Italy’s data protection authority has fined Meta Platforms €805 million ($887 million) for accessing Android users’ photo galleries without proper consent.
The penalty, announced on Saturday, equals about 0.47 percent of Meta’s global revenue, according to the Italian Data Protection Agency.
Through the Facebook application for Android devices, Meta accessed photographs, videos and related metadata belonging to Italian users without obtaining specific consent and without properly informing them, the authority said in a statement.
Regulators found that the application requested access to personal image libraries through a single, app-wide authorization preceded by a generic warning. According to the Italian Data Protection Authority, that notification failed to inform users clearly that their galleries were being tapped, and the function was enabled by default.
The regulator found that Facebook requested a single, general permission to access users’ photo galleries, without clearly explaining that this also enabled the gallery-suggestion feature.
“Access to the gallery is requested with a single permission, valid for the entire app and for multiple functions with different needs,” the Italian agency said in a statement.
If granted in full, this type of permission allows the app to read the device’s entire photo archive, usually permanently, without the user or the authorities being able to verify which information is actually being used, the statement reads.
The authority ruled that the practice breached Article 122 of Italy’s Privacy Code, which implements the European Union’s ePrivacy Directive regarding information stored on user terminals. It stressed that accessing information on smartphones requires free and informed consent, regardless of whether personal data is subsequently transmitted or harm is demonstrated.
Approximately 20 million Android users in Italy could have been affected by the feature. The regulator factored in the scale and duration of the violation, Meta’s lack of cooperation, and a previous action against the company in 2019 when calculating the sum.
The agency rejected an objection from Meta that favored Irish regulatory jurisdiction, stating that ePrivacy rules do not incorporate the EU’s single-market one-stop-shop mechanism.
The proceedings did not examine the use of gallery content for training artificial intelligence, a practice Meta denies. Regulators noted they reserved the right to assess a cloud-based gallery processing feature launched separately in 2026.
Meta has 60 days to disable the suggestion tool by default and implement a separate consent request that clearly explains the feature’s purpose.
Under the order, initial compliance measures must be reported within 30 days, with complete implementation details due within 90 days.
Meta has not yet publicly commented on the matter, and the company holds the right to appeal the regulator’s decision.
Earlier coverage: Ireland Fines Tinder Parent €11m for Incomplete User Data Tool Under GDPR
