Italy’s data protection authority fined the Facebook parent company €805 million ($880 million) on Saturday for accessing users’ photos, videos, and metadata on Android devices “without obtaining specific consent and without properly informing them”.
The feature at the center of the case was simple. While you scrolled Facebook on your Android phone, the app surfaced pictures from your gallery and nudged you to share them. It was switched on by default. About 20 million Italian Android users were affected.
The Trick
Here is how Meta did it: The app asked for gallery access with one permission that covered the entire app and several unrelated features. That request came after a vague notice to “enable other features,” so users had no idea they were also turning on gallery suggestions.
Once the permission was granted, the app could read the device’s entire photo archive — permanently — “without the user or the authorities being able to verify which information is actually being used,” the regulator said.
The Punishment
Meta has 60 days to ask for separate, specific consent and switch the feature off by default, even for users who already allowed access.
The fine is large because of the number of people affected, a previous 2019 decision against Meta, and the company’s poor cooperation during the investigation.
Meta argued that Ireland’s data protection commission, its lead EU privacy regulator, should handle the case. The Italian regulator rejected that objection and ruled under the ePrivacy directive, which has no “one-stop-shop” system that lets a single lead regulator handle a company across the bloc.
The Bottom Line
Italy fined Meta €805 million for accessing 20 million Android users’ photos without specific consent. The feature was on by default and buried behind a vague permission request. Meta has 60 days to fix it. The regulator said the phone itself is part of a person’s private sphere, and any access to it needs free and informed consent.
My Opinion
€805 million might sound like a lot but it’s not. Meta is worth more than a trillion dollars. This fine is the cost of doing business. It is a parking ticket for a company that treats your private life as raw material.
The feature was on by default. The permission was buried behind a vague notice. The app could read your entire photo archive and the regulator could not even verify what it used.
Italy deserves credit for acting. The regulator treated the phone as part of a person’s private sphere, and said any access to it needs free and informed consent, whether or not data leaves the device. That should be obvious. It should not require an €805 million fine to establish.
