Italy’s data protection authority fined Meta €805 million because Facebook for Android accessed photos, videos and metadata stored on Italian users’ phones without specific consent or adequate information. The penalty concerns a feature that suggests images from the gallery while users browse the social network.
The feature, called «Ottieni suggerimenti dalla galleria quando navighi su Facebook» («Get suggestions from your gallery while browsing Facebook»), displays photos and videos from the phone as potential posts. The authority says that access also included the metadata of those files. The measure applies to the Facebook version for Android devices.
«la società ha avuto accesso a fotografie, video e relativi metadati conservati negli smartphone degli utenti italiani senza aver acquisito un consenso specifico e senza averli adeguatamente informati»
— the Garante per la protezione dei dati personali, according to ANSA
A general permission to access the gallery
According to the decision described by The Next Web, Facebook requested permission to access the gallery through a general authorization for the app. The request appeared after a vague notice to enable other features. For this reason, the regulator argues, users could not know that accepting it would also enable photo and video suggestions.
The issue is not limited to whether the images left the phone or whether demonstrable harm occurred. The authority applied Article 122 of the Italian Privacy Code, which considers a phone part of a person’s private sphere and requires free and informed consent to access what it stores. According to The Next Web, the rule applies even if the data does not leave the device and no harm occurs.
The regulator estimates that around 20 million Android users in Italy were affected. It also took into account a previous decision against Meta from 2019 and what it described as poor cooperation during the case. The company was credited with making changes after the complaint, although the authority considered them late and limited to users who updated the app.
Meta must change consent and the default setting
The penalty requires Meta to request, within 60 days, separate and specific consent for gallery suggestions. In addition, the feature must remain disabled by default, including for people who had already granted access to their photos. Euronews also reported that the measure requires the feature not to be activated automatically for users.
The decision is based on Italian privacy rules and the European electronic communications framework, not on the usual mechanism of the General Data Protection Regulation (GDPR). Meta’s European headquarters are in Ireland, and the company argued that the case fell under the Irish regulator, which normally leads GDPR enforcement against the company. The authority rejected that argument: it acted under ePrivacy rules, which, according to The Next Web, do not have a one-stop-shop system.
The fine amounts to approximately 0.47% of Meta’s global revenue, according to The Next Web, which also puts it at around $887 million. The amount is close to the €825 million fine imposed on Uber by the Netherlands, but below the €1.2 billion Meta received for a GDPR violation related to data transfers.
The investigation leaves AI training out of scope
The case did not examine whether Meta used gallery content to train artificial intelligence systems; the company denies doing so. The authority will separately examine a cloud-processing feature that Meta launched in 2026. This is a separate investigation, distinct from the penalty over suggestions that appear while browsing Facebook.
The decision comes as Meta is also embroiled in a dispute with Italy over a decision concerning payments to publishers. The Next Web reported that Reuters had not received an immediate response from Meta when it reported the case; no public reaction from the company to the fine is included.
A feature available since 2023
The case began with an option introduced in 2023: while browsing Facebook, the app offers photos and videos saved on the phone for users to consider as posts. The authority concluded that the way the app requested access to the gallery did not adequately explain that this permission also enabled suggestions.
The order sets a specific deadline for changing how the feature works: 60 days to separate consent and leave the feature switched off by default, including on accounts that have already authorized access to the gallery. The investigation into 2026 cloud processing will continue separately.
Sources: TNW | Insider, Garante per la protezione dei dati personali, Agenzia ANSA, euronews
