Italy's privacy regulator fines Meta €805 million, alleging Facebook Android app accessed users' photo galleries without explicit consent

BlockBeats news, November 14 - The Italian Data Protection Authority has fined Meta Platforms Ireland Limited €805 million. An investigation found that since 2023, the Facebook Android app, through its "get suggestions from your gallery while browsing Facebook" feature, accessed photos, videos, and related metadata on Italian users' phones without specific and informed consent. The feature was enabled by default, the authorization prompt was overly vague, and a single permission covered the entire app, allowing permanent access to device gallery contents, with neither users nor regulators able to verify the actual scope of use.

The regulator determined that this violates Article 122 of the Italian Privacy Code (implementing the EU ePrivacy Directive), emphasizing that mobile phones are part of the personal private sphere and that any access requires free and informed consent, regardless of whether data is transmitted or actual harm is caused. Meta's defense that the Irish regulator should have jurisdiction was rejected, because ePrivacy does not fall under the "one-stop-shop" mechanism. The penalty took into account factors including approximately 20 million affected Italian Android users, the ongoing nature of the violation, a prior penalty record from 2019, and low cooperation during the investigation, with the amount equaling about 0.47% of the group's global revenue. Meta must disable the feature by default within 60 days, obtain separate explicit consent, and clearly inform users of the purpose and how to turn it off; if valid consent is not obtained by the deadline, the feature may not be enabled. Meta must also report remediation progress within 30 days and 90 days respectively. This case did not involve AI training use (which Meta denies), but the newly launched cloud gallery processing feature in 2026 will be assessed separately.