In a landmark ruling that sends ripples through the tech world, Italy's data protection authority has fined Meta Platforms a staggering €805 million for systematically accessing user data without proper consent. The penalty, equivalent to 0.47% of Meta's global revenue, addresses a specific violation involving the unauthorized collection of photos and videos from Android users through a Facebook app feature. This case represents one of the largest privacy fines ever levied against a major tech company, highlighting the growing scrutiny of data practices across Europe.
At the heart of this case is a troubling practice that unfolded over several years. On January 1, 2026, Meta introduced a new function within its Facebook app that enabled cloud processing of content from users' photo galleries. Without obtaining proper consent or providing adequate notification, the company accessed and processed personal photos and videos stored on the devices of Android users. This practice affected a significant number of people across Italy, raising serious concerns about the boundaries of data collection and user privacy in the digital age.
Italy imposes an $887 million fine on Meta for Android users' data access.
The origins of this massive fine trace back to January 1, 2025, when Italian authorities initiated an investigation into Meta's data practices. What they discovered was a systematic approach to accessing user content that violated fundamental privacy principles. The Italian data protection authority took a critical stance, arguing that such unauthorized data collection represented a clear breach of European privacy regulations designed to protect individuals' personal information.
This approach aligns with European data protection regulations that allow for penalties proportional to a company's size and the severity of the infringement.
When determining the fine amount, Italian authorities didn't pull numbers arbitrarily. The €805 million penalty represents a carefully calculated 0.47% of Meta's global revenue—a significant sum that reflects both the scale of the violation and the company's substantial financial resources. This approach aligns with European data protection regulations that allow for penalties proportional to a company's size and the severity of the infringement.
Meta $META fined €805 million by Italy over alleged use of Android users’ photos and videos without consent | Per Reuters Italy’s data protection authority is the regulator behind the fine
Facing this substantial financial penalty, Meta Platforms has adopted a neutral stance, acknowledging the ruling without immediate public objection. The company has been given 60 days to comply with the authority's decision, though the specific measures required for compliance remain unspecified. This period allows Meta to review the findings and potentially implement changes to its data practices that would satisfy Italian regulators.
The Italian fine against Meta serves as a powerful warning to other tech companies about the consequences of inadequate data privacy practices. As digital platforms continue to evolve and find new ways to process user content, regulators are increasingly vigilant about ensuring that such innovations respect fundamental privacy rights. This case demonstrates that even the largest tech companies are not above the law when it comes to protecting user data.
Meta $META hit with an €805 MILLION fine in Italy. 🇮🇹 Regulators say Facebook accessed photos, videos and metadata belonging to around 20 million Android users without specific consent. Your gallery. Their access. No clear permission. https://t.co/f1rWVZ3nan
As of this writing, Meta faces the immediate challenge of addressing the Italian authority's findings while potentially navigating similar concerns in other European jurisdictions. The €805 million penalty stands as one of the most significant financial consequences for a data privacy violation to date, reinforcing Europe's commitment to enforcing strict data protection standards. For the Android users whose personal photos and videos were accessed without proper consent, this ruling represents a validation of their privacy rights and a reminder that in the digital realm, personal boundaries still matter.
