Privacy breach via gallery suggestions
Italy’s data protection agency fined Meta €805m ($887m) for accessing Android users’ photos and videos without specific consent. The penalty targets a gallery suggestions feature that has been available since 2023, which provides photos and videos from a user’s phone gallery as ideas for posts during the browsing process. Through the Facebook application for Android devices, Meta accessed photographs, videos, and related metadata belonging to Italian users without properly informing them. The regulator stated that Facebook requested access via a single authorization for the entire app, a method which prevented users from understanding they were also authorizing suggestions from their gallery during the browsing session. This decision affects approximately 20 million Android users in Italy. The authority determined the fine amount based on the high number of people affected and Meta’s lack of cooperation during the investigation. The infringement remains ongoing for those who have not updated the app and for those who have already given their consent to the system. This fine amounts to roughly 0.4% of Meta’s $201bn annual turnover in 2025, a year when the company earned $60.5bn in net profit.
Meta appeals the penalty
Meta announced it will appeal the decision. A company spokesperson said they "strongly disagree" with the assessment and the "disproportionate level of the fine". In late October, authorities in New Mexico ordered Meta to pay $25bn for misleading residents for more than a decade regarding the use of their data. Meta slammed the $25bn New Mexico fine as a "tax" on freedom of expression. This Italian penalty is among the largest an Italian authority has imposed on a tech company, though Amazon received a fine exceeding €1.1bn in 2021 for breaching competition law. That Amazon penalty, which involved a breach of competition law, fell to €752m on appeal. The regulator now requires Meta to seek consent through a separate and specific request for the feature and to clearly signpost its purpose, specifically that it involves access to a user’s photo gallery and how to disable it. This decision follows the regulator’s finding that Meta’s single authorization for the app was insufficient for obtaining user consent. The regulator’s ruling requires Meta to provide clear information on how to manage these gallery permissions.
