Italy's data protection authority has fined Meta Platforms 805 million euros ($887 million) after finding the company accessed Android users' photos and videos through a default Facebook feature without obtaining their specific consent. Around 20 million Android users in Italy are affected.
Italy's data protection authority has fined Meta Platforms 805 million euros — equivalent to $887 million — after finding the company accessed photographs and videos stored on Android users' devices without obtaining their informed consent, the agency said in a statement Saturday.
The authority found that Facebook had enabled a "get suggestions from gallery when browsing" feature by default, allowing the app to access users' personal photo libraries through a single permission notice rather than seeking their explicit, separate consent for that purpose.
Around 20 million Android users in Italy are affected by the practice, according to the regulator. The fine represents approximately 0.47 percent of Meta's global revenue, the agency said.
Meta has 60 days to disable the feature by default and obtain users' consent through a dedicated process, the authority said.
A Meta spokesperson said the company would appeal, strongly disagreeing with the authority's decision and calling the fine "disproportionate." "This is a simple feature that helps people share photos and videos on Facebook. Users must grant permission on their device before the feature can operate, and they can change that permission at any time in their settings," the spokesperson said in a statement.
The investigation, which began in 2025, did not examine the possible use of the accessed content to train artificial intelligence models — a practice Meta denied — the authority noted.
The regulator also said it had reserved the right to separately assess a newer feature, launched in 2026, that allows content from users' galleries to be processed in the cloud.
The penalty adds to a growing list of enforcement actions European regulators have brought against major American technology companies under the bloc's data protection framework. Privacy authorities across the European Union have increasingly focused on whether companies obtain sufficiently granular consent before accessing device-level data.
Meta's challenge will center on whether a device-level operating system permission — which Android users grant when they first install or configure the Facebook app — constitutes adequate consent under European law, or whether the company was required to present a separate, purpose-specific request tied to the gallery suggestion feature.
The outcome of any appeal could carry implications well beyond Italy, potentially establishing a precedent for how app-level features that rely on broad device permissions are treated under European data protection rules.
Jay Goldberg is a staff writer at TechEchelon covering technology, markets, and policy. He files the breaking news and deal coverage that move the publication's core desks.
More from Jay →Cursor confirmed hackers exploited a stolen credential from AI provider Fireworks AI to distribute malware-laced Claude Code extensions through its marketplace, exposing up to 5,000 developers to persistent SSH backdoor software for approximately 11 hours on October 29.
Attackers exploited two critical PHP flaws and a Check Point zero-day to compromise Security Gateway instances and deploy a data wiper on VMware ESXi hosts, with the first wave targeting Israeli organizations beginning October 30.
Nitori Holdings, Japan's largest furniture retailer, says an unauthorized intruder may have stolen up to 37.62 million customer records after gaining access to a company system in mid-October and going undetected until November 6.
Written for readers who already know the basics — markets, AI, and the policy decisions that shape both.