Imagine opening your messaging app and, as a simple prerequisite to start a chat, granting permission to see not just the photo you intended to share, but every image, screenshot, and video on your device. The feature, embedded within Facebook’s interface, relied on a broad permission model that treated the smartphone’s entire photo archive as a single, accessible block. For the user, it appeared as a routine step; for the data authorities, it represented a significant overreach. The practice wasn’t a glitch or a rare error—it was a default behavior for millions, designed for convenience but executed in a way that ignored the principle of data minimization, which suggests apps should only access what is strictly necessary for a specific function.
The unraveling of this arrangement began not with a global probe, but with a local concern. In July 2025, the consumer protection center in Bolzano, located in Italy’s northernmost region, flagged the issue to the Garante, the country’s data protection authority. This tip-off provided the spark for a formal investigation into Meta’s practices. Bolzano’s role was crucial; it demonstrated that privacy enforcement in the European Union is not just a matter for Brussels, but a regional and local issue. When users in a specific jurisdiction notice their digital rights are being eroded by a single app’s architecture, the local oversight bodies are empowered to act. The Garante took the report seriously, viewing the broad access to metadata and image files as a violation of fundamental rights to private life and data protection.
The Italian Data Protection Authority fined Meta €805 million ($887 million) for accessing photos and videos of Android users’ galleries without their explicit consent.= https://t.co/dtHhNHWJRl
Instead, it contested the authority of the regulator itself. The company argued that because its European headquarters are located in Ireland, the Irish data protection authority was the sole competent body for oversight. This is a common legal maneuver among tech giants, leveraging the structure of the General Data Protection Regulation (GDPR), which allows one member state to act as the "lead supervisory authority" for a multinational company. However, the Garante rejected this objection. It argued that the specific impact on Italian users and the specific harm caused within Italian borders justified local jurisdiction. This rejection was a significant precedent, signaling that while one-stop-shop mechanisms exist, they are not absolute shields against local enforcement when the harm is distinctly national. The authority made clear that a company cannot hide behind its Irish registration to ignore the specific expectations of Italian users.
Meta is now required to obtain explicit, granular consent from users specifically for photo gallery access.
The fine itself is staggering in its isolation: 805 million euros. To put that figure in perspective, the Garante noted it represents approximately 0.47 percent of Meta’s projected global revenue for 2024. While that percentage sounds small on a global balance sheet, the absolute number underscores the regulatory pressure on Big Tech. More critically, the fine reflects the sheer scale of the user base affected. The investigation determined that 20 million Android users in Italy had been exposed to this broad access model. For those users, their entire visual history of their lives—vacations, documents, private moments—had been technically accessible to a social media platform without granular consent. The metadata attached to those photos, such as location and timestamp, added another layer of sensitivity, creating a detailed map of a user's life that was swept up in a single permission prompt.
Privacy: Facebook (Meta) fined 805 million euros in Italy
The core issue lay in the technical design of the 2023 feature. When a user wanted to post a photo or share an image, the app did not ask for permission to access just that specific file. Instead, it requested a general permission to read the storage. On Android, this translated to access to the media library. The system didn’t just see the photo you were holding; it saw the folder it was in, and by extension, the ability to enumerate other files. The Garante criticized this as disproportionate. The principle of data protection requires that access be limited to the minimum necessary. By granting sweeping access for a limited task, Meta failed to uphold this standard. The authority’s critique was not just about the fine, but about the architecture of consent. It argued that the user’s ability to say "yes" to one photo did not equate to saying "yes" to their entire digital library.
The Garante did not stop at the financial penalty. It issued a strict directive for remediation. Meta is now required to obtain explicit, granular consent from users specifically for photo gallery access. This means the "one-tap" broad permission is dead. Furthermore, and perhaps more importantly, the feature must be disabled by default. Even for users who had previously granted permission, the old default settings are now void. The app must now assume a "no" until a user actively chooses "yes" for specific, limited access. This shift in default settings is a fundamental change in user agency. It reverses the inertia that kept people’s photos exposed simply because they had clicked "allow" months or years ago without fully understanding the scope of that permission.
JUST IN: Meta, $META, fined €805,000,000 after Facebook accessed photos on 20 MILLION Android phones without consent. The Facebook app for Android had access to photos, videos and their metadata in the phone’s gallery. A feature live since 2023 suggested pictures from your gallery as posting ideas while you browsed. Meta has 60 days to turn it off by default, including for people who already said yes. The fine works out to about 0.47% of Meta’s worldwide turnover.
Time is now a critical factor. The authority gave Meta 60 days to implement these changes. This is a tight deadline for a company of Meta’s size to re-engineer core application features across millions of devices. The clock started ticking immediately after the fine was imposed in November 2026. This urgency reflects the severity of the violation. The Garante is not allowing a slow, phased rollout that leaves users in a state of uncertainty for years. The requirement is immediate structural compliance. The 60-day window forces Meta to prioritize this fix over other development cycles. It highlights the power of modern data regulators to impose operational timelines, not just financial penalties. The company must now work quickly to patch the code, update the permission requests, and flip the default switches for millions of users, all within two months.
This case is likely to have ripple effects beyond Italy. While the fine was issued by the Garante, the reasoning regarding broad permissions versus granular consent applies to the entire European Union. Other national data protection authorities may look to this ruling as a benchmark. It sets a clear line: a single, broad permission for "storage" is not sufficient when the app’s function only requires access to a specific media file. The emphasis on disabling access by default challenges the dark patterns that have long been used to capture user data. For the 20 million Android users in Italy, the immediate practical outcome is that their photo libraries are no longer implicitly accessible to Facebook by default. For the tech industry, the message is that the era of vague, broad permissions is ending. The future of mobile app design will be defined by specific, informed, and revocable consent. The Garante has forced a reset, and the countdown to compliance is already running.