Italy Fines Meta €805M Over Facebook Android Gallery Access

Italy’s data protection authority, the Garante, has fined Meta €805 million over a Facebook for Android feature that suggests photos and videos from a phone’s gallery for users to post, according to The Hacker News. The authority found the feature was enabled by default and that the app accessed Italian users’ photos, videos and related metadata without explicit consent.

What the Garante ordered

Meta has 60 days to switch the feature off by default, including for people who have already granted the app gallery access, and to ask for consent through a separate, specific request that explains what the feature does and how to turn it off. It must report on work started within 30 days and on measures taken within 90 days. If it misses the 60-day deadline, the feature cannot be switched on for anyone without valid consent.

Meta says it will appeal and calls the fine “disproportionate”. A spokesperson also said the feature works only after users give permission on their device and that the permission can be changed in settings at any time, in a statement reported by Reuters.

The consent problem

The core finding is about permission design. The app asks for gallery access through a single permission that covers the whole app and several functions with different purposes. A general notice about enabling other features appears first, but it does not make clear that users are also enabling gallery suggestions. Once granted in full, a permission like this lets an app read the whole photo archive, usually on an ongoing basis, and neither the user nor the regulator can verify which information is actually used.

The Garante found a breach of Article 122 of Italy’s Privacy Code, which transposes the EU ePrivacy Directive. That rule treats the phone as part of a person’s private life, so any access to what it stores requires free and informed consent, whether or not data is sent anywhere or harm results.

Scope and open questions

The fine is about 0.47% of Meta’s global revenue. The authority weighed roughly 20 million Android users in Italy, the length of the breach (the feature has existed since 2023, and the investigation began in July 2025), a 2019 decision against the company, and limited cooperation. Changes Meta made after the complaint counted in its favor, though the authority judged them late and limited to people who update the app.

The investigation did not examine whether gallery content was used to train AI models, which Meta denies. The authority may separately look at a newer feature that allows gallery content to be processed in the cloud. Meta had argued Ireland’s regulator should handle the case, and the Garante rejected that because ePrivacy rules have no one-stop-shop mechanism.

Analysis: the ruling matters beyond Italy because it treats a bundled OS-level permission as insufficient consent for a specific feature. Mobile developers who lean on one broad grant to power several functions should expect more scrutiny of that pattern. For users, the practical step is the one a consumer group advised in July 2025: check what access the Facebook app has on the phone and turn off gallery suggestions if unwanted.

Related coverage: Android November patches fix 200+ flaws and preinstalled malware in low-cost Android phones.