Italy's Data Protection Authority has imposed a €805m (£670; $887m) penalty on Meta for accessing the photos and videos of approximately 20 million Android smartphone users without obtaining their explicit consent. According to BBC News, the regulator determined that Meta failed to adequately disclose to users that the Facebook app could retrieve images and videos from their device galleries.
The fine represents one of the largest penalties ever issued by an Italian authority against a technology company. BBC News reported that Meta has been given 60 days to disable the feature by default and implement a separate consent mechanism for users who wish to continue using it.
The disputed feature automatically suggests photos and videos from a user's phone gallery as potential content for social media posts. Facebook obtained access to these galleries through a single app-wide authorisation, but according to the Italian regulator, the preceding notice failed to clarify that this permission would also enable Facebook to generate suggestions based on gallery contents. The practice violated Article 122 of Italy's Privacy Code, which implements the EU ePrivacy Directive, Anadolu Agency reported.
Why did regulators take action?
The Data Protection Authority emphasised several factors in reaching its decision. The regulator highlighted the scale of the violation, noting
the high number of people affectedand the fact that the practice remained
still ongoing for those who have not updated the app and for those who have already given their consent to the system. The authority also cited
Meta's lack of co-operationthroughout the investigation process.
The investigation began in July 2025 following a report from the Bolzano Consumer and User Protection Centre, which prompted technical analysis of Facebook's app, according to Il Sole 24 Ore. The regulator also took into account a previous enforcement action against Meta in 2025 when determining the penalty amount.
What is Meta's response?
Meta has denied the allegations, according to reports published on the day the fine was announced. The company also contested the Italian authority's jurisdiction over the matter, arguing that the case should fall under the Irish regulator's oversight. However, Politico reported that the regulator rejected this argument, stating that ePrivacy rules do not employ the EU's one-stop-shop mechanism that would typically direct such cases to a single authority. Meta retains the right to appeal the decision.
How significant is this penalty?
While €805m represents a substantial sum, it constitutes approximately 0.4% of Meta's 2025 annual turnover of $201 billion, according to Le Monde. The company reported $60.5 billion in net profit during that same year. This Italian fine arrives amid a broader pattern of regulatory enforcement against Meta globally. Last month, a US judge in New Mexico ordered Meta to pay $25 billion following findings that the company had systematically deceived the public regarding its handling of Facebook user data over an extended period.
What happens next?
Meta must report its initial compliance measures within 30 days and provide comprehensive details of all implemented measures within 90 days, according to Anadolu Agency. The regulator has also reserved the right to conduct a separate investigation into a gallery feature introduced in 2026 that processes content in the cloud.
