Italy fines Meta $887 million over Android user data access

Italy's data protection authority has hit Meta Platforms with an €805 million, or approximately $887 million, penalty over how the Facebook application handles personal media on Android devices. The sanction arrives after a regulatory investigation launched in 2025 into a specific feature titled Get suggestions from your gallery while browsing Facebook, which was introduced in 2023 to prompt users with photographs and videos stored locally on their phones.

According to the Italian regulator, known as the Garante, the tool scanned local image archives, videos, and associated metadata without securing proper authorization. Instead of a separate, dedicated prompt, the feature relied on a broad, single permission request covering the entire application at installation, automatically opting roughly 20 million Italian Android users in by default. This default setup gave the app permanent, ongoing read access to private device storage without clear disclosure to the individuals whose galleries were reached.

Jurisdictional Clashes and the ePrivacy Framework

During the proceedings, Meta argued that the matter should fall under the purview of Ireland's Data Protection Commission pursuant to the EU's GDPR one-stop-shop rules. The Italian watchdog rejected that defense entirely. The agency anchored its ruling instead in Article 122 of Italy's privacy code, which implements the EU's ePrivacy Directive. The Garante held that the ePrivacy framework falls outside the one-stop-shop mechanism because a smartphone belongs to an individual's private sphere, meaning any access requires free and informed consent regardless of whether data leaves the device.

In calculating the monumental sum, the regulator cited roughly 20 million Italian Android users affected, the continuing nature of the violation, a prior penalty from 2019, and what it characterized as limited cooperation during the probe. The total fine equals roughly 0.47% of Meta's global revenue. While the penalty sits well below the record €1.2 billion fine handed down by Ireland's Data Protection Commission in May 2023 over European user data transfers to the US, it towers over previous Italian penalties, such as a €3.5 million fine levied by the antitrust authority AGCM in 2024 over data use disclosures for advertising.

The 60-Day Compliance Window and Operational Impact

The regulatory order carries strict operational mandates that force a redesign of how the Facebook app interacts with mobile operating systems in the European market. Meta faces a hard window of 60 days to completely disable the gallery-suggestion feature by default. To reactivate it for any user, the company must require separate, explicit consent rather than relying on bundled app permissions. Furthermore, Meta must submit formal progress reports at the 30-day and 90-day marks.

Industry analysts note that turning the feature off by default and forcing an opt-in screen typically causes uptake to plummet sharply. If other European regulators adopt the Garante's reasoning, the same compliance switch will need to be flipped across the entire European Union. Beyond the immediate feature overhaul, the ruling leaves open future liabilities. The current investigation did not examine whether the accessed photographs and videos were used to train artificial intelligence models—a practice Meta has explicitly denied. However, the Italian authority reserved the right to separately evaluate a newer feature introduced in 2026 that processes gallery content through cloud-based systems.

Practical Steps for European Users and Developers

For everyday users of the Facebook Android application in Europe, the ruling alters how permissions must be granted when the 60-day compliance window closes. Affected individuals can review their phone settings and app permissions independently:

1. Open the settings menu on your Android device and navigate to the application manager or apps list.
2. Select Facebook and check the permissions section, specifically looking at access permissions granted to storage, photos, and media.
3. Revoke broad or permanent photo permissions if you wish to prevent background scanning, anticipating that Meta will soon be required to present a separate, explicit opt-in prompt for gallery suggestions.

For software developers and tech startups operating within the European regulatory sphere, the Garante's decision delivers a clear compliance lesson. Relying on a standard operating system permission prompt at the app installation level does not satisfy European data rules regarding smartphone storage. Separate consent must be gathered for specific utility functions, outlining precisely what happens to local files, with detailed records maintained for regulatory inspection.

Meta was not immediately available for comment following the release of the decision.