Italy’s Garante Fines Meta €805 Million Over Android Gallery Access

By Tom Whitfield

Italy’s data protection authority, the Garante, fined Meta Platforms Ireland €805 million, about $887 million, for accessing photos, videos and metadata on Italian users’ Android phones without specific consent. The watchdog said Saturday that the penalty equaled about 0.47% of Meta’s worldwide revenue and that Facebook had not properly informed users.

The case concerns the Facebook for Android feature “Get suggestions from your gallery while browsing Facebook,” available since 2023. It presents items from a phone’s gallery as posting ideas, but the Garante found that it accessed users’ photos, videos and metadata without specific consent.

Facebook sought gallery access through a single permission covering the whole app and several functions. Its prompt mentioned only “other features,” without telling users that granting access also authorized gallery suggestions, the regulator said.

How did Meta obtain gallery access?

The Garante found the gallery-suggestion feature enabled by default after users granted the broader app permission. In its decision, the authority said: “A full permission of this kind lets the app read the device’s entire photo archive, usually permanently.” It added that neither users nor the regulator could check what the app actually used.

The permission supported access to the entire archive while the visible feature offered suggestions from the gallery. The interface did not identify that wider consequence, according to the regulator’s finding. In plain terms, the permission reached far beyond what the prompt described.

What opened the investigation?

The Garante opened its investigation in July 2025 after a complaint from the Bolzano consumer group Centro Tutela Consumatori Utenti. The authority also relied on its own technical analysis to examine the feature and the permission system.

Article 122 of Italy’s privacy code transposes the EU ePrivacy directive and requires free, informed consent for any access to information on a device. The rule applies regardless of whether data leaves the device or harm results, the authority said.

Meta argued that Ireland’s regulator, Meta’s lead authority under the EU’s GDPR, should handle the case. The Garante rejected that argument because the ePrivacy rules contain no “one-stop shop” mechanism, leaving the Italian watchdog free to act.

The Garante cited about 20 million Android users in Italy when setting the fine. It also cited a 2019 decision against Meta and poor cooperation during the investigation, and said the violation remained active for people who had not updated the app or had already granted the permission.

Meta changed some settings after the complaint, and the Garante treated those changes as mitigating. The authority nevertheless called them “late” and “limited to users who update.” Italy treated the case as continuing noncompliance across a large installed base, rather than a problem closed by a later software update.

What must Meta change within 60 days?

Meta must request consent through a separate, specific prompt within 60 days. The revised prompt must explain what the feature does, identify gallery access and show users how to turn the feature off.

The order also requires two actions:

• Keep gallery suggestions off by default, including for users who already granted access.
• If Meta misses the deadline, the feature cannot activate for users without valid consent.

Meta must report the steps it has started within 30 days. It must also report the measures it has adopted within 90 days.

In plain terms, Meta cannot rely on the old blanket permission to keep the feature running in Italy.

What remains unresolved?

The proceeding did not examine whether gallery content was used to train AI models, which Meta denies. The Garante said it may separately review a feature launched in 2026 that processes gallery content in the cloud.

Meta was not immediately available for comment, Reuters reported. The next test for Meta is whether the consent redesign reaches existing users, while a possible separate Italian review could determine how the 2026 cloud-processing feature operates in the country.