Italy’s data protection authority has imposed a €805 million ($887 million) fine on Meta Platforms for accessing Android users’ photos and videos without their specific consent or adequate disclosure. The decision marks one of the largest penalties ever levied by an Italian regulator against a tech company.
The Italian Data Protection Authority (Garante per la protezione dei dati personali) ruled that Meta violated European privacy laws by enabling a Facebook app feature that suggested content from users’ personal galleries for posting. The feature, which required a single permission request covering multiple app functions, was enabled by default and did not clearly inform users about its scope.
Meta has 60 days to disable the feature by default and seek separate consent from users for its use. The authority also reserved the right to review a separate feature, launched in 2026, that allows cloud processing of gallery content.
Key Details of the Ruling
- Fine Amount: €805 million ($887 million), equivalent to 0.47% of Meta’s global revenue.
- Scope: Affects 20 million Android users in Italy.
- Feature in Question: A Facebook app function that suggested photos and videos from users’ galleries for posting.
- Regulatory Basis: Violation of the EU General Data Protection Regulation (GDPR), which requires free and informed consent for accessing private data.
- Investigation Timeline: The probe began in 2025, though the feature in question was active prior to that date.
Meta’s Response
A Meta spokesperson stated the company would appeal the decision, calling the fine disproportionate. The company argued that users must grant permission on their devices before the feature can operate and that they can modify these settings at any time. Meta also denied using the accessed content to train artificial intelligence models, a practice the authority did not investigate in this case.
Regulatory Rationale
The authority cited Meta’s lack of cooperation during the investigation as a factor in determining the penalty. It also emphasized the high number of affected users and the fact that the feature remained active for those who had not updated the app or had already given consent under the previous system.
Broader Context
The fine follows a series of regulatory actions against Meta in the U.S. and Europe. In September, a judge in New Mexico ordered Meta to pay $25 billion after a jury found the company had deceived consumers about its data privacy practices. In 2021, Amazon was fined €1.1 billion (later reduced to €752 million) by Italian authorities for breaching competition law.
The ruling underscores growing scrutiny of tech companies’ data practices, particularly regarding default permissions and user consent mechanisms on mobile platforms.