Phoenix 24
A major privacy ruling challenges how technology platforms handle personal data.
ROME, Italy. Italy’s data protection authority has imposed an €805 million fine, approximately $887 million, on Meta Platforms for allowing Facebook’s Android application to access users’ personal photographs, videos and associated metadata without obtaining sufficiently specific and informed consent. The decision, announced on November 14, affects an estimated 20 million Android users in Italy and represents one of the country’s largest privacy enforcement actions.
The investigation focused on a Facebook feature introduced in 2023 that suggests photographs and videos from a smartphone’s gallery while users browse the social network. According to Italy’s privacy regulator, known as the Garante, the function relied on a general application permission rather than a separate authorization explaining its specific purpose.
Investigators found that the feature was enabled by default and that users received insufficient information about the extent of access being granted. Once comprehensive gallery permissions were approved, the application could potentially read the device’s entire photographic archive, including associated metadata.
The investigation began in July 2025 following a complaint submitted by a consumer protection organization in Bolzano. Technical examinations subsequently identified concerns about how Facebook obtained permission and whether users could meaningfully understand or control access to their private content.
The regulator determined that Meta violated Article 122 of Italy’s Privacy Code, which implements European electronic privacy protections. Under this framework, accessing information stored on personal devices requires freely given and informed consent, regardless of whether the information is transmitted elsewhere or causes demonstrable harm.
Meta now has 60 days to disable the feature by default and introduce a separate consent mechanism. The company must clearly explain its purpose, the information it accesses and how users can deactivate it.
The authority also ordered Meta to report initial corrective measures within 30 days and provide further implementation details within 90 days.
In calculating the penalty, regulators considered the number of potentially affected users, the duration of the infringement, a previous sanction imposed in 2019 and what they described as insufficient cooperation during the investigation. The fine represents approximately 0.47% of Meta’s global annual revenue.
Importantly, the proceedings did not establish that private photographs were used to train artificial intelligence models. Meta denies such use, while Italian authorities have reserved the right to investigate separately a newer cloud-based gallery processing feature introduced in 2026.
The ruling highlights a growing regulatory concern: permission to access personal information cannot automatically be treated as meaningful consent when users lack a clear understanding of how that information may be processed.
For technology companies, the case reinforces the importance of privacy-by-design principles, transparent interfaces and user control over sensitive digital content.
Beyond the Headlines, Accountability Matters.