The Italian Data Protection Authority has fined Meta Platforms Ireland Limited 805 million euros for having accessed, through the Facebook app for Android, photographs, videos, and metadata stored on the phones of Italian users without obtaining their specific consent or providing them with adequate information.
The ruling focuses on the function "Get suggestions from your gallery while browsing Facebook," which has been operational since 2023 and proposes to the user images and clips from the device’s gallery for possible publication on the platform.
The procedure began in July 2025 following a complaint from the Bolzano Consumer Protection Center, based on a technical analysis carried out by the Authority itself.
As the body details, the application requests access to the gallery through a single global authorization, valid for the entire app and for different functionalities with diverse purposes, preceded by a generic notice called "enable other functions," which prevents the user from understanding that they are also consenting to the use of gallery suggestions. In addition, this option was enabled by default.
When the user fully accepts that permission, the app can read the entire photographic file of the device, generally in a continuous manner, without either the affected party or the Authority being able to verify which specific data is being used.
The Authority considers that this behavior violates Article 122 of the Privacy Code, which transposes the European directive on privacy in electronic communications and protects the smartphone as an essential element within each person’s private sphere.
Consequently, any access to the information contained on the terminal requires free and informed consent, regardless of whether data transmission occurs or not, or whether a demonstrable harm exists. The regulator has also dismissed Meta’s allegation regarding the Authority’s lack of competence because the company has its headquarters in Ireland.
"Within a period of 60 days Meta must request consent through a separate and specific request for the function and clearly explain to users what it is for, what access to the gallery involves, and how to disable it," the opinion states.
Likewise, the company will be required to keep the function disabled by default, even for those who have already granted the permission, and once the set period has elapsed, it may not be activated for those users who have not provided valid consent.
To calculate the amount of the fine, the body has taken into account the volume of people potentially affected —around 20 million Android users in Italy—, the extension of the infringement, which remains in effect for those who have not updated the app and for those who already granted the authorization, a prior order issued in 2019 against the company, and the limited cooperation shown during the investigation.
As mitigating factors, the changes introduced after the report have been assessed, although they are considered late and limited only to those who update the app. The amount is approximately 0.47% of the group’s total turnover.
"We strongly disagree with the assessment of the facts and with the application of the legislation by the Garante, and we believe that the amount of the fine is disproportionate," a Meta spokesperson has argued.
"This is a simple feature that allows users to publish photos and videos on Facebook. Users must grant permission on their device for the feature to be active and they can modify this permission at any time in the settings. We intend to file an appeal," he added.