Italy’s Garante Fines Meta €805 Million Over Facebook Android Gallery Access

Italy

The Italian Data Protection Authority, known as the Garante, said in a statement on Nov. 14 that it had fined Meta Platforms Ireland Limited €805 million, finding that the Facebook app for Android had accessed photos, videos and related metadata stored on Italian users’ smartphones without specific consent and without properly informing them. The measure concerns a feature available since 2023, “Get tips from your gallery while browsing Facebook,” which suggests photos and videos from a phone’s gallery as ideas for posts. The authority said about 20 million Android users in Italy were affected.

The investigation started in July 2025 after a report from the Bolzano Consumer Protection Center and relied on a technical analysis by the authority. The Garante said gallery access was requested with a single permission, valid for the entire app and for multiple functions with different needs; that the request was preceded by a generic notice to “enable other features,” which did not make clear that gallery suggestions were also being authorized; and that the feature was switched on by default. If fully granted, the authority said, such an authorization allows the app to read the entire photo archive on the device, usually permanently, “without the user or the Authority being able to verify what information is actually being used.”

The rule broken, the Garante said, is Article 122 of Italy’s Privacy Code, which implements the European ePrivacy Directive and treats the smartphone as part of a person’s private sphere. Any access to the information it contains therefore requires free and informed consent, “regardless of data transmission or the existence of harm.” Meta had argued that the Irish authority should handle the case. The Garante rejected that objection, saying the ePrivacy rules do not provide for the “one-stop shop” mechanism.

In setting the amount, the authority cited the high number of people involved, the duration of the violation, a previous 2019 measure against the company, and what it described as limited cooperation during the investigation. Changes Meta made after the report were treated as mitigating, though the Garante judged them late and limited to users who update the app. The violation, the authority said, is still ongoing for people who have not updated the app or who have already granted the system permission. The fine is about 0.47% of the group’s global revenue.

Within 60 days, Meta must request consent in a separate and specific way for the feature, clearly explain what it is for, that it involves access to the gallery, and how to turn it off, and keep the feature off by default, including for people who have already granted the authorization. If the deadline passes without compliance, the feature cannot be activated for users who have not given valid consent. The company must tell the Garante within 30 days what steps it has started and within 90 days what measures it has taken.

The proceeding did not concern the possible use of the content to train artificial intelligence, which Meta denies. A Meta spokesperson told Reuters the company would appeal, strongly disagreeing with the decision and calling the fine “disproportionate.” “This is a simple feature that helps people share photos and videos on Facebook. Users must grant permission on their device before the feature can operate, and they can change that permission at any time in their settings,” the spokesperson said.

The Garante said it reserved the right to evaluate separately a new feature, launched in 2026, that allows cloud processing of gallery content.