Meta will appeal the €805 million fine imposed by the Italian Garante over Facebook for Android accessing photos, videos and metadata on phones without specific consent. The company maintains that the feature is activated only with the device's authorization; the authority considers that the request did not clearly explain what the access would be used for.
The measure concerns «Ottieni suggerimenti dalla galleria quando navighi su Facebook» —«Get suggestions from your gallery while browsing Facebook»—, which proposes images and videos saved on the phone as ideas for posts. According to the Garante, the app could also access their metadata, such as the date a photo was taken or added to favorites.
One authorization for the entire app
The investigation began in July 2025, following a complaint by the Bolzano Consumer Protection Center. The authority examined how the app requested access to the gallery and concluded that a single authorization applied to all of Facebook, even though its features had different needs.
In addition, the request appeared after a generic notice to «enable other features». The Garante said that this message did not make it clear that accepting the permission would also enable gallery suggestions. The option was also enabled by default.
According to the authority, the permission could allow Facebook to permanently read all the content in the gallery, without users being able to check which specific data was being used. The company, for its part, has argued that access requires authorization on the device and that the feature can be changed in settings.
A Meta spokesperson told ANSA:
«in netto disaccordo con la valutazione dei fatti e l'applicazione della normativa»
— A Meta spokesperson
The spokesperson called the fine disproportionate and described the tool as a feature to support posting. Meta says it is activated only after permission is granted on the device and can be changed in settings.
The grounds for the fine and its scope
The Garante considered the practice to violate Article 122 of the Italian Privacy Code, which requires free and informed consent to access data. The authority maintains that the rule applies even if the content does not leave the phone and even if no harm has occurred. ANSA explains that this article incorporates the European ePrivacy Directive.
Meta argued that the Irish authority should handle the matter, given that the company's European headquarters are in Ireland. The Garante rejected that objection: according to TNW and ANSA, the ePrivacy rules applied in this case do not provide for the one-stop-shop mechanism that allows a regulator to lead certain proceedings under the GDPR.
The fine amounts to around 0.47% of Meta's global revenue, according to ANSA and TNW. In setting it, the Garante took into account that the feature affected around 20 million Android users in Italy, the duration of the infringement—which was ongoing for users who had not updated the app or had already granted permission—and the company's limited cooperation during the investigation.
A 2019 precedent against Meta also weighed in, according to ANSA and TNW. The changes the company made after the complaint counted in its favor, but the Garante considered them late and limited to users who updated the app. TNW puts the fine below the €1.2 billion imposed on Meta over data transfers and close to the Netherlands' €825 million fine against Uber.
Sixty days to change the feature
Meta will have 60 days to request specific consent and clearly explain what the feature is for, that it involves accessing the gallery, and how to disable it. It must also leave it off by default, including for users who had already granted permission. ANSA adds that once this deadline has passed, the tool must be blocked for anyone without valid consent.
ANSA also reports two follow-up deadlines: Meta will have 30 days to report on the initiatives undertaken and 90 days to account for the measures adopted. These deadlines are in addition to the changes the company must make to the settings and authorization process.
The decision did not examine whether Facebook used the images to train artificial intelligence models. The Garante could open another proceeding concerning a cloud-processing feature launched in 2026, which allows users to upload multimedia content when they enable suggestions for creative ideas. TNW notes that Meta denies using these images to train AI.
The decision also does not mention an equivalent feature in the iOS app, according to Punto Informatico. The investigation and obligations described focus on Facebook for Android; the sources do not report any measures concerning Apple's version.
Meta's announced appeal
The company believes that the Garante assessed the facts incorrectly and misapplied the rules, according to the statement reported by ANSA. The company also disputes the proportionality of the fine.
Meta announced that it will appeal the decision. The company must separate consent for gallery suggestions and keep the feature disabled by default. The possible investigation into cloud processing remains pending a decision by the Garante.
Sources: Punto Informatico, TNW | Insider, Garante per la protezione dei dati personali, Agenzia ANSA, euronews
