Italy’s data protection authority has fined Meta €805 million because the Facebook app for Android reached into users’ phone galleries without asking for specific permission. The regulator, the Garante, says the feature that suggests photos and videos to post was switched on by default and hidden behind a vague prompt.
Meta has 60 days to ask for consent in a separate, clearly worded request, and to turn the feature off by default, including for people who already said yes. The penalty equals roughly 0.47% of what the Meta group earns worldwide.
The Garante’s decision, dated 14 November, concerns the “Get tips from your gallery while browsing Facebook” option, available since 2023. The app asked for gallery access with one permission covering the whole app and several features, and the notice before it only said to enable “other features”. Once granted in full, the regulator says, such a permission lets the app read the whole photo archive on the phone, usually permanently, with no way for the user or the authority to check what is actually used.
The case began in July 2025 with a complaint from a consumer protection centre in Bolzano, followed by a technical analysis by the Garante. Meta argued that Ireland’s regulator was the right one to handle it. The Garante disagreed: the ePrivacy rules behind Article 122 of Italy’s privacy code do not use the EU’s one-stop-shop route. Its position is that reading what is on a phone always needs informed consent, even if nothing leaves the device and nobody is hurt.
The amount reflects around 20 million Android users in Italy, a breach that continues for anyone who has not updated the app or who already granted access, a 2019 decision against the company, and limited cooperation during the inquiry. Meta did change the feature after the complaint, which helped it, though the Garante found the changes came late and reach only people who update the app.
The ruling does not cover whether gallery content was used to train AI, which Meta denies. A newer 2026 feature that handles gallery content in the cloud may get its own investigation, the Garante says. Meta must report its first steps to the regulator within 30 days and the measures it adopted within 90 days.
