Privacy violations in Android feature access
The Italian Data Protection Authority fined Meta €805 million after an investigation launched in 2025 found the company violated privacy laws. The regulator targeted the "camera roll suggestions when browsing Facebook" feature, which suggests photos and videos from a phone’s gallery for users to add to posts via its application. This fine is the largest penalty the Italian regulator has ever imposed. The investigation, which began in 2025, established that access to a user’s camera roll is requested with a single permission for the entire app, which the authority said covers multiple features with different needs and lacks specific authorization. The regulator found that Meta’s single permission request provided insufficient transparency for users managing their personal data on Android devices. A generic warning preceded the authorization request and failed to allow users to understand that they were authorizing picture and video suggestions. The authority stated: "If granted in full, this type of permission allows the app to read the device’s entire photo archive, usually permanently, without the user or the authorities being able to verify which information is actually being used." This violation concerns the Italian law implementing the EU’s ePrivacy directive.
Compliance mandates and jurisdiction disputes
| Enforcement Detail | Specification |
|---|---|
| Total Fine | €805 million |
| Compliance Deadline | 60 days |
| Subject Feature | Camera roll suggestions |
| Primary Violation | ePrivacy directive |
Meta has 60 days to obtain consent separately and specifically for the feature, explain what it does, and provide instructions on how to disable it. The regulator also ordered Meta to disable the feature by default. This mandate means the company must revert settings to off for all users who previously granted permission for such access. The Italian authority rejected Meta’s objection of lack of jurisdiction in favor of the Irish authority because the ePrivacy regulation does not provide for the "one-stop-shop" mechanism. The authority requires that Meta clearly explain the feature, provide instructions on how to disable it, and ensure it is turned off by default. Meta must provide this specific information to users to ensure compliance with the directive. Meta did not immediately respond to a request for comment and retains the legal right to appeal the decision.
