Italy’s watchdog says the app accessed Android users’ photos and videos without specific, informed consent
Italy’s privacy watchdog has fined Meta, the parent company of Facebook, Instagram, and WhatsApp, €805 million ($887 million) over Facebook’s access to users’ photos and videos on Android devices without obtaining informed consent.
In a statement on Saturday, the Italian Data Protection Authority said it had launched an investigation in July 2025 into a Facebook feature that suggests photos and videos from users’ phone galleries for posting on the platform.
According to the regulator, the feature is enabled by default through a single permission covering multiple functions. The authorization notice, which asks users to consent to “enable other features,” fails to make clear that they are also allowing Facebook to suggest content from their galleries, the watchdog said.
Once full permission is granted, the app can continuously access the device’s entire photo and video archive, with users and regulators unable to verify what information is actually being accessed or used, according to the regulator.
The watchdog gave Meta 60 days to change how its Facebook app requests consent for the feature and explicitly inform users about its purpose, while keeping it disabled by default unless they provide separate, informed consent.
The authority said the breach potentially affected a significant number of people, noting that Italy has an estimated 20 million Android users. It also accused Meta of failing to cooperate with the investigation.
The regulator said it may separately investigate a feature introduced earlier this year that allows cloud processing of Facebook users’ gallery content.
A Meta spokesperson said the company would appeal the “disproportionate” fine.
“This is a simple feature that helps people share photos and videos on Facebook. Users must grant permission on their device before the feature can operate, and they can change that permission at any time in their settings,” Meta said.
Last month, a court in New Mexico ordered Mark Zuckerberg’s company to pay $25 billion in civil penalties for violating the US state’s Unfair Practices Act. The New Mexico Department of Justice described the verdict as a “landmark victory,” saying it “has secured one of the largest financial penalties against a corporation in U.S. history.”
The case followed the 2018 Cambridge Analytica scandal, in which the British political consulting firm obtained personal data from tens of millions of Facebook users without their consent and used it to target voters with political messaging, including during Donald Trump’s successful 2016 US presidential campaign. The New Mexico case also involved broader allegations that Facebook misled users about its privacy practices, third-party access to personal data, and content moderation.
Meta also faces a potential fine of up to 6% of its worldwide annual turnover after European Union regulators preliminarily found that the US tech giant had failed to adequately assess and mitigate risks to Facebook and Instagram users’ wellbeing from features that encourage compulsive use. These include autoplay, infinite scroll, push notifications, and highly personalized recommendation systems.
A final decision has yet to be made, with Meta rejecting the allegations.
