Italy Fines Meta $887 Million Over Facebook Gallery Access

By Priya Raman

Italy has fined Meta $887 million for a Facebook feature that accessed Android users' gallery photos and videos without specific, informed consent, the country's data protection authority announced on Saturday. The penalty equals approximately 0.47% of the group's global revenue.

The regulator ordered Meta to disable the feature, called "Get suggestions from gallery when browsing Facebook," and obtain separate consent for its use within 60 days.

The Italian Data Protection Authority said the feature violated a European privacy directive incorporated into Italian law. That directive protects smartphones as part of a person's private sphere and requires "free and informed consent" for such access, the authority said.

The stakes are large. Italy has about 20 million Android users, according to the agency. The fine falls on Meta Platforms Ireland Limited, which challenged Italy's jurisdiction during the proceedings.

What Did Investigators Find?

Two findings drove the decision. First, the feature was enabled by default. Users did not choose it; Facebook switched it on for them.

Second, Facebook requested gallery access through a single permission covering multiple app functions with different purposes. Under the European directive, data use requires consent specific to each purpose. Bundling gallery access into one broad permission failed that test.

The authority also cited Meta's "lack of cooperation" with the investigation as a factor that increased the penalty.

Meta made no immediate comment.

What Does This Change for Marketers?

The practical question for practitioners is what this ruling changes for consent architecture on mobile. The answer: default-on access to device storage is now a documented, heavily priced liability in a major EU market. A regulator has put a number on it — $887 million — and tied the size of that number partly to how the company behaved during the inquiry.

Three implications follow from the decision:

• Unbundle permissions. One permission covering several purposes, each with different aims, does not satisfy the specific-consent standard the authority applied.

• Expect heavier penalties for obstructive conduct. The authority stated plainly that "lack of cooperation" factored into the fine. How a company engages with a regulator now has a measurable cost.

Count the user base. With roughly 20 million Android users in Italy alone, gallery-access features operate at a scale where even small consent failures multiply into systemic exposure.

The ruling also clarifies that jurisdictional challenges carry limited weight. Meta Platforms Ireland Limited contested Italy's authority over the matter, according to the regulator's statement, and the fine followed regardless.

What Happens Next

Meta now faces a 60-day deadline to disable the feature and design a separate consent flow if it wants to keep the functionality alive in Italy. How the company rebuilds that permission request — and whether other EU regulators follow the Italian authority's reasoning on bundled permissions — will set the template for mobile data collection across European markets.