The Italian data protection authority has fined Meta 805 million euros over access to photo galleries for 20 million users without specific consent on the Android app.
The decision marks the largest sanction ever issued by the Italian regulator. Officials targeted a feature launched in 2023 that surfaced device media while users browsed the social network.
Investigators launched the probe in July 2025 following a report from the Centro Tutela Consumatori Utenti in Bolzano. Technical checks revealed that general operating system permissions allowed continuous access to device storage.
The regulator said that the setup violated Article 122 of the Privacy Code, which implements European rules on electronic communications. The authority said that the company did not provide sufficiently clear information or require a distinct opt-in for the photo suggestion tool.
Dispute Over Proportionality and Legal Action
Meta strongly rejected the findings and announced plans to challenge the ruling in court.
“Siamo in netto disaccordo con la valutazione dei fatti e con l’applicazione della normativa da parte del Garante e riteniamo sproporzionato l’importo della sanzione,” said a spokesperson for Meta.
The company defended the feature as a tool designed to help users share media easily. Representatives maintained that individuals grant initial permissions through their device settings and can revoke them at any time.
“Intendiamo presentare ricorso,” the spokesperson told lacapitalenews.it.
The penalty accounts for approximately 0.47 percent of the parent group’s worldwide turnover. The regulator cited the duration of the violation and insufficient cooperation during the inquiry as factors in calculating the amount.
Meta Must Adjust App Functionality and Meet Deadlines
The enforcement order instructs Meta to modify the app functionality within sixty days. The platform must implement a dedicated consent prompt, explain the consequences of gallery access clearly, and provide simple disable controls.
Photo suggestions must be turned off by default for all users, including those who previously granted broad system permissions. Meta must report its initial compliance steps to the authority within thirty days and complete all required technical adjustments within ninety days.
A separate examination will review cloud processing systems linked to a function introduced in 2026. Meta said that it does not use the personal photographs in question to train artificial intelligence models.
