Italy's Garante Fines Meta €805 Million Over Facebook Android Gallery Access

Italy's data protection authority, the Garante per la protezione dei dati personali, has fined Meta Platforms Ireland Limited 805 million euros, equivalent to about $887 million, over a Facebook app feature that the regulator said accessed Android users' photo and video galleries without obtaining consent or informing them, according to CNBC and the Garante's own statement. Both sources say the order also requires Meta to switch the feature off by default and to seek consent through a separate prompt within 60 days.

What Triggered the Fine

The Garante said the violation centers on a Facebook app function called "Ottieni suggerimenti dalla galleria quando navighi su Facebook" ("Get suggestions from the gallery while browsing Facebook"), available since 2023, which surfaced photos and videos taken from a user's phone gallery as content they might want to post. CNBC described the same mechanism as a Facebook app feature that "suggested content from users' personal galleries for them to post."

The investigation began in July 2025 after a complaint from the Centro Tutela Consumatori Utenti di Bolzano, a consumer protection group, and the Garante said it relied on its own technical analysis of the feature before issuing the sanction.

How the Feature Obtained Access

According to the Garante's findings, gallery access was requested through a single permission valid for the entire app and for multiple functions with different needs, rather than a request tied specifically to the gallery-suggestion feature. That permission request, the authority said, was preceded by a generic notice referencing the need to "enable other features," language the regulator found did not allow users to understand they were also authorizing gallery-based suggestions. The Garante additionally found the feature was preset as active by default.

Factors Behind the €805 Million Figure

The Garante said several factors shaped the size of the penalty. It cited the scale of exposure, roughly 20 million Android users in Italy, as a key consideration. The authority also pointed to the continuing nature of the violation, which it said remains active for users who have not updated the app or who had already granted the original permission. A prior 2019 sanction against the company and what the Garante described as limited cooperation during the investigation were cited as additional factors.

The Garante stated that the €805 million fine equals approximately 0.47% of Meta's global revenue. CNBC reported the equivalent amount as about $887 million. By our calculation using those two reported figures, they differ by 82 units of their respective currencies (805 − 887 = −82), or about 9.2% measured against the dollar figure (−82 ÷ 887 × 100 = −9.2%) — a gap that reflects only the euro-to-dollar conversion, not any change in the underlying penalty.

Required Remedial Steps and Timeline

Under the order, Meta has 60 days to disable the gallery-suggestion feature by default and to implement a consent process that is distinct from other app permissions, according to both the Garante and CNBC. The Garante specified that the new consent request must clearly explain what the feature does, that it involves access to the phone gallery, and how a user can turn it off. Notably, the feature must default to off even for users who had previously granted permission under the old, bundled consent flow.

Beyond the consumer-facing change, the Garante said Meta must report to the authority within 30 days on the initiatives it has begun and within 90 days on the measures it has actually adopted. The order as published addresses Meta's conduct in Italy, where the Garante estimated roughly 20 million Android users were involved; neither the Garante's statement nor CNBC's report indicates whether Meta intends to extend the consent changes to markets outside Italy. CNBC reported that Meta was not immediately available for comment.

Jurisdiction and the Rejected Irish Defense

According to the Garante, Meta objected that the Italian authority lacked competence and that the matter should fall to Ireland's data protection authority. The Garante rejected that objection, stating that the provision violated was Article 122 of Italy's Privacy Code, which transposes the EU's ePrivacy directive, and that the ePrivacy framework does not provide for the "one-stop-shop" mechanism. The authority added that the rule protects the smartphone as part of a person's private sphere.

What the Investigation Did Not Cover

Both sources note that the inquiry was narrowly scoped. CNBC reported that the investigation "did not cover the possible use of the content to train artificial intelligence models, a practice Meta denied," and the Garante's statement likewise says the proceeding did not address the use of the content to train artificial intelligence, which Meta denies. The Garante also said it reserves the right to assess separately, through distinct inquiries, a newer feature launched in 2026 that allows gallery content to be processed in the cloud.

Bottom Line

The Garante's €805 million penalty, described by the authority as roughly 0.47% of Meta's global revenue and tied to an estimated 20 million affected Android users in Italy, represents a significant enforcement action grounded in Italy's ePrivacy rules rather than the GDPR's cross-border framework. The order's immediate consequences are concrete and time-bound: a 60-day deadline to disable the gallery-suggestion feature by default and build a standalone consent flow, with progress reports due to the regulator at 30 and 90 days. What remains unresolved in the public record is whether Meta will contest the decision, how (or whether) any consent redesign might extend beyond Italy, and how the separately flagged 2026 cloud-processing feature will be treated once the Garante examines it on its own terms.