Italian data privacy regulators fined Meta Platforms 805 million euros ($887 million) on Saturday for accessing Android users’ photos and videos without consent.
Roughly 20 million Android users in Italy were affected by the default setting. The penalty stems from an investigation launched in July 2025 following a complaint from the Centro Tutela Consumatori Utenti di Bolzano, a consumer protection centre in South Tyrol.
Investigators found that the Facebook app for Android accessed photos, videos, and associated metadata from smartphones without specific consent or adequate disclosure, according to the Garante per la protezione dei dati personali.
The dispute centers on a feature called “Get suggestions from gallery when browsing Facebook,” which was available on Android devices. The tool recommends photos and videos from a user’s personal gallery for posting while browsing the platform.
The Italian Data Protection Agency found that access was requested through a single app-wide authorization preceded by a generic warning that did not adequately inform users.
“Access to the gallery is requested with a single permission, valid for the entire app and for multiple functions with different needs,” the GPDP said in a statement.
The feature was enabled by default behind a bundled permission prompt. According to the Italian Data Protection Agency, this setup breached Article 122 of the Italian Privacy Code, which implements the European Union’s ePrivacy directive.
The provision “imposes a general prohibition on the storage of and access to information on the user’s terminal” and “requires free and informed consent,” the authority said. The fine represents 0.47 percent of Meta’s global revenue, as reported by Al Jazeera.
In calculating the penalty, the GPDP considered the “duration of the violation.” The GPDP considered the high number of affected individuals and “Meta’s lack of co-operation” during the probe.
The GPDP also considered an earlier 2019 fine, according to The Times of India.
Regulators gave Meta 60 days to disable the feature by default and establish a separate, explicit consent process for users. The company must also submit progress reports at the 30-day and 90-day marks, as detailed by BigGo Finance.
The investigation did not examine whether the accessed media was used to train artificial intelligence models, a practice Meta denies. But the Italian authority reserved the right to separately review a newer feature launched in 2026 that processes gallery content through cloud systems.
The penalty was issued against Meta Platforms Ireland Limited, which operates Facebook in the EU. The Italian regulator rejected arguments concerning the GDPR’s one-stop-shop mechanism, noting that ePrivacy rules operate outside that framework, allowing the authority to act directly against the Irish-headquartered entity.
Neither the watchdog nor individual smartphone owners could verify how far the application’s access actually extended into private device galleries. Meta has retained the right to appeal the decision and must meet the deadlines set by the regulator.
Worth a look