Italy's Garante, the country's data protection watchdog, has imposed a €805 million fine—approximately $887 million—on Meta for unauthorized access to photo libraries through Facebook's Android application. The regulator determined that the social network's app accessed photos, videos and associated metadata stored on Italian users' devices without obtaining specific consent or providing adequate disclosure.

According to reporting by Reuters, the enforcement action centers on a gallery suggestions feature that has been operational since 2023. As users browse Facebook, the feature recommends photos and videos from their device's storage as potential content for posts.

The Garante's investigation revealed that Facebook requested gallery access through a single permission prompt covering the entire application. This request appeared alongside a generic notification about enabling additional functionality, making it impossible for users to understand they were simultaneously activating the gallery suggestions capability.

Jurisdictional dispute and regulatory framework

Meta maintains its primary European operations through its Irish subsidiary, which typically means the Irish Data Protection Commission leads regulatory matters under GDPR. The company contended this case should fall under Irish jurisdiction. However, the Garante rejected this argument, noting that its enforcement relied on ePrivacy regulations, which lack a centralized regulatory mechanism comparable to GDPR's one-stop-shop provision.

The Garante applied Article 122 of Italy's privacy code, which classifies a smartphone as an extension of personal privacy. According to this provision, accessing any information stored on a device requires free and informed consent, regardless of whether data is transmitted elsewhere or whether demonstrable harm occurs.

Scale of impact and enforcement considerations

The regulator identified approximately 20 million Android users in Italy as affected by the unauthorized access. In determining the penalty amount, the Garante also considered a previous 2019 enforcement action against Meta and what it characterized as insufficient cooperation from the company. While the Garante acknowledged that Meta implemented certain modifications following the complaint, it determined these changes arrived too late and applied only to users who installed updated versions of the application.

The €805 million penalty represents approximately 0.47 percent of Meta's worldwide revenue. Within 60 days, Meta must request separate, explicit consent specifically for the gallery suggestions feature. Additionally, the company must configure the feature to remain inactive by default, even for users who previously granted permission.

Scope and future investigations

The current enforcement action did not investigate whether gallery content was utilized to develop artificial intelligence systems, a claim Meta has denied. The Garante indicated it will conduct a separate examination of a cloud processing feature that launched in 2026.

In terms of comparable enforcement actions, the fine approximates the €825 million penalty imposed on Uber by Dutch regulators, though it remains lower than Meta's €1.2 billion GDPR fine related to data transfer practices. Meta is simultaneously engaged in separate disputes with Italy regarding regulations on publisher compensation.

Reuters reported that Meta had not provided an immediate response to requests for comment.

Source: The Next Web