Italy fines Meta 805 million euros for accessing Facebook’s Android gallery without explicit consent
Meta was fined 805 million euros in Italy yesterday over a Facebook for Android feature that suggests users post photos and videos from users’ phone galleries.
Garante, the Italian data protection authority, found that the feature was enabled by default and that the app was accessing Italian users’ photos, videos and associated metadata without their explicit consent.
The company has 60 days to turn off the feature by default, including for people who have already granted access to the App Gallery, and to request consent separately.
Meta plans to appeal and calls the fine “disproportionate”, a spokesperson said in a statement reported by Reuters.
The app requests access to the gallery through a single permission that covers the entire app and multiple functions with different purposes, the authority found. A general notice about enabling other features appears first, but it doesn’t make it clear to users that they are also enabling gallery suggestions.
Fully granted, a permission like this allows the app to read the phone’s entire photo archive, usually continuously. Neither the user nor the authority can verify which information is actually used.
The authority found a violation of Article 122 of the Italian Privacy Code, which transposes the European Privacy and Privacy Directive into Italian law. This rule considers the phone as part of a person’s private life. Any access to what the phone stores therefore requires free and informed consent, regardless of whether the data is sent anywhere or harms the results.
The authority’s order, included in its press release, requires the company to:
- Within 60 days, request consent via a separate, specific request for this feature, and clearly explain what the feature is for, that it accesses the gallery, and how to disable it.
- Within 60 days, turn off the feature by default, including for people who have already granted permission.
- Within 30 days, report to the authority on the work it has started, and within 90 days, on the measures it has taken.
If the company does not meet the 60-day deadline, the feature cannot be activated for anyone who has not provided valid consent.
Meta said in a statement cited in a Reuters report that the feature only works after users give permission on their device and they can change that permission at any time in their settings.
The Centro Tutela Consumatori Utenti, the Bolzano consumer protection group whose complaint opened the investigation, published consumer advice on July 11, 2025. It asks users to disable gallery suggestion settings in the app and to check what access and permissions the Facebook app has on their phone.
The investigation did not examine whether gallery content was used to train AI models. The company denies such use. The authority could separately examine a newer feature, launched this year, that allows gallery content to be processed in the cloud.
The company had argued that the Irish data protection authority should take up the matter. The Garante rejected this argument because the ePrivacy rules do not provide for a one-stop shop mechanism.
This feature has been available since 2023. The investigation began in July 2025 and included the authority’s own technical analysis.
The fine is equivalent to approximately 0.47% of the group’s overall turnover. In setting it, the authority took into account the large number of people involved, around 20 million Android users in Italy.
It also assessed the duration of the violation. The violation is still ongoing for people who have not updated the app and for those who have already granted permission, the authority said.
Other factors were a 2019 ruling against the company and limited cooperation during the investigation. The changes made by the company after the complaint worked in its favor, although the authority considered them late and limited to people who update the application.
Gn bussni
