Italy’s privacy regulator has fined Meta Platforms Ireland Limited €805 million over a Facebook feature that suggested photos from Android users’ galleries for posting, saying the company relied on a device-level permission and a generic explanation where the law required a separate, specific and informed consent. The size of the penalty makes this more than another privacy headline: it turns mobile permission design into a board-level business risk.
For app makers and the companies that buy mobile software, the useful question is simpler than the legal paperwork: when does a valid operating-system permission stop counting as meaningful consent? Italy’s answer, in this case, is that a broad app permission is not enough when it covers several functions, the explanation is vague, and an optional gallery-reading feature is switched on by default.
Where the Garante drew the line
In the Garante’s decision, the authority says Facebook’s “Get suggestions from gallery when browsing Facebook” feature, available since 2023, accessed photographs, videos and related metadata on Italian Android devices without adequately informed consent. The feature suggested gallery items that users could post. The investigation began in July 2025 after a report from the Bolzano consumer-protection center and included technical analysis by the authority.
The regulator’s technical findings go to mechanism, not just messaging. It said Meta used one broad device authorization for the whole app and for multiple functions with different purposes; showed a generic warning tantamount to “enable other functions”; and kept the gallery-suggestion feature active by default. Once that broad authorization was granted, the authority said, the app could read the device’s photo archive, generally on a continuing basis, without giving either users or the regulator a clear way to verify what information was actually used.
Italy grounded the case in Article 122 of its privacy code, which implements the ePrivacy directive and protects information stored on a smartphone. Under that theory, the legal problem begins when the app accesses information on the device, whether or not the content was transmitted off the phone and whether or not a specific harm was shown. That also let the Garante reject Meta’s argument that Ireland’s regulator should have exclusive competence: unlike GDPR cases, this ePrivacy route does not use the one-stop-shop mechanism in the same way. For multinational platforms, that is a meaningful jurisdiction point. Local regulators can still act when they frame the phone itself as a protected private sphere.
Why this matters beyond Meta
The broader lesson is about architecture. Mobile operating systems often grant permissions at the app level, while product teams reuse the same permission across features with very different purposes. From an engineering standpoint, one Android gallery permission may look efficient. From a regulator’s standpoint, it can blur the line between a core sharing function and an optional discovery tool. The Italian ruling effectively says consent UX, default settings and access architecture have to line up with each specific purpose.
That is why this story belongs in Business & Markets, not just policy news. A company can have a technically valid permission from Android and still fail the consent test if the surrounding product design does not tell users what data source is being accessed, why, and with what default behavior. In practice, that pushes compliance upstream into product management and engineering. The question is no longer whether legal approved the copy; it is whether the app was built so that optional features can be separated, limited and audited.
The published decision leaves several operational blanks. It does not say how many of the roughly 20 million Android users in Italy actually enabled the feature, how many photos or videos were read, what metadata fields were collected in practice, or whether gallery contents stayed on the device. Those gaps matter for technical scoping, but they do not change the legal core of the case. Under the Garante’s reading, a company cannot lean on uncertainty about downstream use if the initial access was not explained specifically enough.
The business impact is immediate. The Garante said the fine equals about 0.47% of Meta’s worldwide turnover. Meta now has 60 days to obtain a separate and specific consent, explain that the feature accesses the gallery and how to disable it, and keep the feature off by default, including for people who had previously granted the broader Android authorization. It must report initiatives within 30 days and measures adopted within 90 days. AP and Reuters reported that Meta plans to appeal and called the penalty disproportionate; Meta’s public position is that users had to grant device permission, could change it in settings, and were using a straightforward sharing feature.
In sizing the sanction, the authority cited the number of people affected, the duration of the conduct, a 2019 prior decision involving the company, and what it characterized as limited cooperation. It treated later changes by Meta as mitigating, but said they came late and only reached users who updated the app. That combination matters for executives weighing privacy fixes against release schedules: delayed remediation may still help, but it may not undo the view that the original system was structurally noncompliant.
What mobile-product teams should change now
For product leaders, this is less about Meta’s brand than about a redesign checklist. Name the exact data source and purpose at the moment of access. Separate optional features from the core permission flow instead of burying them inside a broader app authorization. Keep sensitive discovery features off by default. Where possible, read only the items a user selects rather than routinely scanning a larger store. Make revocation obvious inside the product, not just in operating-system settings. And log which feature triggered access, so compliance teams can verify that the app only touched what a specific feature needed.
That checklist applies well beyond social media. Any app that reads photos, videos, contacts, location or microphone data may face the same challenge if it treats a broad device permission as a blanket authorization for multiple purposes. Enterprise buyers should be asking vendors the product version of the same question: what exactly can your app access once permission is granted, which features use that access, and how is optional functionality separated from the default experience?
Just as important is what this case is not. The decision is about access and consent design for the 2023 gallery feature, not a finding that Meta trained AI models on users’ images. Meta denies that, and the Garante explicitly said the proceeding did not examine AI training. The authority did reserve the right to investigate separately a newer 2026 feature that allows gallery contents to be processed in the cloud. For companies designing consumer apps, that separation is crucial: on-device access and cloud processing are different data flows, with different disclosure, security, retention and transfer questions.
Meta’s appeal could still reshape the amount of the fine or the scope of the remedy. Other regulators may or may not copy Italy’s approach, and the published decision does not show whether the same interface was used outside Italy or on iPhones. But the signal is already clear. In Europe, a permission prompt is no longer just a technical handshake between an app and Android. It is part of the product’s control system, and if that system treats an optional feature like a free pass to inspect a phone, the compliance bill can land in the hundreds of millions.
By
By
By
By
By
