Italy fines Meta 805 million euros

Italy's data protection authority (Garante per la protezione dei dati personali) has fined Meta, the company that runs Facebook, 805 million euros because the social network's Android app accessed photos, videos and their metadata stored on Italian users' phones without permission. The fine, announced on Saturday, is by far the largest ever imposed by the Italian authority, and according to the Garante's calculations amounts to roughly 0.47 percent of Meta's annual global revenue. The authority also ordered the company to turn off the function in question by default within sixty days, even for users who had previously enabled it.

The investigation concerns a feature available since 2023 called, in Italian, “Ottieni suggerimenti dalla galleria quando navighi su Facebook” — “Get suggestions from the gallery while you browse Facebook.” It suggests photos and videos from the phone's gallery as ideas for posts. According to a report by Il Fatto Quotidiano, the Garante found that Meta requested access to the gallery through a single permission covering the entire app and several functions with different purposes. This was preceded only by a generic prompt (“enable additional features”), which gave users no way of understanding that they were also consenting to photo suggestions, and the feature was switched on by default. According to the authority, this meant that neither users nor the authorities could verify what information the company was actually using. The investigation began in July 2025 following a complaint from the Bolzano Consumer Protection Centre (Centro Tutela Consumatori Utenti), and the authority also carried out its own technical analysis.

The legal basis for the decision is Article 122 of the Italian data protection code, which implements the EU's ePrivacy directive on electronic communications privacy. According to the Garante, this rule protects the phone as part of a person's private sphere, which means that any access to the device's content requires free and informed consent, even if the data is not transmitted and no harm results. Meta argued in its defence that the case should fall under the jurisdiction of the Irish data protection authority, since the company's European headquarters is in Ireland. The Garante rejected this, stating that the “one-stop-shop” system, which under GDPR cases refers big American platforms to the Dublin authority, does not apply to ePrivacy rules.

In determining the fine, the authority considered it an aggravating factor that around twenty million Android users in Italy were affected, that the infringement is still ongoing for some of them, that the company had already been the subject of a ruling in 2019, and that Meta cooperated only to a limited extent during the investigation. As a mitigating factor, it noted that the company changed the feature after the complaint, though it considered this change belated, and it also criticized the fact that it applies only to users who update the app. Within sixty days, Meta must request separate, explicit consent specifically for this feature, clearly explain what it is for and how it can be turned off, report on the steps taken within thirty days, and on the measures adopted within ninety days. If it fails to meet these conditions by the deadline, it may not enable the feature for any user without valid consent. The Garante did not examine whether Meta also used the photos to train its artificial intelligence, which the company denies. However, a new feature planned for 2026, which processes gallery content in the cloud, will be examined in a separate proceeding.

Meta's response is not yet known. American technology companies typically challenge data-protection fining decisions in court, so the Italian ruling marks another chapter in the long battle between Europe and the big American platforms. In 2023, Meta was fined 1.2 billion euros under the GDPR by the Irish authority over the transfer of European users' data to the United States, and in 2024 the European Commission fined it nearly 800 million euros on competition grounds over Facebook Marketplace.

Ugar