Italy fines Meta €805 million over Facebook's access to Android photo galleries

Italy's data protection authority, the Garante, on November 14 fined Meta Platforms Ireland Limited €805 million. According to the regulator, the Facebook app for Android accessed photos, videos and their metadata on Italian users' phones without specific consent and without telling people properly. The case is about one feature, "Get tips from your gallery while browsing Facebook", which has been suggesting photos and videos from the phone's gallery as ideas for posts since 2023.

What the Garante found

The inquiry began in July 2025 after a complaint from the Bolzano consumer protection centre CTCU, and the authority ran its own technical analysis of the app. It found three problems. Facebook asks for gallery access through a single permission that covers the whole app and several features with different purposes. The request comes with a vague notice about "enabling other features", so people cannot tell they are also switching on gallery suggestions. And the feature was turned on by default.

Once full access is granted, the app can read the entire photo archive on the device, usually permanently, and neither the user nor the regulator can check what is actually used. The Garante relied on Article 122 of the Italian Privacy Code, which implements the EU ePrivacy Directive and treats the smartphone as part of a person's private sphere. Any access to what is stored on it needs free and informed consent, whether or not the data leaves the phone and whether or not anyone is harmed.

Meta argued that the case belonged to the Irish regulator, which normally leads on Meta under the GDPR. The Garante rejected this: the ePrivacy rules have no "one-stop-shop", so each country's authority can act on its own.

What Meta has to change

Within 60 days Meta must ask for consent to this feature separately, explain what it does and how to turn it off, and keep it off by default, including for people who have already granted the permission. If it misses the deadline, the feature cannot run for anyone without valid consent. Meta has to report its first steps within 30 days and the finished measures within 90.

In setting the amount, the Garante took into account the number of people affected, a violation that is still ongoing for users who have not updated the app, an earlier 2019 decision against the company and what it called poor cooperation during the inquiry. Changes Meta made after the complaint counted in its favour, though the regulator found them late and limited to people who update the app.

The decision does not cover whether gallery content was used to train AI, which Meta denies. A newer feature launched in 2026, which processes gallery content in the cloud, will be examined separately.

Meta will appeal

"We strongly disagree with the Garante's assessment of the facts and its application of the law, and we consider the amount of the fine disproportionate," a Meta spokesperson told Adnkronos. According to the company, this is a simple feature that helps people post photos and videos, it only works after the user grants a permission on the device, and that permission can be changed in settings at any time. Meta intends to appeal.

It is not the company's first big bill this autumn: in October a judge in New Mexico ordered Meta to pay $25 billion for misleading Facebook users about privacy.

Check which apps can see your photos

• On Android, open Settings, then Apps, Facebook, Permissions, Photos and videos. Choose "Don't allow", or on Android 14 and later "Allow limited access" to share only the photos you pick.
• In the Facebook app, look in Settings for the camera roll sharing suggestions and the cloud processing settings, and turn off any you do not use.
• Go through the same Photos and videos permission for your other apps. Many of them got full access years ago and never needed it.