Italy Fines Meta €805 Million Over Facebook’s Android Gallery Access Without Explicit Consent

The Garante, Italy’s data protection authority, found that the feature was enabled by default and that the app accessed Italian users’ photos, videos, and related metadata without their explicit consent.

The company has 60 days to switch the feature off by default, including for people who have already granted the app gallery access, and to request consent separately.

Meta plans to appeal and calls the fine «disproportionate», a spokesperson said in a statement reported by Reuters.

The app asks for gallery access via a single permission that covers the whole app and several functions with different purposes, the authority found. A general notice about enabling other features appears first, but it does not make it clear to users that they are also enabling gallery suggestions.

Fully granted, a permission like this lets the app read the phone’s whole photo archive, usually on an ongoing basis. Neither the user nor the authority can check which information is actually used.

The authority found a breach of Article 122 of Italy’s Privacy Code, which puts the EU’s ePrivacy Directive into Italian law. That rule treats a phone as part of a person’s private life. Any access to what the phone stores, therefore, requires free and informed consent, whether or not data is sent anywhere or harm results.

The authority’s order, set out in its press release, requires the company to:

• Within 60 days, ask for consent through a separate, specific request for this feature, and explain clearly what the feature is for, that it accesses the gallery, and how to turn it off.
• Within 60 days, keep the feature off by default, including for people who already granted the permission.
• Within 30 days, report to the authority on the work it has started, and within 90 days, on the measures it has taken.

If the company misses the 60-day deadline, the feature cannot be switched on for anyone who has not given valid consent.

Meta said in a statement quoted in a Reuters report that the feature works only after users give permission on their device, and that they can change that permission at any time in their settings.

The Centro Tutela Consumatori Utenti, the Bolzano consumer protection group whose complaint started the investigation, published consumer advice on July 11, 2025. It told users to switch off the gallery suggestion settings in the app and to check what access and permissions the Facebook app has on their phone.

The investigation did not look at whether gallery content was used to train AI models. The company denies any such use. The authority may separately examine a newer feature, launched this year, that allows gallery content to be processed in the cloud.

The company had argued that Ireland’s data protection authority should handle the case. The Garante rejected that argument because the ePrivacy rules do not provide a one-stop-shop mechanism.

The feature has been available since 2023. The investigation began in July 2025 and included the authority’s own technical analysis.

The fine equals about 0.47% of the group’s global revenue. In setting it, the authority weighed the large number of people involved, about 20 million Android users in Italy.

It also weighed how long the breach has lasted. The breach is still ongoing for people who have not updated the app, and for those who have already granted permission, the authority said.

Other factors were a 2019 decision against the company and limited cooperation during the investigation. Changes the company made after the complaint counted in its favor, though the authority judged them late and limited to people who update the app.