€805 million: that is the penalty Italy's data-protection regulator imposed on Meta yesterday for a Facebook-for-Android feature that suggested phone-gallery photos and videos to users without explicit consent.
The fine, who it targets, and the scale of the exposure
The Garante — Italy's data protection authority — concluded that the Facebook Android feature, available since 2023, accessed Italian users' photos, videos and related metadata without obtaining the free and informed consent required by law. In setting the sanction, the authority cited about 20 million Android users in Italy as affected. The fine equals roughly 0.47% of the group's global revenue, the authority said.
Legal basis: Article 122 of Italy's Privacy Code and the ePrivacy Directive
The Garante found a breach of Article 122 of Italy's Privacy Code, which incorporates the EU ePrivacy Directive into Italian law. That rule treats a phone as part of a person's private life and requires free and informed consent for any access to what the phone stores, the authority said — whether or not data is transmitted or harm results. The regulator's technical analysis concluded that a single gallery permission request covered the whole app and several separate functions with different purposes, and that a preliminary, general notice did not make clear that enabling other features also enabled gallery suggestions.
The authority also highlighted a practical problem: a fully granted permission of this type lets the app read the phone's entire photo archive, typically on an ongoing basis, and “neither the user nor the authority can check which information is actually used,” the Garante said in its order.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleWhat the Garante has ordered Meta to do, and the clock that follows
- Within 60 days, Meta must ask for consent through a separate, specific request for the gallery-suggestion feature and explain clearly what the feature is for, that it accesses the gallery, and how to turn it off.
- Within 60 days, the feature must be kept off by default for all users, including people who already granted the permission.
- Within 30 days, Meta must report to the Garante on the work it has started; within 90 days, it must report on the measures it has taken.
The order adds a compliance enforcement point: if Meta misses the 60-day deadline, the feature cannot be switched on for anyone who has not given valid consent.
Meta's response, the company's procedural arguments, and unresolved technical questions
Meta said in a statement quoted in a Reuters report that the feature “works only after users give permission on their device,” and that users can change that permission at any time in their settings. A Meta spokesperson said the fine was “disproportionate,” Reuters reported, and the company plans to appeal.
Meta had argued that Ireland's data protection authority should handle the case; the Garante rejected that contention because ePrivacy rules do not provide a one-stop-shop mechanism for this type of access. The investigation — opened in July 2025 and including the Garante's own technical analysis — did not examine whether gallery content was used to train AI models; the company denies any such use. The authority said it may separately examine a newer feature, launched this year, that allows gallery content to be processed in the cloud.
How the Garante, Meta, and Italian consumers are positioned
- The Garante: The authority used its technical review to apply Article 122, weighed the length of the alleged breach and the large number of people affected, and factored in a 2019 decision against the company and what it described as limited cooperation during the investigation. Post-complaint changes by Meta counted in its favor but were judged late and limited to users who update the app.
- Meta: The company intends to appeal and maintains the feature requires device-level permission and can be changed in settings. Meta also raised jurisdictional arguments favoring another EU regulator, which the Garante dismissed for purposes of ePrivacy enforcement.
- Italian consumers and the Centro Tutela Consumatori Utenti: The complaint that triggered the probe came from the Bolzano consumer protection group Centro Tutela Consumatori Utenti. That group published guidance on July 11, 2025, advising users to switch off gallery-suggestion settings in the app and to check what access and permissions the Facebook app has on their phones.
The Garante's order frames a narrow, time-bound path: explicit, feature-specific consent; default-off for an intrusive capability; and frequent reporting on implementation. Meta's appeal and the authority's possible separate review of cloud-processing functionality are the immediate next steps. The decision leaves concrete technical questions in place — chiefly what data the app actually read and when — and sets a strict timetable that will determine whether the feature remains dormant for Italian Android users or becomes the subject of further enforcement.
