Italy Hits Meta With Record €805M Fine for Silently Accessing Users' Photos

Italy's data regulator Garante levied its largest-ever fine against Meta for accessing ~20M Android users' photos without meaningful consent — a consent architecture built to obscure, not inform.

Italy's data privacy authority Garante has fined Meta €805 million ($887 million) for accessing photos, videos, and metadata stored on Italian Android users' smartphones without specific consent. The violation centers on a feature called "Get suggestions from gallery when browsing Facebook," which scanned phone galleries and suggested content for posting — enabled by default, buried behind consent language too vague to constitute informed permission.

The fine — roughly 0.47% of Meta's global turnover — is the largest Garante has ever imposed. The regulator cited three aggravating factors: the scale of the violation (an estimated 20 million Italian Android users affected), Meta's "lack of cooperation" during the investigation, and a prior 2019 violation that established a pattern of recidivism. The mechanism here is worth understanding precisely. Meta did not hack phones. It built a feature that accessed the photo gallery as part of the app's normal operation, wrapped it in consent language broad enough to cover nearly anything, and turned it on by default. The user's "agreement" was structural — embedded in flows designed to produce clicks, not understanding. This is the dark-pattern playbook: make the extractive behavior the default, make the opt-out invisible, and call the result "consent." Garante has ordered Meta to fix the unclear consent notification and disable the default-on setting. Meta has not publicly commented and retains the right to appeal. Notably, the proceedings did not address whether user content was used to train AI models — a question Meta denies but which hangs over every data-access story in 2025. The fine is significant by Italian standards but modest relative to Meta's financials. At 0.47% of global turnover, it sits well below the GDPR's theoretical maximum of 4%. For a company that generated $164 billion in revenue in 2024, €805 million is a quarterly rounding error — a cost of doing business unless the behavioral remedy (disabling default-on access) actually constrains the data pipeline. The pattern is familiar across EU enforcement: large headline numbers that look punitive but land as operational costs for trillion-dollar platforms. The real question is whether Garante's order to disable default access and fix consent flows will be enforced with teeth — or whether Meta will appeal, delay, and redesign the same behavior under a different feature name. This case illustrates the structural asymmetry at the heart of platform regulation. The regulator spent years investigating a single feature on a single platform in a single country. Meta operates thousands of such features across billions of users globally. The enforcement bandwidth problem is not a bug — it is the environment in which platform extraction thrives.