Italy Fines Meta $880 Million for Unauthorized Access to User Photos
Thestandard · 4 SOURCESabout 13 hours ago2 MIN
Summary
Italy's Data Protection Authority has issued a landmark fine of 805 million euros (approximately 880 million US dollars or 69 billion Hong Kong dollars) against Meta Platforms Ireland Limited for unauthorized access to users' photos, videos, and metadata through Facebook's Android application . The regulatory action stems from a "Get suggestions from your gallery when you browse Facebook" feature that suggested content from users' phone galleries without obtaining specific consent or providing adequate disclosure . An estimated 20 million Android users in Italy were impacted by this practice, which the authority ruled violated Article 122 of Italy's Privacy Code . Meta has been ordered to disable the feature by default within 60 days and must seek consent through a separate, specific request in the future . The company has not yet responded publicly and may appeal the decision .
Key Points
- The 805 million euro penalty is among the largest ever imposed by Italian regulators on a technology company, representing approximately 0.47% of Meta's global revenue .
- The investigation began in July 2025 following a complaint from the Consumers' and Users' Protection Centre of Bolzano, which triggered a technical analysis by authorities .
- Facebook requested gallery access through a single authorization valid for the entire app, preceded by a generic notice that did not clearly explain the photo suggestion feature .
- Italian authorities confirmed the breach specifically concerns photo and video data access, explicitly stating the case does not involve AI model training purposes .
- Meta must clearly explain the feature's purpose, what gallery access entails, and provide instructions on how users can disable it .
Why It Matters
This case signals an escalation in European regulatory enforcement against big tech data practices, with authorities specifically targeting how apps access smartphone storage without transparent consent mechanisms . The decision sets a precedent requiring technology companies to implement granular consent processes for each data collection purpose, potentially influencing similar investigations across the European Union .
This case signals an escalation in European regulatory enforcement against big tech data practices, with authorities specifically targeting how apps access smartphone storage without transparent consent mechanisms . The decision sets a precedent requiring technology companies to implement granular consent processes for each data collection purpose, potentially influencing similar investigations across the European Union .