Italy Fines Meta €805 Million: Here Is Why
Privacy Violations on Facebook
The Italian data protection authority, known as Garante, has fined tech giant Meta €805 million (approximately $887 million). The ruling stems from a feature in the Facebook Android app that accessed photos and videos on users' phones without obtaining proper consent.
The issue concerns the "gallery suggestions" feature introduced in 2023. As users browsed their Facebook news feed, the app would suggest photos and videos stored on their devices as potential post ideas. The regulator stated that this process occurred without the informed consent of the users.
Problematic Permissions and Legislation
According to Garante’s investigation, Facebook requested access to the gallery under the umbrella of general app permissions. Users enabling various features often failed to realize they were granting the app permission to view their media files. The regulator concluded this violated Article 122 of the Italian Privacy Code, which classifies a smartphone as an extension of an individual's private space.
Meta attempted to move the dispute to Irish jurisdiction, where the company’s European headquarters are located, but the Italian side rejected the argument. They maintained that the case involves electronic privacy rules, where the "one-stop-shop" principle does not apply. The regulator emphasized that the fine was issued regardless of whether the data left the phone or if the user suffered actual harm.
What Lies Ahead for the Company
In addition to the fine, Meta has been ordered to change its policy within 60 days and must obtain separate, specific consent from each user if they wish to use this feature. Furthermore, the feature must be disabled by default, including for those who had previously granted consent.
It is worth noting that this investigation did not concern the use of photos for training artificial intelligence, which Meta categorically denies. However, the regulator intends to separately examine a cloud processing feature launched in 2026. Approximately 20 million Android users in Italy were affected. Although Meta implemented certain changes, the regulator deemed them late and insufficient.
For users in Georgia, this case serves as another reminder that checking app permissions is essential. Often, seemingly harmless features designed to simplify our lives can become the basis for the unauthorized processing of our personal data.