Italy Hits Meta With Record €805M Fine for Harvesting Android Users' Photo Galleries Without Consent

Italy's data protection agency levied its largest-ever tech fine after finding Meta's Facebook app accessed users' camera rolls to suggest posts — without informed consent or proper disclosure.

Italy's Garante per la protezione dei dati personali imposed an €805 million fine on Meta on Saturday, the largest penalty Italian regulators have ever levied against a big tech company. The charge: Meta's Facebook app on Android devices accessed users' personal photo and video galleries to power a feature suggesting content they might want to post — without obtaining specific consent and without properly informing them.

The fine amounts to 0.4% of Meta's annual turnover, a figure calibrated to sting but unlikely to threaten the company's balance sheet. Meta generated roughly $164 billion in revenue in its most recent fiscal year. The penalty is large by Italian standards but modest relative to the EU's GDPR maximum of 4% of global turnover — Italian regulators used roughly one-tenth of the theoretical ceiling. Regulators launched their investigation in July 2025 and say Meta refused to cooperate during the probe. The agency found a "high number of people affected" by the infringement, which it described as ongoing for users who have not updated their app and for those who had already given consent to the system — raising questions about how retroactive consent was handled. Meta has 60 days to disable the camera roll suggestions feature entirely and to implement a separate, standalone permission request for that specific function. The jurisdictional question is a recurring pressure point. Meta's European headquarters is in Dublin, and the company has argued that any data privacy case involving EU users should fall under Irish jurisdiction — where enforcement has historically been slower and more accommodating to tech platforms. Italian regulators rejected this claim outright, asserting their authority over violations affecting Italian users on Italian devices. Meta has not publicly commented on the fine or the specific allegations. The company has previously denied using the camera roll feature to train AI models, though Italian regulators noted this aspect was not part of their investigation. Meta retains the right to file a legal appeal against the penalty within the 60-day window. The structural pattern here is familiar: a platform embeds a data-harvesting feature into a core app function, surfaces it as a convenience to users, and defers consent mechanisms until regulators intervene. The "suggest photos you might want to post" framing repackages surveillance as helpfulness. The fine penalizes past behavior but does not address the economic incentive that produced it — Meta's ad-targeting infrastructure profits from deeper access to user content regardless of whether any individual feature is toggled off. Whether this enforcement action changes Meta's behavior or simply becomes a cost of doing business depends entirely on the appeal outcome and whether other EU member states follow Italy's jurisdictional lead. If the Irish bottleneck on GDPR enforcement breaks, the economics shift. If it holds, €805 million is a rounding error on a $164 billion revenue stream.