ع
The Italian Data Protection Authority, known as the Garante, fined Meta Platforms 805 million euros after determining that the Facebook app on Android devices had accessed photographs, videos and related metadata stored on users’ smartphones without obtaining specific consent or providing adequate information. According to the regulator’s statement reported by Reuters and Bloomberg, the case centered on a feature introduced in 2023 that suggested content from a user’s personal gallery for posting while browsing the app. The authority found that the permission request used a generic prompt about enabling other functions, which did not allow users to understand they were authorizing gallery access, and the option was enabled by default.
An investigation launched in July 2025 followed a complaint from the Bolzano Consumer and User Protection Centre, with the Garante conducting its own technical analysis that confirmed the single authorisation covered multiple app functions with varying requirements. This mechanism potentially granted permanent access to a device’s entire photo library without verifiable limits on what data was used, Il Sole 24 Ore reported, citing the authority’s findings. The regulator emphasised that such access infringes Article 122 of Italy’s Privacy Code, implementing the EU ePrivacy Directive, which treats the smartphone as part of an individual’s private sphere requiring informed consent regardless of data transmission or harm.
The Garante estimated that roughly 20 million Italian Android users could have been affected by the practice since the feature’s launch. It calculated the penalty as equivalent to about 0.47 percent of Meta’s global revenue while rejecting the company’s argument that jurisdiction lay with the Irish authority, since ePrivacy rules lack the GDPR’s one-stop-shop mechanism. Bloomberg noted that the decision explicitly did not address whether any gallery content had been used to train artificial intelligence models, a practice Meta has denied.
Meta has been ordered to disable the gallery suggestion feature by default and to seek separate, explicit user consent within 60 days, with the authority requiring updates on compliance steps after 30 and 90 days. Reuters reported that the company was not immediately available for comment following the announcement. The regulator indicated it would separately evaluate a newer 2026 feature allowing cloud processing of gallery content.
This fine represents the largest ever imposed by the Italian data protection authority, with Al Jazeera reporting that Meta’s lack of full cooperation and a previous 2019 violation contributed to the scale of the penalty. The Garante acknowledged some remedial changes made by the company after the initial complaint but deemed them limited, late and applicable only to users who updated the app. Such factors weighed against Meta in the final assessment.
The decision adds to Meta’s substantial history of EU privacy penalties, with the company facing approximately 2.83 billion euros in fines from Irish Data Protection Commission rulings alone through late 2024 and further actions since then, according to a PrivacyTerms.io analysis of regulator decisions. Data from the GDPR Enforcement Tracker places the cumulative total for all tracked European privacy fines above 7.59 billion euros across more than 3,400 cases as of November 2026. This latest action underscores ongoing regulatory focus on how technology platforms obtain and manage consent for accessing personal content on mobile devices.
