Meta has been fined €805 million by the Italian Data Protection Authority for violating privacy rules. The case concerns allegations that Facebook on Android devices accessed photos, videos and their associated data on Italian users’ phones without obtaining their explicit, informed consent.
The decision centers on the “Get camera roll suggestions when browsing Facebook” feature, which the platform introduced in 2023. It suggested posts to users based on photos and videos stored on their phones. The Italian authority said the fine amounts to approximately 0.47% of the group’s global turnover.
Të lidhura
None found
The investigation was opened in July 2025 following a complaint by the Consumer Protection Center in Bolzano. At the conclusion of its review, the authority found violations of Article 122 of the Privacy Code. This provision protects data stored on electronic devices and makes its use conditional on freely given, specific and informed consent.
According to the investigation’s findings, the main shortcomings concerned the process for obtaining permission to access the phone’s gallery. Rather than requesting separate authorizations, the app used a single consent for all functions. The notice presented to users was generic and did not adequately explain the purposes for which their personal data would be used.
The feature was also enabled by default. According to the authority, this could allow the app to continuously read the entire photo collection, while users lacked clear control over that access.
The calculation of the fine took into account the practice’s reach, affecting approximately 20 million Android users in Italy. The final amount also reflected the duration of the violation, an earlier decision from 2019 and Meta’s limited cooperation with the investigation.
The company, for its part, has disputed the findings. A spokesperson said Meta disagrees with the assessment of the facts and the application of the law, and considers the fine disproportionate. According to the company, the feature is designed to help users publish content, is activated only after permission is granted on the device and can be adjusted at any time through the settings.
The decision requires Meta, within 60 days, to ensure the feature is disabled by default, including for accounts that had previously consented to it. Within the same period, the company must introduce a separate, clear and transparent request for consent. Once the deadline expires, anyone who has not provided valid authorization must be prevented from using the feature.
In addition to these obligations, Meta must notify the authority of the measures taken within 30 days and submit a report on their implementation within 90 days.
The authority stressed that these proceedings did not examine the use of photos to train artificial intelligence, a practice Meta has denied. However, it left open the possibility of separate checks into the new cloud-processing feature the company launched in 2026.
