ROME (The Thursday Times) — Italy’s data protection authority has fined Meta €805 million (about $887 million) after finding that the Facebook app on Android phones read users’ photos, videos, and their metadata without specific consent. It is the largest fine the regulator has ever imposed.
The authority, known as the Garante, said on Saturday that the app “accessed photos, videos and associated metadata stored on Italian users’ smartphones without specific consent and without informing them”. It said about 20 million Android users in Italy could have been affected.
The case concerns a feature, introduced in 2023, that suggests photos and videos from a phone’s gallery for users to post while they browse Facebook.
One permission for many uses
The regulator found that Facebook asked for access to the photo gallery through a single permission covering the whole app. The request came after a generic notice that did not make clear users were also agreeing to gallery suggestions, and the feature was switched on by default.
“If granted in full, this type of permission allows the app to read the device’s entire photo archive, usually permanently, without the user or the authorities being able to verify which information is actually being used,” the authority said.
It said the practice broke Article 122 of Italy’s privacy code, which puts the EU’s ePrivacy directive into Italian law and protects information stored on people’s devices. Reading information on a phone needs free and informed consent, the authority said, whether or not personal data is then sent anywhere and whether or not any harm is shown.
Sixty days to fix it
Meta must ask for consent to the feature separately, explain clearly what it does and how to turn it off, and keep it off by default, including for users who have already granted permission. It has 60 days to make the changes. It must report its first steps within 30 days and give details of everything it has done within 90 days.
In setting the fine, the regulator cited the number of people affected, how long the breach had lasted, an earlier action against Meta in 2019, and what it called the company’s “lack of cooperation”. It said the breach was still going on for users who had not updated the app and for those who had already given consent. The fine is about 0.47% of Meta’s global turnover.
The authority also rejected Meta’s argument that the case belonged to the Irish regulator, which oversees the company in the European Union. It said the ePrivacy rules do not use the bloc’s “one-stop-shop” system, under which a single national regulator leads cases against a company.
AI training not examined
The investigation began in July 2025 after a complaint from the Bolzano consumer protection centre and included a technical analysis of the app. It did not examine whether gallery content was used to train artificial intelligence, which Meta denies. The authority said it could look separately at a cloud-based gallery feature launched this year.
Meta did not immediately comment on the decision, which it can appeal.
The fine follows a $25 billion penalty that a US judge in New Mexico ordered Meta to pay last month over how it handled Facebook user data. Earlier this month, Meta said Instagram would use AI worldwide to spot teenagers lying about their age. In Pakistan, the telecom regulator and Meta blocked 176,000 WhatsApp accounts on recycled SIM numbers this month.
