A permission prompt becomes an €805 million problem
Meta has been fined €805 million in Italy after the country’s data protection authority concluded that Facebook for Android accessed photographs, videos and related metadata stored on Italian users’ phones without specific consent and without sufficiently clear notice . The case centers on a Facebook feature that suggests photos and videos from a user’s device gallery while the person is browsing the app, nudging them toward possible posts .
The sanction lands at the intersection of mobile permissions, platform design and European privacy law. On paper, the disputed feature sounds like a minor product convenience: an app sees local media and recommends items a person might want to share. In the regulator’s view, however, the design crossed a legal line because the user was not being asked a clear, separate question about that specific access . The Garante, Italy’s privacy authority, said the function was pre-set as active and tied to a broad authorization covering the app as a whole and multiple functions with different purposes .
That framing is what makes the case larger than one product toggle. The authority is effectively saying that access to a phone’s local gallery cannot be buried inside a general Android permission flow or a vague app notice when the result is ongoing visibility into photos, videos and metadata . For app developers, the message is blunt: if a feature touches sensitive material stored on a device, convenience defaults can become regulatory liabilities.
What the Italian regulator says Facebook did
The Garante says the relevant feature, available since 2023, is called “Get suggestions from gallery when browsing Facebook” in English-language reporting and “Ottieni suggerimenti dalla galleria quando navighi su Facebook” in the Italian release . It proposes photos and videos from the device gallery as posting ideas while a user navigates Facebook .
According to the authority, Facebook requested access to the gallery through one authorization valid for the whole app, rather than a distinct permission tied only to this suggestions feature . That request was preceded by a generic notice about enabling other features, which the regulator said did not allow users to understand that they were also authorizing gallery suggestions . The authority also found that the feature was enabled by default .
The regulator’s concern goes beyond whether a user tapped “allow” at the operating-system level. It said that, if granted in full, this type of authorization can permit the app to read the whole photographic archive of the device, typically on an ongoing basis, while neither the user nor the authority can verify exactly which information is actually used . AP also reported that investigators found Facebook had requested gallery access through a single permission covering multiple functions with different purposes .
That distinction is central. Meta’s expected argument is not that Android has no permission prompt, but that the user already grants device-level access and can later change that choice in settings . Italy’s authority is saying that device-level access is not enough when the user is not separately and clearly informed about the specific function that will use the gallery .
The legal basis: a phone as private space
The Garante tied the violation to Article 122 of Italy’s Privacy Code, which implements the EU ePrivacy Directive . The authority said the rule protects the smartphone as part of a person’s private sphere, and that access to information stored on it requires free and informed consent regardless of whether the data is transmitted elsewhere or whether harm is proven .
That point matters because it narrows the debate. This is not only a question of whether Meta used the content in a damaging way. It is about access itself. In the regulator’s view, the phone gallery is not a neutral technical resource; it is a private archive. A product feature that reads from it must be explained and consented to in a way the user can actually understand .
The proceeding was imposed on Meta Platforms Ireland Limited, the entity that often handles Meta services in Europe . Meta challenged Italy’s jurisdiction, but the Garante rejected that objection, saying the ePrivacy framework does not provide for the same “one-stop-shop” mechanism associated with other EU data protection enforcement . In practical terms, Italy said it could act directly.
The order: turn it off by default and ask again
The financial penalty is only part of the decision. The Garante gave Meta 60 days to change the feature’s operation: Facebook must ask for consent through a separate, specific request, clearly explain what the feature does, state that it involves access to the gallery, and explain how to disable it . The authority also ordered that the feature be kept off by default, including for people who have already granted authorization .
If Meta does not meet the 60-day deadline, the feature cannot be activated for users who have not given valid consent . Meta must also tell the authority within 30 days what initiatives it has started and within 90 days what measures it has adopted . That timetable turns the case into an immediate compliance project, not merely a fine to contest later.
The remedy is especially important because it reaches existing users. The Garante did not accept the idea that past broad permission should continue to support the gallery-suggestions system. Instead, it wants a new, feature-specific consent flow and a default-off design .
Why the fine is so large
The authority said the amount reflected several aggravating factors, including the high number of people involved, about 20 million Android users in Italy, and the duration of the violation . The Garante said the breach was still ongoing for users who had not updated the app and for users who had already granted authorization to the system . AP reported that the penalty equals about 0.47% of Meta’s global turnover .
The regulator also cited a previous 2019 decision against the company and what it described as limited cooperation during the investigation . At the same time, it recognized that Meta had made some changes after the complaint, though the authority considered them late and limited to people who updated the app .
Al Jazeera described the €805 million sanction as by far the largest fine ever imposed by the Italian privacy regulator . The Guardian called it among the largest penalties an Italian authority has imposed on a technology company, while noting that Italy previously fined Amazon more than €1.1 billion in a competition case that was later reduced on appeal .
Meta plans to appeal
Meta says it plans to appeal the decision and strongly disagrees with both the regulator’s assessment and the level of the fine, according to The Guardian . The company has characterized the feature as a tool that helps people share photos and videos, and reporting cited by The Hacker News says Meta argues it works only after users grant permission on their device and that users can change permission settings at any time .
That response sets up the likely dispute on appeal: whether a general device permission, paired with later settings controls, satisfies the standard for specific, informed consent under the Italian rules implementing ePrivacy. The Garante’s answer is no; it wants the consent request to be separate from the app’s broader access request and tied explicitly to the gallery-suggestions function .
As of the latest reports published over the weekend, the appeal has been announced but not resolved . Until a court or tribunal changes the decision, Meta faces both the financial sanction and the short compliance clock.
What this means for app design
The case is a warning for any app that relies on local media access, especially where the feature is pitched as a convenience. Product teams often treat defaults as growth levers: fewer prompts, smoother sharing, faster activation. Regulators increasingly see those same choices as pressure points, especially when the feature touches intimate data such as photos, videos and file metadata.
The Italian decision suggests three practical rules. First, “permission” is not always enough; the user must understand the specific purpose. Second, “on by default” is risky where sensitive local data is involved. Third, a general authorization for an app may not justify every downstream feature that can use the same technical access.
There is also an AI shadow around the case. The Garante said this proceeding did not examine whether gallery content was used to train artificial intelligence, which Meta denies . The authority added that it may separately assess a newer 2026 function that allows gallery content to be processed in the cloud . That leaves a second regulatory door open, even though the current fine is about gallery access and consent rather than AI training.
For users, the immediate lesson is simple: review app permissions and in-app settings, especially for photo and video access. For developers, the lesson is more expensive: a default that makes sharing easier can become an €805 million design flaw when the consent behind it is not specific enough.
Comments
Be the first to comment.