Italy fines Meta €805m over Android photo privacy access

Italian regulators have fined Meta €805 million for accessing Android users' photos and videos without their specific consent. The penalty was announced by Italy's Data Protection Authority, known as Garante, and concerns a Facebook app feature that suggested images from a phone gallery for posts. The authority said the company had not properly informed users that the app could access photos, videos and related metadata stored on their smartphones.

The case centres on the "Get suggestions from gallery when browsing Facebook" function, which was enabled by default on Android devices. According to the regulator, Facebook sought a single app-wide permission, but the notice given to users did not make clear that this would also allow the app to generate post suggestions from gallery content. Garante said the consent process was too generic and did not allow users to understand the specific permissions they were granting.

The authority said the feature may have affected about 20 million Italian Android users. It also ordered Meta to disable the setting by default and to seek separate consent from users. Garante said the size of the fine reflected the large number of people affected and what it described as a lack of cooperation from the company.

It also said a previous violation, which led to a 2019 fine, was taken into account. The penalty is one of the largest ever imposed by an Italian regulator and adds to wider scrutiny of how major technology companies handle personal data. It also comes at a time when European privacy rules continue to shape the design of platform features that rely on user permissions.

In this case, the regulator said the issue was not simply whether access existed, but whether users were clearly told what that access would allow the app to do. The decision is also significant because it concerns a default setting rather than an optional feature that users actively chose. That makes the case relevant to broader debates over consent design, especially where mobile apps request broad permissions that can cover multiple uses of personal data.

The regulator said the feature remained relevant for users who had not updated the app and for those who had already given consent to the system. Meta has not publicly commented on the decision, according to the supplied reports, and it has the right to appeal. The proceedings did not address whether content from users' galleries was used to train artificial intelligence, and Meta denies that allegation.

The fine was reported as €805 million, or about $887 million, which the regulator said amounted to roughly 0.47% of Meta's global turnover. The case follows earlier enforcement action against the company in Italy and adds to a series of privacy and business-practice disputes involving major technology platforms. It also highlights the role of Garante in applying Italy's law implementing the EU ePrivacy directive.

The regulator's order gives Meta 60 days to change the default setting and revise the consent flow, making the next steps a matter of compliance as well as possible legal challenge. What remains unclear is how quickly the company will respond and whether it will contest the ruling. It is also not yet clear how the changes will be implemented for users who already accepted the current permission flow.

The key issue to watch is whether the feature is disabled as ordered and whether the appeal process alters the scope or timing of the penalty.

#Italy #Meta #privacy #Android #Facebook