Italy: €805 million fine for Meta for Facebook’s access to photo galleries

• The Italian data protection authority Garante imposed a fine of EUR 805 million on Meta Platforms Ireland. According to the office, this is approximately 0.47% of the group’s global turnover.
• The penalty applies to photo and video suggestions from your phone’s gallery in the Facebook app for Android. According to Garante, the feature was enabled by default and users did not provide separate, informed consent to it.
• The decision is based on the provisions on privacy of electronic communications. The proceedings did not concern artificial intelligence training.
• Meta has 60 days to change features. It is intended to remain disabled until the user provides valid consent.
• The decision applies to users in Italy. The announcement does not indicate whether the changes will also apply to Poland.

The penalty concerns a function that suggests photos and videos from the phone’s gallery as materials to publish when browsing Facebook. It is available from 2023.

According to Garante, the app was asking for one broad gallery permission for several different functions. The message generally talked about “enabling other features,” without explaining that consent also included suggesting private photos. The tooltips themselves were turned on by default. The office notes that full permission of this type allows the application to read the entire photo archive on the phone, usually permanently.

The Office referred to Art. 122 of the Italian Privacy Code, which implements the EU ePrivacy Directive. It held that access to the contents of the phone requires free and informed consent, regardless of whether the data is transferred outside the device and whether damage has occurred. He also rejected Meta’s argument that the case should be handled by an Irish authority. He explained that there is no single window mechanism in the ePrivacy regulations, which allows the case to be brought before one authority in the EU.

The proceedings began in July 2025 after a notification to the consumer protection center in Bolzano. Garante points to around 20 million Android users in Italy and considers the breach to be ongoing. When determining the penalty, he took into account the previous decision against Meta from 2019 and the company’s poor cooperation during the proceedings. He treated the changes introduced after the notification as a mitigating factor, but considered them to be late and limited to people updating the application.

Within 60 days, Meta is to introduce a separate, specific request for consent to gallery suggestions. He must explain what the function is for, that it requires access to photos and videos, and how to turn it off.

The function is to be disabled by default also for people who have previously granted the application wide access to the gallery. After the deadline, it will no longer be possible to run it without proper consent. The company must also inform the office about the actions taken within 30 days and present the implemented measures within 90 days.

Garante emphasizes that the proceedings did not concern the use of photos to train artificial intelligence, which Meta denies. Separately, it intends to evaluate a 2026 feature that allows gallery content to be processed in the cloud.

Information about a potential conflict of interest: bitcoin.pl publishes content on Facebook and Instagram, which belong to Meta.