Italian regulator fines Meta 805 million euros for unauthorized Android gallery access

The Italian data protection authority fined Meta Platforms Ireland 805 million euros for unauthorized access to photos, videos, and metadata from Android user galleries in Italy. The penalty follows an investigation into a Facebook feature that accessed private user content without sufficient notification or consent. This fine represents approximately 0.47% of the total global revenue of Meta Platforms Ireland.

Details of the privacy violation

The investigation focused on a Facebook feature introduced in 2023 called Get suggestions from gallery while browsing. According to the Italian data protection authority, this feature was enabled by default on Android devices. The investigation found that the system used a single permission to perform multiple functions, which prevented users or authorities from verifying exactly which data was being accessed. The feature allowed the application to access entire photo archives without clear user notification regarding the scope of the data collection.

The regulatory action was initiated in July 2025. This investigation followed a formal complaint submitted by the Consumer Protection Center in Bolzano. The authority noted that the scale of the violation was significant, affecting an estimated 20 million Android users in Italy. The regulator stated that the fine was determined based on the number of affected users, the duration of the violation, a prior violation from 2019, and a lack of cooperation from the company during the proceedings.

Mandatory changes and future oversight

Meta Platforms Ireland must implement specific changes to its data practices within a strict timeframe. The company has 60 days to disable the feature by default and must obtain separate, explicit consent from users before accessing gallery content. The Italian data protection authority has also reserved the right to investigate a new function introduced in 2026 that involves the cloud-based processing of gallery content.

While the investigation addressed unauthorized access to media, it did not cover the potential use of content for training artificial intelligence models. Meta Platforms Ireland has denied allegations regarding the use of such data for artificial intelligence training. This penalty is one of the largest ever imposed by the Italian regulator on a technology company.

Global regulatory challenges for Meta

The fine in Italy follows other significant legal challenges faced by the company regarding data practices and platform management. In October 2026, a judge in New Mexico ordered Meta Platforms Ireland to pay 25 billion dollars for misleading the public regarding Facebook user data practices. Additionally, in November 2026, the Brazilian Electoral Court fined the company 1.3 million euros following allegations regarding campaign interference involving Luis Inácio Lula da Silva.