Italy's data protection authority has fined Meta Platforms Ireland 805 million euros — roughly $890 million — after finding that Facebook's Android app reached into users' phone galleries without the specific consent European law requires. The decision, announced Saturday by the Garante per la protezione dei dati personali, ranks among the largest privacy penalties a national regulator has ever issued against the company.
The feature at the center of the case has been available since 2023. Titled "Get suggestions from the gallery when you browse Facebook," it surfaces photos and videos from a user's phone as posting ideas while they scroll their feed. The authority found that Meta obtained access to photographs, videos and associated metadata through a single authorization valid for the entire app, preceded by a generic "enable other functions" notice that never made clear the user was also approving gallery suggestions. The permission was preset as active, and once granted in full, it let the app read a device's entire photo archive — usually permanently.
About 20 million Android users in Italy were affected, according to the authority, which calculated the fine at roughly 0.47 percent of Meta's worldwide revenue. The inquiry began in July 2025 after a report from the Centro Tutela Consumatori Utenti, a consumer protection organization based in Bolzano.
The order gives Meta 60 days to switch the feature off by default — including for people who already granted permission — and to seek consent through a distinct, specific request. The regulator said the violation is still underway for users who have not updated the app and for those who granted system-level authorization, and it cited a 2019 enforcement measure against the company and poor cooperation during the inquiry as aggravating factors.
Meta had argued the case belonged with Ireland's regulator, its lead supervisory authority under the EU's data protection framework. The Garante rejected that argument, saying the European ePrivacy rules, which Italy's privacy code implements, provide no one-stop-shop mechanism for that referral. Under Italian law, the phone itself is treated as part of a person's private sphere, and Article 122 of the code requires free and informed consent for access to the information it contains. Meta can challenge the decision before an ordinary court within 60 days.
Notably, the proceeding did not examine whether the gallery content was used to train AI systems — a use Meta denies. The authority reserved the right to separately review a new 2026 feature that processes gallery content in the cloud, keeping the door open to a second front in the dispute.
The precedent matters for the AI industry regardless of where the training question lands. Gallery photos and videos are exactly the kind of rich personal data that image and video models consume, and the Garante's ruling signals that European regulators intend to enforce consent requirements at the access layer — long before anyone reaches the training pipeline. For platforms shipping agentic and multimodal features that quietly broaden what an app can read, the Italian fine is a reminder that the permission dialog, not the model, is where the liability now begins.
Comments (0)
Log in to join the discussion
Log InNo comments yet