The Italian Data Protection Authority fined Meta Platforms Ireland Limited €805 million over a Facebook Android feature, saying it accessed Italian users’ photos, videos and metadata without specific consent or adequate notice.
Available since 2023, the feature displayed photos and videos from a phone gallery as possible posts while people browsed Facebook. The authority said one Android permission covered several app functions, while a general notice did not flag the gallery suggestions. According to the authority, Facebook enabled the feature by default.
Within 60 days, Meta must leave the feature off unless a user provides separate, specific consent. The company must explain the feature’s purpose, disclose that it accesses the gallery and tell users how to disable it. After the deadline, Meta cannot activate it for users without valid consent. The authority also required an account of the company’s initiatives within 30 days and a report on measures taken within 90 days.
The authority estimated that about 20 million Android users in Italy were affected. It said the fine amounted to about 0.47% of the group’s global revenue. CNA reported a dollar equivalent of $887 million.
In setting the penalty, the authority considered the number of people affected, how long the practice continued, a 2019 measure against Meta and the company’s limited cooperation. It gave some weight to changes Meta made after a consumer complaint, but said they came too late and reached only people who updated the app.
The authority invoked Article 122 of Italy’s Privacy Code, the national provision implementing the EU’s ePrivacy Directive. The authority said the provision requires free and informed consent before an app accesses information stored on a smartphone.
CNA reported that a Meta spokesperson said the company would appeal and called the fine “disproportionate.” The spokesperson said the feature requires device permission and users can change that permission in settings.
The authority did not assess whether Meta used gallery content to train artificial-intelligence models, a use the company denies. It said it may examine separately a cloud-processing feature launched in 2026. Meta’s first report, outlining its initiatives, is due within 30 days.
