Italy fines Meta $900 million for accessing users' phone galleries without consent

Hind Al Soulia - Riyadh - ROME — Italy's data protection authority has fined Meta €805 million ($900 million) for accessing photos, videos and related metadata stored on Italian users' Android devices without obtaining specific and informed consent.

The Italian Data Protection Authority said the violation involved Facebook's "Get suggestions from gallery when browsing Facebook" feature, introduced in 2023 to recommend photos and videos stored on users' smartphones for sharing on the social media platform.

An investigation found that Facebook requested a single permission covering multiple functions, accompanied by a generic warning that failed to clearly inform users that the application could access their photo galleries.

The regulator also found that the feature was enabled by default, potentially allowing Facebook to access users' entire photo archives once permission was granted.

The investigation began in July 2025 following a complaint filed by the Bolzano Consumer Protection Center and included a technical examination of the Facebook application.

According to the authority, the practice violated Article 122 of Italy's Privacy Code, which implements the European Union's ePrivacy Directive and protects information stored on users' electronic devices.

The regulator emphasized that accessing information stored on smartphones requires freely given and informed consent, regardless of whether personal data is subsequently transmitted or any actual harm is demonstrated.

It also rejected Meta's objection to its jurisdiction, explaining that the EU's ePrivacy framework does not provide for the "one-stop-shop" mechanism that applies to certain cross-border data protection cases.

Under the ruling, Meta must introduce a separate consent request that clearly explains the feature's purpose and ensure that it remains disabled by default.

The changes must be implemented within 60 days, including for users who previously granted permission.

Meta is also required to report its initial corrective measures within 30 days and provide details of the measures implemented within 90 days.

The authority estimated that approximately 20 million Android users in Italy could have been affected.

In determining the penalty, the regulator cited the scale and duration of the violation, a previous enforcement action against Meta in 2019 and what it described as the company's lack of cooperation during the investigation.

The proceedings did not examine whether content accessed from users' photo galleries was used to train artificial intelligence systems.

However, the authority said it reserved the right to launch a separate investigation into a cloud-based gallery processing feature introduced in 2026.