The Italian Data Protection Authority has fined Meta Platforms Ireland Limited 805 million euros for accessing photos, videos, and metadata stored on the phones of approximately 20 million users through the Facebook app for Android devices, without specific consent.

The penalty, which is equivalent to approximately 0.47% of the group’s global turnover, is in response to a feature called “Get gallery suggestions while browsing Facebook.”

Available since 2023, it uses photos and videos saved on the phone to suggest content that users can post on the social network.

The investigation began in July 2025 after a complaint filed by the Center for Consumer and User Protection in Bolzano (north) and was supported by a technical analysis.

The regulator determined that the app requested a single generic gallery access permission (“enable other features”), valid for the entire platform and activated by default, without clearly explaining that it also authorized publication suggestions.

For the Italian authority, this system gave Facebook permanent access to the entire photo archive of the phone without users or the regulator being able to verify what information was actually used.

Specifically, these practices violate Article 122 of the Italian Privacy Code, which incorporates European ePrivacy regulations and protects electronic devices as part of individuals’ private sphere.

Therefore, the Garante stressed, any access to data stored on the device requires “free and informed consent,” regardless of whether it is transmitted or causes harm.

To determine the amount of the fine (805 million euros), the body took into account the high number of affected parties, the duration of the infringement, a previous procedure against the company in 2019, and Meta’s “poor cooperation” during the investigation.

As the only mitigating factor, it valued the modifications introduced after the complaint, although it considered them “late and limited to users who update the application.”

In addition to the financial penalty, Meta has a period of 60 days to deactivate the feature by default, even in the case of users who had previously granted gallery access permission.

The company must also request specific and separate consent for this tool, clearly explain its purpose to users, inform them that it involves accessing their photos and videos, and detail how they can deactivate it.

Finally, the body clarified that this file does not address the possible use of these images to train artificial intelligence systems – an accusation that Meta denies – although it reserved the possibility of opening independent investigations into a new function, launched in 2026, which allows gallery files to be processed in the cloud.

IN THIS ARTICLE