The Italian Data Protection Authority (Garante per la Privacy) has imposed a massive fine of €805 million on Meta, equivalent to approximately 0.47% of the group's worldwide revenue. The ruling centers on the Facebook app for Android devices, through which the company allegedly accessed photos, videos, and related metadata stored on Italian users' smartphones without obtaining specific consent or providing adequate information. The U.S. giant responded immediately, announcing an appeal.
A Meta spokesperson stated that they "strongly disagree with the assessment of the facts and the application of the law," deeming the fine disproportionate and reiterating that it is simply a publishing support feature, which can only be activated with prior authorization on the device and can always be changed in the settings . The case revolves around the "Get suggestions from the gallery when browsing Facebook" feature, introduced in 2023 to suggest content present in the phone's memory as ready-to-publish ideas. The investigation, launched in July 2025 following a report from the Bolzano Consumer Protection Center, highlighted serious technical issues: access to the gallery was requested through a single authorization valid for the entire application, preceded by a generic warning ("enable other functions") that did not clarify the actual purposes of the processing. Furthermore, the option was set to enabled by default, potentially allowing the app to read the entire photo archive permanently and without the possibility of control by the user or the authorities. According to the Guarantor, this mechanism violates Article 122 of the Privacy Code (which implements the European ePrivacy Directive), a provision that protects the smartphone as an extension of a person's private sphere and requires free and informed consent regardless of data transmission or the existence of damage.
The Authority also rejected Meta's objection of lack of jurisdiction in favor of the Irish regulator, clarifying that the ePrivacy legislation does not provide for a "one-stop shop" mechanism. Although the proceedings did not concern the use of files for training artificial intelligence—a practice denied by the company—the Authority reserved the right to conduct separate investigations into the new cloud processing feature launched in 2026. The fine was assessed based on the large number of users affected (approximately 20 million Android users in Italy), the duration of the violation, a previous ruling from 2019, and the lack of cooperation during the investigation. Within 60 days, Meta must keep the feature disabled by default, even for those who had already given their consent, and introduce a separate and transparent consent request; after that deadline, the tool must be blocked for users without valid consent. The company will also have 30 days to communicate the initiatives launched and 90 days to report the measures adopted.
