One permission box, up to 20 million phones: Italy fines Meta €805 million over Facebook’s reach into photo galleries

Italy’s privacy regulator has fined Meta €805 million over the way Facebook’s Android app reached into people’s photo galleries.

The data protection authority said on Saturday, Italian time, that the app accessed photos, videos and related metadata stored on users’ phones “without obtaining specific consent and without properly informing them”. It found a breach of the Italian law that carries the European Union’s ePrivacy rules into national law.

What did Facebook actually do?

The case is about a feature that suggests photos and videos from a phone’s gallery as ideas for new posts. According to the regulator, Facebook asked for gallery access through a single, app-wide permission, preceded by a general notice that did not explain the permission would also turn on those suggestions. In other words, a user who allowed access so they could upload a picture was also agreeing, without being told, to the app looking through the rest of their gallery for content.

The regulator said up to 20 million people in Italy could have been affected, and pointed to what it called Meta’s lack of cooperation and the number of people involved as reasons for the size of the fine.

What does Meta have to change?

Meta has 60 days to disable the gallery suggestions by default and to ask users separately whether they want them. The regulator says its process is “still ongoing” for people who have not updated the app and for those who had already given consent.

What does Meta say?

Meta said it strongly disagrees with the regulator’s assessment, with how it applied the law and with the size of the fine, and that it will appeal. The company says the feature only works with device permission, which users can change at any time.

Does this matter outside Italy?

The decision applies to Italian users, but the issue it targets is universal: the single “allow access” tap that unlocks more than a user realises. Phone permissions work the same way in Australia and everywhere else Facebook runs on Android, and European privacy decisions have a record of changing how global platforms build features for every market.

For Meta it adds to a costly year over privacy. A New Mexico judge has already ordered the company to pay that state US$25 billion after a jury found it had misled consumers about how it handled their data, a verdict Meta disputes. The largest European privacy penalty on record remains the €1.2 billion Ireland’s regulator imposed on Meta in 2023 over transfers of European users’ data to the United States.

VNN will update this story as more is confirmed.