Italy's Data Protection Authority has fined Meta €805 million over the way Facebook's Android app accessed users' photo and video galleries for post suggestions. The regulator said about 20 million smartphone users were not properly informed that granting gallery access would allow the app to generate suggestions from material stored on their devices.
The authority ordered Meta to disable the feature by default within 60 days and to seek separate user consent. According to the regulator's findings, Facebook obtained access through a single permission covering the app, while the preceding notice did not clearly explain that gallery content could be used to recommend photos and videos for posts.
The decision does not allege that Facebook bypassed Android's device-level permission prompt. Instead, the dispute centers on whether Meta gave users sufficiently specific information and obtained consent for this particular use after they authorized gallery access. The regulator said the number of affected people and the continuing operation of the feature were factors in determining the penalty.
Meta disputes both the legal analysis and the size of the fine. A company spokesperson told the BBC that Meta planned to appeal, calling the feature a straightforward tool designed to help people post photos and videos. The company said users must grant device permission before it works and can change that permission in their settings.
That response sets up a distinction likely to be central to the appeal: Meta points to the user's operating-system permission, while the Italian authority says the company needed clearer disclosure and separate consent for generating suggestions from gallery content. The penalty therefore concerns the specificity of notice and consent, not simply whether access was technically authorized at the device level.
The €805 million sanction, equivalent to about £670 million or $887 million at the figures reported by the BBC, is among the largest penalties imposed on a technology company by an Italian authority. The order also carries an operational consequence beyond the fine because Meta would have to change the feature's default setting and consent flow if the decision remains in force.
For affected users, the case highlights that a broad permission can enable several functions inside an app. A person may understand that an app can reach a photo library for uploads without realizing that the same access is being used proactively to scan for posting suggestions. The regulator's position is that those uses must be distinguished clearly enough for consent to be meaningful.
The appeal means the authority's conclusions remain contested. Until that process is resolved, the regulator's findings and Meta's denial should be treated as opposing positions rather than a final judicial determination of the dispute.
