Italy’s data protection authority has hit Meta with a hefty €805 million fine over Facebook’s Android photo‐gallery suggestions feature, which was found to access users’ entire gallery by default without clear, explicit consent. The ruling targets how the app offered photo and video suggestions for posts without making it distinct that the gallery permission covered more than routine functions. The authority deemed this a breach of privacy laws enshrined in Italy’s adaptation of the EU’s ePrivacy rules.
Background: What triggered the investigation
The investigation was initiated by a consumer group based in Bolzano in mid-2025, prompted by concerns that Facebook for Android asked for one broad permission that granted access to users’ photos, videos, and metadata, and that it included a suggestion-feature that operated without specific consent. The function had been active since 2023. The regulator’s technical review confirmed that users weren’t properly informed that enabling gallery access also turned on suggestions based on that content, nor was there a clear opt-out path.
Penalty details and ordered remedies
The decision marks the fine as roughly 0.47% of Meta’s global revenue, reflecting the scale of the breach—some 20 million Italian Android users were impacted. In setting the penalty, the authority considered the duration of the issue, which remains for users who haven’t updated the app or those who already granted permission. Factors such as limited cooperation during the probe weighed against Meta, though recent fixes available only to updated users counted somewhat in its favor.
Meta has 60 days to disable the suggestions feature by default—whether or not users have already granted gallery access—and to collect consent via a separate, specific request that clearly explains what the feature does, how it uses gallery content, and how to deactivate it. Additionally, it must report initial steps within 30 days and full implementation within 90 days. Failing to meet the 60-day requirement means the feature must stay off for everyone who hasn’t provided valid consent.
Meta’s response and wider implications
Meta indicates it will appeal the decision, calling the fine disproportionate. The company maintains that gallery access requests come only after user permission and stress that users can change those permissions at any time. The authority rejected Meta’s argument that Ireland’s data protection agency should have exclusive jurisdiction, since ePrivacy rules in Italy do not allow such a one-stop mechanism in this case.
The authority did not examine whether photo content was used to train AI, and Meta denied any such use. However, a newer feature launched this year—allowing gallery content to be processed in the cloud—is under separate review.
”The ruling draws a clear line on what consent means in digital privacy,” said Italy’s regulator. With France and Germany already pushing similar data access boundaries, the decision adds pressure in Brussels to tighten ePrivacy enforcement across the EU.
Analytical take: This fine amplifies how European privacy regulators are increasingly unwilling to treat vague consent as sufficient—especially when apps seek access to users’ private content like photos. For Meta, it’s not just a compliance challenge, but also a signal that system design—how permissions are requested and how features are enabled—matters almost as much as what data is collected. Going forward, tech firms should expect regulators to closely scrutinize default settings and consent flows. It’s a pivotal moment in defining what “transparent permission” must actually look like under Europe’s privacy framework.
