Italian regulator fines Meta 805 million euros for unauthorized Android gallery access

The Italian data protection authority has fined Meta 805 million euros for unauthorized access to the photos, videos, and metadata of approximately 20 million Android users in Italy. The regulator determined that the Facebook app obtained access to user gallery content through a single general permission. This method failed to clearly inform users about the content suggestions provided by the application.

Details of the regulatory violation

The investigation focused on a specific feature titled "Get suggestions from gallery while using Facebook," which has been available to users since 2023. The regulator found that the company obtained gallery access through a single general permission that did not provide sufficient transparency regarding content suggestions. The decision to impose the fine also considered the duration of the violation and the lack of cooperation from Meta during the investigation process.

The legal action was triggered following a complaint submitted by the Bolzano Consumer Protection Center in July 2025. While the current ruling addresses the gallery access feature, the Italian regulator reserved the right to conduct a separate investigation into a new 2026 feature. This potential new investigation will focus on the cloud-based processing of gallery content.

Required changes for Meta

The Italian regulator has ordered Meta to implement a separate and explicit consent mechanism for the gallery access feature. This implementation must be completed within 60 days. Under the new requirements, the feature must be disabled by default and can only be activated through active user consent. This mandate ensures that users must take a deliberate action to allow the Facebook app to access their media content.

The fine represents approximately 0.47% of the global annual turnover of Meta. A Meta spokesperson stated that the regulator misinterpreted facts and laws and argued that the fine is disproportionate. The company intends to appeal the decision.

Broader regulatory landscape

The ruling comes amid increased regulatory pressure on Meta within Europe. Last year, the European Commission imposed a 200 million euro fine against the company regarding its advertising model. In November 2024, Meta also faced a 798 million euro fine from the European Union.

The current investigation did not cover the use of photos and videos for training artificial intelligence systems, a practice that Meta denies performing. Meanwhile, the company is planning to raise 15 billion dollars through bond issuance to accelerate its investments in artificial intelligence infrastructure. This follows other significant regulatory actions in the region, such as the 2021 fine against Amazon for antitrust violations, which was initially set at 1.1 billion euros and later reduced to 752 million euros.

Glossary

• European Commission — The European Commission is an entity that declares all European Union citizens/residents have the freedom of information. It provides a list of members from which the Council of the European Union selects representatives.
• European Union — The European Union is a political and economic union of which Slovenia has been a member since 2004. It includes the Council of the European Union.
• antitrust violations — Antitrust violations are legal matters that may be subject to civil jurisdiction by the Federal Trade Commission. Private individuals or organizations may file lawsuits for damages related to these violations.
• bond issuance — Bond issuance is a process used to raise capital, such as Meta's plan to raise 15 billion dollars. An alternative to an underwritten bond is the private placement bond.