ROME — The Italian data protection authority, the Garante, said on Saturday it had fined Meta €805 million ($887 million) after finding the Facebook app accessed photos and videos stored on Italian Android users’ phones without their specific consent.
At issue is a Facebook feature, on offer since 2023, called “Get suggestions from your gallery when you browse on Facebook.” In the Garante’s account, Facebook was opening photos, videos and related metadata without specific consent — and without giving users a proper explanation — breaching Italy’s Privacy Code.
One permission for the whole app
It started in July 2025, after the Consumer Protection Centre of Bolzano complained. Its own technical look at the app came next, and the Garante leaned on what that showed when it backed the complaint.
Investigators found a single permission doing the work for the entire app, plus a number of photo and video functions alongside it. First, users are shown a generic prompt, “enable additional features”, which says nothing about gallery suggestions also being switched on.
It was on by default. Once users grant it, the Garante said, Facebook can read the whole photo archive on their phone for good, and neither the user nor the authority can tell what information is actually used.
Article 122 of Italy’s Privacy Code is the rule that was breached. It puts the European ePrivacy directive into Italian law. Under that provision, a smartphone is treated as part of a person’s private sphere, so what it holds can be opened only with free and informed consent, regardless of any transfer of data or any harm.
The Garante also rejected Meta’s objection that the case should go to the Irish privacy regulator. The one-stop-shop procedure, it said, does not apply to proceedings under the ePrivacy rules.
60 days to switch it off by default
Within 60 days, Meta will have to ask for consent through a separate, specific request for the feature, explaining clearly what it is for, that it involves access to the gallery and how to turn it off.
The feature will remain turned off by default, including for users who have already granted the authorisation. If the deadline passes without the change, the feature cannot be activated for users who have not given valid consent.
Meta will also have to report its planned initiatives to the Garante within 30 days, and the measures it has adopted within 90 days.
About 20 million users in Italy
While determining the amount of the fine, the Garante took into account about 20 million Android users in Italy and a violation it said is still continuing, for users who have not updated the app and under authorisations already granted.
It also took into account an earlier measure against the company in 2019 and scant cooperation during the inquiry. However, the Garante gave Meta some credit, as mitigation, for changes made after the complaint, but called those changes late and noted they reached only users who update the app.
Overall, the fine comes out to be around 0.47% of its worldwide turnover. Using gallery material for AI training was outside the scope of this proceeding, the authority said, and Meta has denied any such use. A separate assessment is reserved for a cloud-processing feature introduced in 2026.
Meta was not immediately available for comment, Reuters reported.