Facebook: Data Protection Authority fines Meta 805 million for the inappropriate use of mobile phone images
According to the Authority, via the app for Android devices, ‘the company gained access to photographs, videos and related metadata stored on Italian users’ smartphones’ without authorisation
The Data Protection Authority has fined Meta 805 million euros. According to the Authority, via the Facebook app for Android devices, ‘the company accessed photographs, videos and related metadata stored on Italian users’ smartphones without having obtained specific consent and without having adequately informed them’.
The measure relates to the ‘Get suggestions from your gallery whilst browsing Facebook’ feature, available from 2023, which suggests photos and videos from the user’s phone gallery as ideas for posts whilst they are browsing.
The investigation began in July 2025 following a report from the Bolzano Consumer and User Protection Centre and drew on a technical analysis carried out by the Authority. The findings, it is emphasised, revealed that: access to the gallery is requested via a single authorisation, valid for the entire app and for multiple functions with different requirements; the authorisation is preceded by a generic prompt (‘Enable other features’) which does not allow the user to understand that they are also authorising suggestions from the gallery; furthermore, the feature was found to be preset as active. If granted in full, this type of authorisation allows the app to access the device’s entire photo library, usually on a permanent basis, without the user or the Authority being able to verify what information is actually being used.
The Data Protection Authority pointed out that the provision that had been breached – Article 122 of the Privacy Code, which transposes the European ePrivacy Directive – protects the smartphone as part of an individual’s private sphere.
Any access to the information it contains therefore requires free and informed consent, irrespective of whether data is transferred or whether any harm has occurred. The Authority also rejected the plea of lack of jurisdiction raised by the company in favour of the Irish authority, as the ePrivacy Regulation does not provide for a ‘one-stop shop’ mechanism.
