Italian regulators have fined Meta €805m (£670m; $887m) for accessing Android users' photos without their specific consent.
Italy's Data Protection Authority said Meta did not properly inform about 20 million smartphone users that it had access to their photos and videos through a feature of the Facebook app. It is among the largest fines an Italian authority has ever imposed on a tech company.
A Meta spokesperson told the BBC it plans to appeal.
What the feature does
The charge relates to a feature that suggests photos and videos from a user's phone gallery as ideas for posts.
Facebook requested access to users' photo galleries through a single app-wide authorisation. According to the regulator, the notice shown beforehand did not make clear that this would also allow Facebook to generate suggestions based on the photos in the gallery.
The distinction the regulator is drawing
This is worth separating carefully, because it is not a case of secret data collection.
Users did grant photo access — knowingly, through the standard Android permission prompt. Almost everyone grants it, because without it you cannot attach a photo to a post, which is most of what the app is for.
The regulator's objection is that one permission was used for two purposes. Granting access so an app can upload the photo you choose is not the same as granting access so the app can look through the gallery and decide which photos to suggest. The first is a tool you operate. The second is a system that reads everything in order to recommend.
Italy's position is that the second needs its own, separately explained consent.
What Meta has to do
The authority has given Meta 60 days to disable the feature by default and to seek users' consent for it separately.
It said it took into account "the high number of people affected" and the fact that the issue is "still ongoing for those who have not updated the app and for those who have already given their consent to the system".
That second clause matters. The regulator is saying the harm did not end when the feature was publicised, because people who already consented under an unclear notice are still consenting under it.
Why this reaches past Italy
Bangladesh has no equivalent authority and no rule that would require a second consent for a feature like this, so the default here will remain whatever Meta ships globally — and global defaults usually follow the strictest large market that actually enforces.
Until then, the practical control is on the phone rather than in the app. On Android, Settings → Apps → Facebook → Permissions lets you set photo access to "ask every time" or to selected photos only. That removes the standing gallery access the fine is about, at the cost of a prompt each time you post a picture.
Why the size of the fine is not the point
€805m is a large number and a small one at the same time, and it is worth holding both. It is among the biggest penalties an Italian authority has issued; it is also recoverable from a company of Meta's size without changing any plan. The part of this ruling with teeth is not the money but the 60-day order to turn the feature off by default — because a default is worth far more than a fine. A penalty is paid once. A default that has to be opted into applies to every user, every day, for as long as the product exists.
