Italy fines Meta €805 million—and orders a new choice over Facebook photo access

The case involves about 20 million Android users in Italy. Its most consequential requirement is not the size of the penalty but the reset: within 60 days, Meta must keep the suggestion feature off by default and obtain separate, specific consent. An old system permission to access photographs is not enough. Whether Meta has delivered that change across existing permissions remains unverified.⁠12

The investigation began in July 2025 after a report from the Centro Tutela Consumatori Utenti, the consumer protection center in Bolzano. The Garante’s technical analysis examined a function whose Italian name translates as “Get suggestions from your gallery while browsing Facebook.” It proposes pictures and videos from the phone as material the user might publish. This is the particular feature under scrutiny, not a prohibition on Facebook or Android.⁠12

The regulator found that Facebook requested a single gallery authorization covering the whole app and multiple functions with different needs. The notice preceding that request used the generic phrase “enable other functions,” without making clear that permission would also enable gallery-based posting suggestions. The suggestion feature itself was already switched on by default.⁠12

Those two choices reinforced each other. A broad authorization opened the door; a preset feature supplied a use that the notice had not adequately explained. The Garante concluded that Meta had accessed photographs, videos and their metadata without specific consent or sufficient information for users.⁠12

The breadth of access matters, but it must be described carefully. When full gallery permission is granted, this kind of authorization allows an app to read the device’s entire photographic archive, generally on an ongoing basis. According to the regulator, neither users nor its investigators could verify which information was actually being used.⁠12

That is not a finding that every photograph was uploaded, that private pictures were automatically published, or that phones were hacked. Permission wide enough to reach an archive is not proof that every item in it was transmitted. The established problem is access without an adequately explained, specific choice.

The legal finding rests on Article 122 of Italy’s Privacy Code, which implements Europe’s ePrivacy directive and protects information held on a person’s device. For this gallery-suggestion feature, the Garante said free and informed consent was required even if nothing was transmitted elsewhere and no further harm was demonstrated. The protection begins with access to the private store of information, not only after data leave the phone.⁠12

Meta challenged the Italian authority’s competence, arguing that the Irish regulator should handle the case. The Garante rejected that objection because the ePrivacy framework does not provide the “one-stop-shop” mechanism Meta invoked. The company’s Irish establishment therefore did not remove this proceeding from Italian enforcement.⁠12

The regulator’s requirements go beyond rewriting a generic notice. Meta must make a distinct request for consent to the gallery-suggestion function, explaining what it does, that it accesses the gallery, and how to turn it off. The default-off requirement expressly includes people who have already granted permission. Once the 60-day period expires, the feature cannot be activated for users without valid consent if the required changes have not been made.⁠12

That coverage is central to the case. The Garante said the violation continued for people who had not updated the app and for those who had already granted system authorization. Changes Meta introduced after the complaint counted in its favor when the penalty was assessed, but the regulator considered them late and limited to people who updated the app. An update that leaves older installations or existing permissions untouched is only a partial remedy.⁠12

There are three separate compliance milestones. Within 30 days, Meta must tell the Garante what initiatives it has begun. Within 60 days, it must change consent and defaults. Within 90 days, it must report the measures adopted. The last reporting obligation does not extend the settings deadline.⁠12

Those intervals cannot responsibly be converted into calendar due dates yet. The public announcement is dated November 14, but it does not establish when the decision was notified to Meta. Nor does an order to provide a new choice prove that a compliant control is already available. A current settings path for Italian Android users has not been verified.

The €805 million sanction—approximately $887 million in DW’s report—reflects more than the number of users involved. The Garante cited the duration of the violation, a previous measure against the company in 2019 and poor cooperation during the investigation, alongside the scale of the affected population. It described the amount as approximately 0.47% of the group’s worldwide turnover, without identifying the turnover year or publishing the full calculation.⁠1⁠12

This was not an artificial-intelligence training case. Meta denies using gallery contents for that purpose, and the proceeding did not examine it. The Garante also reserved separate checks on a new function launched in 2026 that enables cloud processing of gallery contents. That is a boundary around this decision, not an additional finding of wrongdoing.⁠12

A verified current Meta response to the sanction, a promised or filed appeal, and evidence of payment have not been established. The regulator’s announcement should not be mistaken for proof that every subsequent legal or compliance step is settled.

The practical test is narrower and more useful than the headline sum: do people who previously gave Facebook broad gallery access receive a genuinely separate choice, with this feature off unless they validly agree? The order requires that outcome. Evidence that it has reached those existing users is still missing.