Italy fines Meta EUR 805 million over Facebook's photo-suggestion feature on Android

A phone’s photo gallery holds birthdays, family trips and quiet everyday moments. On 14 November, Italy’s data protection authority, the Garante per la protezione dei dati personali, said Meta had no right to look through it the way it did. It fined Meta Platforms Ireland Limited EUR 805 million.

The Meta fine Italy announced is about one feature in the Facebook app for Android. The Garante says Meta accessed photos, videos and metadata on Italian users’ phones without specific consent and without properly informing them. Meta strongly disagrees and plans to appeal. The case tests how much permission an app needs before it reads your camera roll.

Why Italy fined Meta: what Facebook did with the gallery

The feature is called “Get tips from your gallery while browsing Facebook”. Available since 2023, it shows photos and videos from the phone gallery as suggestions to post.

The investigation began in July 2025, after a report from the Bolzano Consumer Protection Center, and used the Garante’s own technical analysis. It found three problems:

• One permission for everything. Gallery access was requested once, for the whole app and several functions.
• A vague notice. A generic message, “enable other features”, did not let users see they were also allowing gallery suggestions.
• On by default. The Garante says full permission lets an app read the whole photo archive, usually permanently, with no way for the user or the authority to check what is used.

The rule is Article 122 of Italy’s Privacy Code, which applies the European ePrivacy Directive. The Garante says it protects the smartphone as part of a person’s private sphere, so access needs free and informed consent, whether or not data is sent or anyone is harmed.

Meta says it will appeal

A Meta spokesperson told the BBC: “We strongly disagree with the [regulator’s] assessment of the facts, its application of the law, and the disproportionate level of the fine. This is a straightforward feature which helps people post photos and videos to Facebook. People must give permission on their device before it can operate, and they can change this permission at any time via their settings.”

The two sides describe the same permission very differently. Meta sees a simple helper the user approved. The Garante sees a broad approval that did not make clear what it covered. It also rejected Meta’s objection that the Irish authority should decide, saying ePrivacy rules have no “one-stop shop”. The case did not cover AI training, which Meta denies.

The BBC calls the fine among the largest an Italian authority has imposed on a tech giant. The Garante weighed about 20 million Android users in Italy, a violation it says continues for people who have not updated, the 2019 ruling and limited cooperation. It saw Meta’s later changes as mitigating, but late and limited to those who update. The fine is about 0.47% of the group’s global revenue.

If you use Facebook on Android, what to watch

The ruling concerns the Facebook app for Android and applies to Italian users. The Garante’s statement does not mention iPhone.

Meta’s own statement points to one step: gallery permission can be changed at any time in your phone’s settings. It is worth checking what you have allowed.

Within 60 days Meta must ask for consent in a separate, specific request, explain what the feature is for and how to switch it off, and keep it off by default, even for people who already agreed. Meta must tell the Garante within 30 days what it has started and within 90 days what it has done. The Garante will assess separately a new 2026 feature that allows cloud processing of gallery content.

A fair rule, a fine that will be tested

On balance, the core demand is hard to argue with: ask clearly, ask separately, and let people say no. Photos are among the most personal things a phone holds. Meta’s point deserves weight too: Android already asks for permission, and the company calls the feature simple.

The likelier outcome is a long argument over what “specific consent” means, shaping how apps ask for access. Meta has plenty on its legal and financial calendar, from its third-quarter results to its court challenge to a California teen law.

The next date is 60 days away

The fine makes the headline, but the deadline changes what users see. Watch whether Meta’s new consent request satisfies the Garante, and whether the appeal changes it.