the consent request, explain the purpose, report initial steps within 30 days and complete the measures within 90 days.

The appeal will determine whether the penalty survives. For now, the order establishes a clear principle with consequences beyond one Facebook setting: permission to enter a device is not unlimited permission to turn private archives into a platform’s pool of suggested content.

Hero image: Meta Platforms headquarters in Menlo Park, California, March 27, 2022; photograph by LPS.1, CC0 via Wikimedia Commons. Cropped for the locked Pamphlets V9 card.