Italy fines Meta €805 million over Facebook Android gallery access

Italy’s data protection authority fined Meta Platforms Ireland €805 million after finding that Facebook’s Android app accessed photos, videos and related metadata on Italian users’ phones without specific consent or adequate disclosure.

Meta has 60 days to introduce a separate, feature-specific consent request explaining the feature’s purpose, its access to the phone gallery and how users can disable it. The feature must remain off by default, including for people who previously granted the Android system permission. Meta must tell the regulator within 30 days which initiatives it has begun and within 90 days which measures it has adopted.

The case centers on “Get suggestions from gallery when browsing Facebook,” a feature available since 2023 that offers photos and videos from a phone as potential Facebook posts while a user browses the app. The authority opened its investigation in July 2025 after a report from the Bolzano Consumer Protection Centre, then conducted a technical analysis.

Investigators found that Facebook sought gallery access through a single permission covering the whole app and several functions with different purposes. The request followed a generic notice about enabling other features, but the notice did not tell users they were also authorizing gallery suggestions. The suggestion feature was enabled by default.

When granted in full, the permission can let the app read the device’s entire photo archive on an ongoing basis, the authority said. Neither users nor the regulator could verify which information was actually used. The decision does not establish that every item in a user’s gallery was used.

The regulator said the conduct violated Article 122 of Italy’s Privacy Code, which implements the EU ePrivacy Directive. Accessing information stored on a smartphone requires free and informed consent regardless of whether the data is transmitted or harm occurs, it said. The authority also rejected Meta’s argument that the Irish regulator had jurisdiction, saying the ePrivacy framework does not include the GDPR’s one-stop-shop mechanism.

About 20 million Android users in Italy were involved, according to the authority. It said the penalty was about 0.47% of Meta’s global revenue and cited the number of people affected, the duration of the infringement, a 2019 measure against the company and limited cooperation during the investigation. Changes made after the complaint counted as mitigation, but the regulator said they came late and benefited only users who updated the app.

The proceeding did not assess whether Meta used gallery content to train artificial intelligence. Meta denies doing so. The regulator said it may separately examine a gallery cloud-processing feature launched in 2026.