Italy has fined Meta Platforms €805 million ($887 million) over Facebook’s access to photographs, videos and related metadata stored on Android smartphones, intensifying scrutiny of how technology companies obtain permission to access personal information.
The penalty announced on November 14 followed an investigation by Italy’s Data Protection Authority, which determined that Facebook accessed users’ photo galleries without sufficiently informing them or obtaining specific consent.
The regulator estimated that approximately 20 million Android users in Italy were affected and ordered Meta to change the feature’s consent process within 60 days.
Meta disputes the findings and plans to appeal, arguing that users already grant device-level permission before the feature operates.
Facebook’s Photo Suggestions Trigger Privacy Investigation
The case centers on a Facebook feature called “Get suggestions from gallery when browsing Facebook,” introduced in 2023.
The feature suggests photographs and videos from a user’s smartphone gallery as potential Facebook posts.
According to the Italian regulator’s investigation, the application requested gallery access through a single permission covering multiple functions with different purposes.
Users received a general notification about enabling additional features, which investigators said failed to explain that permission would also activate gallery-based suggestions.
The authority found that the feature was enabled by default. Once broad permission was granted, the application could potentially access the device’s entire photo archive without users knowing precisely which information was being processed.
The investigation began in July 2025 following a complaint from the Bolzano Consumer Protection Center.
Meta Challenges Fine and Defends Its Permission System
A Meta spokesperson told Reuters that the company strongly disagreed with the decision and considered the fine “disproportionate.”
The company maintained that its photo suggestion feature helps users share content and requires permission through Android’s operating system.
Meta also argued that users could modify those permissions through their device settings.
However, the regulator distinguished between granting general access to a smartphone gallery and knowingly authorizing a particular Facebook feature to use that access.
The authority concluded that the practice violated Article 122 of Italy’s Privacy Code, which implements the European Union’s ePrivacy Directive.
It also rejected Meta’s jurisdictional objection favoring Ireland, finding that the ePrivacy framework did not apply the same one-stop-shop mechanism.
Regulator Orders Separate Consent Within 60 Days
Under the regulatory decision, Meta must disable gallery suggestions by default and introduce a separate, specific consent request explaining the feature’s purpose and how users can deactivate it.
The requirement applies even to users who previously granted access.
Meta must report its initial corrective initiatives within 30 days and describe its implemented measures within 90 days.
In determining the penalty, the authority considered the number of affected users, the duration of the infringement, a previous 2019 ruling and what it described as limited cooperation during the investigation.
The fine represents approximately 0.47% of Meta’s global revenue.
The regulator acknowledged some modifications Meta introduced after the complaint but considered them insufficient.
AI Training Remains Outside the Investigation
The authority clarified that its proceedings did not examine whether photographs or videos were used to train artificial intelligence models, something Meta denied.
It separately reserved the right to investigate a 2026 cloud-processing feature that allows gallery content to be processed remotely.
The distinction matters because the present decision concerns consent for accessing information stored on smartphones, not an established finding of unauthorized AI training.
For developers and technology companies, the ruling highlights the growing importance of purpose-specific permissions and privacy-conscious product design.
A user granting technical access to a device does not necessarily mean they have knowingly agreed to every feature capable of using that permission.
The case illustrates how seemingly convenient product features can create substantial regulatory risks when consent mechanisms fail to explain what personal information is being accessed and why.
