Italy fines Meta €805 million over Android photo access

Italy's data protection authority said on Saturday, November 14, that it has fined Meta Platforms ↗ 2.90% €805 million ($887 million). The regulator found that the company accessed Android users' photos and videos without their consent and without telling them. According to Politico Europe, it is by far the largest fine the Italian regulator has ever issued.reuters.com+1

The decision centers on the "Get suggestions from your gallery whilst browsing Facebook" feature, available since 2023. It proposes photos and videos from a user's phone gallery as ideas for posts. Through it, Meta reached photographs, videos and related metadata stored on Italian users' smartphones.en.ilsole24ore.com

A single permission for the whole app

The investigation found that Facebook asked for gallery access through one permission covering the entire app. A generic warning came before the request, and it did not make clear that users were also authorizing gallery suggestions. "If granted in full, this type of permission allows the app to read the device's entire photo archive, usually permanently," the authority said. The regulator also found that the feature was switched on by default. It said the practice broke Article 122 of Italy's Privacy Code, which puts the EU's ePrivacy Directive into Italian law.politico.eu+1

The fine was imposed on Meta Platforms Ireland, the company's main European subsidiary. It equals about 0.47% of the group's worldwide revenue. In setting the amount, the authority cited roughly 20 million affected Android users in Italy, a violation that is "still ongoing," and "Meta's lack of cooperation during the investigation". It also took into account an earlier enforcement action against Meta in 2019.aa.com.tr+2

Deadlines and jurisdiction

Meta has 60 days to ask for separate, specific consent for the feature and to explain clearly what it does and how to turn it off. The feature must also be off by default, including for users who already granted permission. The company must report its first steps within 30 days and give details of the measures it has put in place within 90 days.aa.com.tr+1

Meta argued that the case belonged to Ireland's regulator. The authority rejected that objection, saying the ePrivacy rules do not include the EU's "one-stop-shop" mechanism. The case began in July 2025 after a complaint from the Bolzano Consumer Protection Center.politico.eu+1

AI questions left open

The investigation did not look at whether the content was used to train artificial intelligence models, which Meta denies. However, the regulator kept the right to examine separately a feature introduced in 2026 that processes gallery content in the cloud.investing.com

Meta did not immediately respond to requests for comment and can appeal. The penalty comes weeks after authorities in New Mexico ordered Meta in late October to pay $25 billion for misleading residents about how it used their data. Meta called that ruling a "tax" on freedom of expression.lemonde.fr