In a significant blow to tech giant Meta, Italy’s data protection authority, the Garante, has levied an staggering €805 million fine against the company. The penalty stems from a Facebook for Android feature that was found to be accessing users’ photo and video galleries without their explicit, informed consent, automatically suggesting content for posting.
The Heart of the Matter: Unpacking the Garante’s Ruling
The Garante’s investigation revealed that the contentious feature, designed to streamline content sharing, was enabled by default on Facebook’s Android application. Crucially, the app accessed Italian users’ sensitive gallery data and associated metadata without obtaining the necessary specific consent. This practice, according to the authority, violated the fundamental privacy rights enshrined in Italy’s Privacy Code, which incorporates the EU’s stringent ePrivacy Directive.
A Breach of Trust and Law
At the core of the Garante’s findings was the issue of consent. Facebook’s app requested gallery access through a single, broad permission that covered multiple functionalities. While a general notice about enabling features appeared, it failed to clearly inform users that they were also consenting to gallery suggestions. This broad permission allowed the app to continuously read a phone’s entire photo archive, making it impossible for users or even the authority to ascertain precisely what information was being utilized.
Article 122 of Italy’s Privacy Code dictates that a phone is an extension of an individual’s private life. Consequently, any access to its stored content demands free and informed consent, irrespective of whether data is transmitted or harm directly results. The Garante emphasized that Meta’s approach fell short of this critical legal standard.
Meta’s Defense and the Path Forward
Unsurprisingly, Meta has announced its intention to appeal the decision, labeling the fine “disproportionate.” A company spokesperson, as reported by Reuters, stated that the feature only operates after users grant permission on their device, and that these permissions can be modified at any time within settings. However, the Garante’s ruling highlights that the nature of this permission and its default activation were the key points of contention.
The Road to Compliance
The Garante’s order outlines strict measures for Meta to rectify the situation:
- Separate Consent: Within 60 days, Meta must implement a separate, specific request for consent for the gallery suggestion feature. This request must clearly explain the feature’s purpose, its access to the gallery, and how users can disable it.
- Default Off: Also within 60 days, the feature must be switched off by default for all users, including those who had previously granted the broad permission.
- Reporting: Meta is required to report on its progress within 30 days and detail the measures taken within 90 days. Failure to meet the 60-day deadline will prevent the feature from being activated for any user without valid consent.
The investigation, which commenced in July 2025 (as stated in the original article, though likely a future date typo), was initiated following a complaint from the Centro Tutela Consumatori Utenti, a consumer protection group in Bolzano. This group had already advised users to disable gallery suggestions and review Facebook’s app permissions on their devices.
Broader Implications and Future Scrutiny
This ruling underscores the ongoing global push for stricter data privacy enforcement, particularly against major tech platforms. The Garante’s decision to handle the case directly, rejecting Meta’s argument for Ireland’s data protection authority to take the lead, highlights that ePrivacy rules do not always fall under the “one-stop-shop” mechanism often associated with GDPR.
Why Italy Took the Lead
The Garante’s jurisdiction in this matter was firm, asserting that ePrivacy rules, unlike some aspects of GDPR, do not always allow for a single lead supervisory authority. This stance is crucial for national data protection agencies seeking to enforce local privacy codes effectively.
The Cost of Non-Compliance
The €805 million fine, representing approximately 0.47% of Meta’s global revenue, was determined by several factors. The authority considered the vast number of affected individuals—around 20 million Android users in Italy—the prolonged duration of the breach (the feature has been available since 2023 and remains ongoing for many), a prior 2019 decision against Meta, and the company’s limited cooperation during the investigation. While some post-complaint changes by Meta were acknowledged, they were deemed late and insufficient, benefiting only users who updated the app.
Notably, the investigation did not delve into whether gallery content was used to train AI models, a claim Meta denies. However, the Garante indicated it might separately examine a newer feature, launched this year, that processes gallery content in the cloud, signaling continued vigilance over Meta’s data handling practices.
This case serves as a potent reminder for tech companies to prioritize explicit, granular consent and transparency in their data collection practices, especially when dealing with sensitive user data like personal photos and videos.
For more details, visit our website.
Source: Link
Leave a comment