Italy fines Meta €805 million over Facebook photo access without consent

Italy's data protection authority has fined Meta €805 million for allowing Facebook to look through Android users' photos without their specific consent, in one of the largest penalties an Italian regulator has ever imposed on a technology company.

The fine, equivalent to about £670 million or $887 million, follows an investigation into a Facebook feature that suggests photos and videos from a user's phone gallery as ideas for posts. The regulator found that Meta had not properly informed around 20 million smartphone users that the social network could reach into the pictures and videos stored on their devices.

According to the authority, Facebook requested access through a single, app-wide authorisation, and the notice shown to users beforehand did not make clear that agreeing would also let the app generate suggestions based on the contents of their gallery. The regulator cited the high number of people affected, the fact that the practice is still continuing for people who have not updated the app and for those who have already agreed to the system, and what it described as Meta's lack of cooperation during the investigation.

Meta has been given 60 days to switch the feature off by default and to ask users for their consent separately before it can look at their photos in this way. A spokesperson for the company told the BBC that Meta planned to appeal against the decision.

How the photo feature works

The feature at the centre of the case is designed to help people post more often. When switched on, it scans the photos and videos saved on a phone and proposes some of them as ready-made posts, so that users do not have to go looking for something to share.

On Android phones, the access is requested once, for the app as a whole, rather than each time a photo is used. The Italian regulator's objection is not that users were never asked at all, but that the request and the information given with it did not explain clearly enough what Facebook would do with the access once it had it.

That distinction matters under European data protection rules, which require consent to be specific and informed. A broad permission to reach the photo gallery, the regulator concluded, is not the same as permission to study its contents and turn them into suggestions.

Meta disagrees. In a statement to the BBC, the company said it strongly disagreed with the regulator's reading of the facts, its application of the law and the size of the fine, describing the feature as a straightforward tool that helps people post photos and videos to Facebook. The company added that people must give permission on their device before the feature can operate, and that they can change that permission at any time through their settings.

Why the regulator acted

The size of the fine reflects both the scale of the practice and the regulator's view of how Meta handled the case. Around 20 million people were affected, a figure the authority highlighted when announcing the penalty, and the practice has not stopped: it continues for users who have not updated the app, and for those who gave their consent under the old system.

Penalties of this size from an Italian authority are rare, and the decision places Meta among a small group of companies to have faced a fine approaching a billion euros in a single case. The 60-day deadline gives Meta a short window to change how the feature works for Italian users, so that people who want the suggestions would have to switch them on knowingly rather than having the feature run because of a permission granted for the app in general.

A growing bill for Meta

The Italian fine is the latest in a run of expensive legal setbacks for the company behind Facebook, Instagram and WhatsApp. Last month, a judge in the US state of New Mexico ordered Meta to pay $25 billion, about £18.6 billion, after finding that the company had spent years misleading the public about how it handled Facebook users' data. That was the largest fine the company has ever faced.

For now, the practical effect for Italian Facebook users is limited. The feature will keep working as it does today until Meta changes it or the appeal is decided, and people who are concerned can already switch off the phone's photo access for the Facebook app in their device settings.

What happens next will depend on the appeal and on how quickly Meta moves to meet the 60-day deadline. If the fine stands, it will be a reminder to other technology companies that European regulators are willing to impose penalties running into hundreds of millions of euros when they believe consent has not been properly obtained, and that a permission buried in a general request may not count as consent at all.