Italy hits Meta with €805m privacy fine

Italy’s Data Protection Authority has fined Meta Platforms €805 million, equivalent to about $887 million, for accessing Android users’ photos and videos without obtaining explicit consent. The case centers on the Facebook app’s access to photographs, videos and related metadata stored on Italian users’ smartphones.

Regulators found that Meta accessed content from users’ phone galleries without adequately informing them and without their specific or explicit consent. Around 20 million Android users in Italy are estimated to have been affected by the conduct.

The penalty is tied to a Facebook feature that suggests photos and videos from a user’s phone gallery as ideas for posts. To enable this feature, Facebook requested access to users’ photo galleries through a single app-wide authorization within the app.

The authority said a preceding notice did not clearly explain that granting this authorization would allow Facebook to generate suggestions based on images and videos in the gallery. The regulator highlighted that the issue remains ongoing for users who have not updated the app and for those who have already granted consent under the existing system.

In addition to the monetary fine, the authority has given Meta 60 days to disable the gallery suggestion feature by default and to obtain users’ consent separately if the feature is to operate. The fine ranks among the largest imposed by an Italian authority on a technology company.

In setting the penalty, the regulator cited the high number of people affected and described Meta’s behavior as marked by a lack of cooperation. These factors were among the elements used to justify the scale of the sanction for the ongoing access to users’ galleries.

Meta has stated that it strongly disagrees with the assessment of the facts, the application of the law and what it views as a disproportionate level of the fine. The company argues that the feature is a straightforward tool to help people post photos and videos to Facebook, that device permission is required before it can operate, and that users can change this permission at any time in their settings.

The Italian fine adds to a series of significant financial penalties Meta has faced over privacy and data-handling practices. In September, a judge in New Mexico ordered Meta to pay $25 billion after a jury concluded the company deceived consumers for years about its data privacy policies.

That separate judgment, which Meta has said it disagrees with, underscores the broader legal and regulatory pressure confronting the owner of Facebook, Instagram and WhatsApp on how it manages user data and communicates its practices. The new Italian decision further intensifies scrutiny of Meta’s consent mechanisms and default settings for data access.