Italy fines Meta $887 million for failing to obtain consent for user photos

The Italian Data Protection Authority (IDPA) has imposed one of its largest penalties to date against Meta. According to the Italian data regulatory body, the company failed to specifically disclose that it possessed access to user photos, videos and the related metadata for individuals using the Facebook app on Android devices. Meta Platforms Ireland Limited was fined 805 million euros, or approximately $887 million, a sum representing 0.47 percent of the firm's global revenue.

The "Camera roll sharing suggestions" feature recommends that users post photos or videos from their phone's photo library to Facebook. The Italian authority stated that access to this gallery is granted via a single permission request covering the entire app, despite the various functions it serves. The IDPA argued that this approach allows Meta broad ongoing access without "obtaining specific consent and without properly informing" its users.

The IDPA further contended that the feature should not be enabled by default and that Meta must clarify that users are authorising media gallery access for post suggestions. The Italian data watchdog noted that it initiated the investigation in July 2025, following a complaint from the Bolzano Consumer Protection Centre.

Meta has 60 days to secure "separate and specific" user consent for the feature while explaining its purpose and how to disable it. The tech giant is also required to set the feature to off by default, even for users who previously agreed to the permission request. Meta is currently addressing a ruling from a New Mexico judge requiring the social media company to pay $25 billion in penalties following the personal data harvesting scandal involving Cambridge Analytica.