Italy fine Target at 805 million for accessing data without permission

A Italian Data Protection Authority has fined the European subsidiary of Meta Platforms EUR 805 million for accessing photos, videos and metadata stored on Facebook phones of 20 million users without consent.

Meta Platforms Ireland Limited – owner of Facebook, Instagram and WhatsApp – accessed the data through the Facebook app for Android devices through a functionality available since 2023 called “Get gallery suggestions while browsing Facebook”, which uses photos and videos stored on your phone to suggest publication content to users.

The Italian investigation, initiated in July 2025 after the complaint of a consumer rights association in Bolzano, northern Italy, concluded that the application requested a single generic permission to access the gallery (“enable other functions”), valid for the entire platform and activated by default, without being informed that it also authorized the publication suggestions.

For the Italian authority, this system granted Facebook permanent access to the entire photographic archive of the mobile phone, without users or the regulatory body being able to verify that information was actually used, practices that violate the Italian Privacy Code.

Any access to data stored on the device requires a “free and informed consent”, regardless of whether the data is transmitted or caused any damage, he highlighted.

The value of the fine (EUR 805 million) is equivalent to approximately 0.47% of the group’s global turnover and was determined taking into account the high number of persons affected, the duration of the infringement, a previous procedure against the company in 2019 and the “exhaust collaboration” of the Meta during the investigation.

As the only mitigating circumstance, it considered the changes made after the complaint, although it classified them as late and limited to users updating the application.

In addition to the economic sanction, Meta has 60 days to disable the functionality by default, including for users who have already granted permission to access the gallery, having to request a specific consent for this tool and detail how it can be disabled.