Italy says Facebook hid gallery access inside one broad Android permission

Italy’s data-protection authority fined Meta Platforms Ireland €805 million on Saturday, saying Facebook’s Android app accessed photos, videos and related metadata in Italian users’ phone galleries without specific, informed consent for a gallery-suggestion feature.

The authority said the feature, available since 2023, suggested gallery images while people browsed Facebook. Access was requested through one Android permission covering multiple app functions with different needs, preceded by a generic notice about enabling “other features.” The gallery-suggestion setting was active by default.

That design is the core accountability issue. A user granting photo access for one app function was not separately asked to authorize a distinct feature that surfaced gallery items as posting suggestions. The regulator said a full permission could let the app read the device’s entire photo archive, generally on a continuing basis, while neither users nor the authority could verify which information was actually used.

The authority grounded its decision in Article 122 of Italy’s Privacy Code, which implements the European ePrivacy Directive. It said accessing information stored on a smartphone requires free and informed consent regardless of whether data is transmitted or harm is shown. It also rejected Meta’s argument that the Irish regulator had jurisdiction, saying the ePrivacy regime does not use the GDPR’s one-stop-shop system.

The order requires Meta to seek separate, specific consent for the feature, explain that it involves gallery access and show how to disable it. Meta must keep the feature off by default, including for people who previously granted the broader permission. The company must report initial steps within 30 days, meet the feature requirements within 60 days and report implemented measures within 90 days.

The regulator said about 20 million Android users in Italy were involved and calculated the penalty at about 0.47% of Meta’s global group revenue. It cited the duration of the violation, a 2019 action and what it called limited cooperation. It also treated Meta’s changes after the complaint as mitigation, while calling them late and limited to users who updated the app.

Meta disputed the Italian authority’s jurisdiction, and the decision may be appealed. The Associated Press reported that the company had not immediately commented. The reviewed record does not establish which individual files were read, that photos were transmitted off a device, retained, sold, monetized or shared with third parties, or that an individual user suffered harm.

The proceeding did not decide whether gallery content was used to train artificial-intelligence systems. Meta denies that use. The authority said it may separately examine a different 2026 feature that allows cloud processing of gallery content; that possible inquiry is not a finding in this case.

The central question is why Meta designed a distinct gallery-suggestion feature to depend on a generic, multi-function permission and a default-on setting instead of obtaining separate consent at the point of use. Meta should publish the exact app versions and dates involved, the technical scope of access, what files were actually read or processed, retention and deletion rules, and its compliance plan for the 30-, 60- and 90-day deadlines.