Italy Fines Meta Over Android Photo Access Without Consent

Italy's data protection authority has fined Meta €805 million, roughly $887 million, for accessing photographs and videos belonging to Italian users through the Facebook app for Android devices without obtaining their specific consent, according to The Guardian. The authority said the company also failed to properly inform users about that access, and The Guardian reports that the fine is among the largest an Italian authority has imposed on a major technology company.

According to The Guardian, Meta says it plans to appeal the decision. The company's response, as reported, centers on contesting the ruling rather than accepting the findings at this stage.

BBC News reports that the social media giant is accused of not informing about 20 million users that it had access to their photos. That figure comes from the BBC's coverage and reflects the scope of the complaint as the outlet describes it.

The two outlets emphasize slightly different details. The Guardian leads with the size of the penalty and the statement from the regulator, while the BBC frames the case around the number of people affected and the failure to notify them. Both describe the same core allegation: that access to personal media was not clearly disclosed or agreed to.

Neither report, as summarized here, lays out the specific technical mechanism by which the access occurred, so questions about how the app handled permissions remain open.

Background

Data protection in the European Union is governed largely by the General Data Protection Regulation, which took effect in 2018 and sets strict conditions for how companies collect, process and share personal information. Under this framework, consent must generally be freely given, specific, informed and unambiguous, and users must be told in clear terms what data is being used and why. National regulators, such as Italy's data protection authority, enforce these rules and can levy fines that scale with a company's global turnover, up to a defined ceiling.

Mobile operating systems add another layer. Android and iOS both use permission prompts that ask users to grant apps access to photos, cameras, microphones and location. Developers are expected to request access only when it is needed and to explain the purpose clearly. Over the past several years, regulators and researchers have examined whether these prompts are understandable, whether apps request more access than their features require, and whether users can meaningfully refuse once they have agreed to something else.

Photos are a particularly sensitive category. A camera roll can reveal family members, locations, health information, religious practice and daily routines, and metadata attached to images can include timestamps and location coordinates. For this reason, privacy advocates often argue that access to a full media library should be narrower and more transparent than access to ordinary contact details.

Meta has faced repeated regulatory scrutiny in Europe over its handling of personal data, including earlier fines and ongoing disputes about advertising, data transfers and user tracking. Companies facing such penalties typically contest them through national courts or appeals bodies, and final outcomes can take years. Fines of this size are intended to deter similar conduct across the market, not only to punish a single firm.

Why it matters

The case goes to the heart of a common tension in modern apps. Features such as photo uploads, stories, or suggested edits often depend on access to a device's media, and users may reasonably expect that access to be limited to what they actively choose to share. When an app reaches further than that expectation, trust erodes, even if the company argues the access served a legitimate product purpose.

The size of the penalty signals that European regulators are willing to treat consent failures as serious violations, not technicalities. For other app developers, the message is that permission prompts and privacy notices must match what the software actually does, and that vague or buried disclosures may not satisfy the law.

The number of affected users, as the BBC describes it, also matters. Privacy harms at scale are difficult for any individual to detect or challenge alone, which is one reason regulators act on behalf of large groups of people.

For Meta, the decision adds to a long record of regulatory pressure in the region and could shape how the company designs permissions and consent flows for its mobile apps. For users, the case is a reminder to review which apps can see their photo libraries and to grant access selectively.

What to watch

The most immediate question is how Meta's appeal proceeds and whether the fine is upheld, reduced or overturned. Appeals in Italian and EU courts can take considerable time, and the outcome may affect how other regulators calibrate their own penalties.

Observers will also want to know whether Meta changes the Android app's permission flow in Italy or across the European Union, and whether those changes are described publicly in terms users can understand.

Other national data protection authorities may open parallel inquiries or cite this decision in their own work. Watch for statements from European regulators and any coordinated guidance on mobile media permissions.

Finally, the details of how the access occurred, and how long it lasted, may become clearer as the case moves forward.