805 million Euro fine against Meta Platforms Ireland
Gallery photo access without specific, informed consent on users' smartphones.
| fineID | Date | Fine | Recipient | Country | Infringement | href | Land |
|---|
Fine details
The Italian data protection authority, Garante per la protezione dei dati personali, has imposed a fine of 805 million EUR on Meta Platforms Ireland. The investigation began in July 2025 following a complaint from the Bolzano Consumer Center (Centro Tutela Consumatori Utenti) and was based on a technical analysis conducted by the authority. The investigation focused on the feature “Get suggestions from your gallery while browsing Facebook,” which has been available in the Facebook app for Android since 2023. While users are browsing, the feature suggests photos and videos from their phone’s gallery for posting. Meta accessed photos, videos, and metadata on Italian users’ smartphones via the app without obtaining specific consent and without providing sufficient information. Permission to access this data was requested with a single authorization covering the entire app and multiple features. A general notice (“enable additional features”) did not make it clear that the gallery suggestions were also being authorized. Furthermore, the feature was enabled by default.
The Garante views this as a violation of Article 122 of the Codice privacy, which implements the ePrivacy Directive. The smartphone is part of one’s private sphere; any access to its contents requires free and informed consent, regardless of whether data is transferred or harm is caused.
The Garante rejected the objection of lack of jurisdiction in favor of the Irish authority, as the ePrivacy rules do not provide for a one-stop shop. In determining the penalty, the Authority took into account approximately 20 million affected Android users in Italy, the prolonged duration of the violation, a previous decision from 2019, and the lack of cooperation. Subsequent changes were considered mitigating factors, though they were deemed belated and limited in scope. Meta must obtain separate consent within 60 days and disable the feature by default.
