Meta Platforms, Inc. has been penalized by Italy’s data protection authority, Garante, with a substantial €805 million fine. The penalty was issued due to a Facebook for Android feature that automatically suggests users’ photos and videos for sharing, which accessed content from phone galleries without explicit user consent.
Default Access Without Explicit User Approval
The Garante’s investigation revealed that the feature operated by default, allowing the app to access and suggest photos and videos from users’ devices without clear, express permission. Meta now faces a 60-day deadline to disable the feature by default for all users, including those who had previously consented, and to obtain explicit consent separately.
In response, Meta announced plans to appeal the decision, describing the fine as disproportionate. The company contends that the feature activates only after users grant the app broad permission, which covers multiple functionalities across the platform.
Legal Implications and Required Changes
The Italian authority identified a breach of Article 122 of the nation’s Privacy Code, aligned with the EU’s ePrivacy Directive. This legislation treats the data stored on an individual’s phone as part of their private life, mandating free and informed consent for any access.
Garante’s mandate requires Meta to clearly inform users about the feature’s purpose, its access to their gallery, and how to deactivate it. Meta must report initial compliance steps within 30 days and full compliance within 90 days. Failure to meet the 60-day consent acquisition requirement will prevent the feature from being enabled for any user who hasn’t provided valid consent.
Ongoing Investigation and Wider Implications
The examination, which began in July 2025, did not assess whether the gallery data were utilized for training artificial intelligence models, though Meta has denied such use. The Garante suggested further scrutiny might occur regarding a newer feature that processes gallery content in the cloud.
The fine represents approximately 0.47% of Meta’s global revenue, reflecting the extensive user base affected—around 20 million Android users in Italy—and the breach’s duration. Although Meta had proposed that Ireland’s data protection authority should oversee the case, the Garante rejected this, citing the lack of a one-stop-shop mechanism in ePrivacy regulations.
Consumer advocacy groups, like the Centro Tutela Consumatori Utenti in Bolzano, have advised users to disable the gallery suggestion feature and regularly review app permissions. The Garante’s decision underscores the importance of stringent data protection measures and could influence future regulatory actions in Europe and beyond.
