Meta Fined $887 Million in Italy Over Android Gallery Photos and Videos

Italy announced an €805 million ($887 million) fine against Meta on Saturday after regulators determined that Facebook accessed and processed photos and videos from Android users' device galleries without specific consent or adequate disclosure. As detailed in SecurityWeek's report, the Italian Data Protection Authority sanctioned Meta Platforms Ireland Limited following an official inquiry into automated gallery scanning features.

This report covers the regulatory findings against Facebook's gallery suggestion mechanism, the statutory legal basis under European privacy rules, the financial scale of the penalty, and the enforcement mandate issued to Meta. It provides mobile engineers, compliance officers, and platform architects with the verified operational details surrounding bundled mobile permissions and regional data protection enforcement.

01Regulatory Fine and Default Gallery Access

The Italian Data Protection Authority established that Facebook enabled media scanning features automatically on mobile devices rather than waiting for explicit user activation. Operating under the title of "Get suggestions from gallery when browsing Facebook," the feature scanned stored photos and videos without providing clear upfront disclosure to individuals.

The resulting financial sanction amounts to €805 million, which converts to approximately $887 million, levied directly against Meta Platforms Ireland Limited. Italian regulators determined that the unauthorized access infringed national privacy legislation enacting broader European standards protecting personal digital property.

Meta Platforms Ireland Limited formally challenged Italy's jurisdiction during the proceedings, according to the regulator's official statement released on Saturday. The administrative authority noted that Meta made no immediate public comment following the public announcement of the substantial regulatory penalty.

02Bundled Permissions and Automated Media Suggestions

Investigators found that the underlying configuration operated by default across the Facebook mobile application on the Android platform. Instead of requesting separate authorizations for distinct functional features, Facebook routed gallery access through a single blanket permission prompt that grouped multiple distinct operational objectives together.

The Italian watchdog concluded that conflating general photo upload capabilities with background browsing suggestions violated user consent standards. By bundling divergent tools under one generic media permission, the application prevented device owners from making granular decisions regarding how Facebook examined their local files.

Regulators underscored that collecting media stored directly on personal hardware demands dedicated transparency rather than passive background access. The authority established that users were neither properly informed about the background suggestions nor given an independent opportunity to evaluate the scanning feature on its own terms.

03European Privacy Directive and Global Turnover

The formal sanction rests on a European privacy directive incorporated directly into Italian statutory law. The legal framework establishes that modern smartphones constitute an integral element of an individual's private sphere, making unauthorized data harvesting from local hardware a statutory breach.

Under the directive, tech companies must secure "free and informed consent" prior to accessing or processing files stored on personal devices. The Italian regulator determined that Meta failed to meet this statutory threshold by relying on pre-enabled defaults and ambiguous multi-purpose permission agreements.

The €805 million penalty represents approximately 0.47% of Meta's global turnover across the corporate group. The authority explicitly stated that Meta's "lack of cooperation" during the course of the administrative investigation served as an aggravating factor that increased the ultimate monetary fine.

04Twenty Million Android Devices Across Italy

The scope of the enforcement action directly reflects the large scale of Meta's operating footprint within the country. The Italian data protection agency highlighted that Italy maintains an estimated population of about 20 million Android users who rely on mobile operating software across diverse smartphone models.

Because the gallery scanning mechanism targeted Android installations where Facebook was active, millions of local handset owners were exposed to automated photo and video inspection. Regulators treated the widespread deployment across the national user base as a major consumer privacy concern requiring formal administrative intervention.

While Meta Platforms Ireland Limited contested whether the Italian national authority maintained legal authority over its corporate activities, regulators affirmed their mandate over local data processing violations. The regulator emphasized that domestic consumer protections extend to international internet services distributing software within Italian territory.

05Sixty Days for Separate User Consent

In addition to issuing the financial penalty, the Italian Data Protection Authority imposed specific operational corrective mandates on Meta. The regulatory agency ordered the company to disable the automated gallery suggestion feature across affected systems within a strict 60-day compliance window.

The order further requires Meta to design and deploy a distinct consent mechanism before the feature can ever be reinstated. The company must seek separate, explicit permission specifically dedicated to the suggestion tool rather than hiding the function behind generic device-level storage authorizations.

The 60-day deadline establishes an unambiguous timeline for Meta Platforms Ireland Limited to modify the Facebook Android client software. Regulators confirmed that continued deployment of the default media suggestion architecture without independent consent would directly breach the binding administrative compliance order.