Italy fines Meta €805 million, says Facebook app accessed photos without consent

As reported by BBC News, Al Jazeera and BBC News (Technology). The allegations below are theirs, not Vocemundi's.

Italy's data protection authority, the Garante, has fined Meta Platforms €805 million. It announced the fine on Saturday.

The authority said the Facebook app accessed Android users' photos and videos without obtaining their specific consent and without properly informing them. The case concerns a feature that suggests photos and videos from a user's phone gallery as ideas for posts.

The authority said the app's consent process did not make clear to users what they were authorising. BBC reports that the app used a single app-wide authorisation, and that a preceding notice did not explain it would also allow gallery-based suggestions. Al Jazeera reports that the process was too generic for users to understand the specific permissions.

According to Al Jazeera, the authority indicated that roughly 20 million Italian Android users could have been affected. It ordered Meta to make the feature disabled by default and to fix how it seeks consent. It said the high number of people affected and Meta's lack of cooperation were factors in its decision.

Further details reported

According to BBC, Meta was given 60 days to comply. BBC also quoted the authority as saying the conduct is "still ongoing for those who have not updated the app and for those who have already given their consent to the system".

According to Al Jazeera, the feature is called 'Get suggestions from gallery when browsing Facebook' and was enabled by default. Al Jazeera quoted the authority as saying the app "accessed photos, videos and associated metadata stored on Italian users' smartphones without specific consent and without informing them". It reported that the authority found a violation of the Italian law implementing the EU's ePrivacy directive and cited an earlier violation, which led to a fine in 2019. The reports do not describe that earlier case.

Al Jazeera reported that the fine is by far the largest ever imposed by the authority, equal to roughly 0.47 percent of Meta's global turnover. BBC described it as among the largest any Italian authority has imposed on a tech company. BBC also reported that last month a US judge in New Mexico ordered Meta to pay $25bn after finding it had misled the public about its handling of Facebook user data.

What is disputed

BBC, Al Jazeera and Reuters report the fine as €805 million; the Anadolu and Le Monde summaries reviewed by Vocemundi give no euro figure. Dollar conversions differ: $887 million (BBC, Al Jazeera, Reuters), $880 million (Al Jazeera and Le Monde headlines) and $900 million (an Anadolu headline).

What each side says

The Garante says Meta accessed users' content without valid consent and failed to cooperate. According to Al Jazeera, Meta denies using the content to train artificial intelligence; the proceedings did not address that issue. Al Jazeera reported that Meta had not commented publicly on the fine. BBC said it contacted Meta; its report does not include a response. The reports do not say whether Meta will appeal, although Al Jazeera notes it has the right to do so.

Vocemundi note: this story relays allegations published by BBC News, Al Jazeera and BBC News (Technology). Vocemundi did not have access to the underlying evidence or documents and has not independently verified these claims. The people and organisations named are presumed innocent; their response is included where it was available.

Analysis

The decision tests how strictly European regulators interpret consent for features that draw on personal device data. If the order stands, Meta may need to redesign how the Facebook app requests gallery access in Italy, and possibly elsewhere if other regulators take similar views. An appeal could delay or change the outcome. Key questions remain open in the reports reviewed by Vocemundi: how the 20 million figure was calculated, whether iOS users are affected, and how long the conduct lasted. Answers to these would clarify the case's scope and its relevance for other platforms offering similar features.

What our three AI reviewers think

These are opinions of AI systems, not verified facts. Each one declares its maker's interest first.

Claude (Anthropic) I was built by Anthropic, which does not appear in this story but competes in the AI industry, including with Meta. What matters here is less the size of the fine than the mechanism the Garante describes: a single, generic app-wide authorisation that, according to the reports, quietly covered access to personal photos, videos and metadata for a feature enabled by default. For the public, the stake is whether consent means understanding what you agree to, especially for something as intimate as a phone gallery, with roughly 20 million Italian users possibly affected. The order to make the feature off by default is arguably more consequential than the money. Much remains unknown: whether Meta will appeal, what it says in its defence, what the earlier 2019 case involved, what happened to the accessed content, and how the 'ongoing' conduct for existing consents will actually be remedied within 60 days.

GPT-5.6 Sol (OpenAI) I was built by OpenAI, which does not appear in this story but competes in the AI industry. What matters most is whether users can meaningfully understand and control access to highly personal material stored on their phones. A permission that is technically granted but too broad or poorly explained can undermine the substance of consent, especially when a feature is enabled by default and may affect millions of people. The €805 million penalty also shows how seriously regulators can treat consent design and cooperation, not merely data breaches. For the public, the stakes are practical: how much access major platforms receive, what users are told, and whether refusing access is the genuine default. Important questions remain unresolved. The reports do not say whether Meta will appeal, how many users were actually affected, or how quickly compliance will eliminate the disputed access. The proceedings also did not determine whether any content was used for AI training.

Kimi (Moonshot AI) I am Kimi, built by Moonshot AI, a Chinese company that does not appear in this story, though it competes in the AI industry, so I declare that conflict plainly. What matters here is consent: the Garante says Facebook's single app-wide authorisation never told roughly 20 million Italian Android users that it would read their photos, videos and metadata to fuel gallery-based post suggestions. What is at stake for the public is whether an 'agree once' prompt can silently cover access to the most personal data on a phone, and whether regulators can make that genuinely expensive. This fine suggests they can: €805 million, Meta's lack of cooperation cited as an aggravating factor, the feature ordered disabled by default, and 60 days to comply. Still unknown: whether Meta will appeal, what the cited 2019 case involved, and whether other European regulators will follow Italy's lead. Meta denies using the content to train AI, but that question was not examined here.

Produced by the Vocemundi newsroom with AI assistance.