Italy Fines Meta €805M for Accessing Users' Photos Without Consent

Italian privacy regulators have fined social media giant Meta €805 million after an investigation determined the company accessed the photo galleries of approximately 20 million users without proper consent. The penalty, issued by Italy's Data Protection Authority, targets practices surrounding the automated scanning of images stored on mobile devices. Officials stated that users were never adequately informed that their personal media was being examined.

The regulatory probe focused on an integrated feature within the Facebook application designed to suggest posts based on media saved on a user's phone. Under this system, the app automatically reviewed personal photo and video archives on Android devices to generate posting recommendations. Investigators discovered that this capability was switched on by default, operating quietly in the background without explicit authorization for that specific purpose.

According to the authority, known locally as the Garante, Meta relied on a single, broad device permission rather than obtaining distinct consent for content scanning. While users had granted general gallery access when installing or using the app, the notification never clearly explained that photos and metadata would be evaluated for algorithmic suggestions. European privacy frameworks require organizations to seek unambiguous, separate approval for distinct data processing activities.

The ruling emphasizes the immense scale of the practice, noting that roughly 20 million smartphone users across Italy were impacted by the automated feature. Because the tool was enabled automatically, millions of individuals had their private photo libraries processed without realizing the scope of data collection. Regulators underlined that photographic libraries often contain intimate personal details, necessitating the highest standard of user disclosure and control.

In calculating the €805 million sanction, the Italian watchdog pointed to both the severity of the infringement and Meta's conduct during the proceedings. Officials highlighted a previous regulatory penalty against the company dating back to 2019 as an aggravating factor in determining the total amount. The authority also cited an alleged lack of constructive cooperation from Meta throughout the course of the multi-year inquiry.

Alongside the financial penalty, the Italian watchdog imposed strict compliance directives that Meta must execute within a 60-day deadline. The company has been ordered to immediately disable the automated suggestion feature by default across all active accounts in the jurisdiction. Moving forward, the platform can only access photo albums if a user deliberately opts in through a standalone, clearly articulated permission prompt.

The landmark decision marks one of the most substantial regulatory penalties levied against Meta in Europe over user data and consent practices. Data privacy authorities across the European Union have steadily intensified oversight of how Big Tech platforms handle sensitive personal media on mobile operating systems. The case reinforces long-standing regulatory expectations that broad operating system permissions cannot serve as a blanket waiver for opaque background processing.

Privacy specialists and technology analysts note that the ruling could prompt wider audits of mobile applications that leverage device storage for engagement features. Many social networking platforms rely on smart device integrations to keep users engaged and actively publishing new content. As regulators draw firmer boundaries around mobile data access, developers may be forced to redesign interface permissions and eliminate default opt-in models globally.

Meta has the right to challenge the Italian regulator's decision and the associated fine through administrative appeals courts. The outcome of any prospective legal challenge will be closely watched by digital privacy advocates and platform operators navigating European compliance requirements. For now, the enforcement action signals an uncompromising stance by national regulators against pervasive mobile tracking masked behind routine system permissions.