Meta Platforms Ireland Limited has been fined €805 million (about $887 million) by Italy’s data protection authority over how Facebook on Android obtained access to people’s photo and video libraries. The regulator’s objection centers on Camera roll sharing suggestions, a Facebook feature that recommends photos or videos from a phone’s gallery that a user might want to post.
The penalty is significant on its own—described as one of the authority’s largest to date—and is stated to equal 0.47% of Meta’s worldwide revenue. But the accompanying order may matter just as much for Facebook users in Italy: Meta has 60 days to obtain separate, specific consent for the feature, explain both its purpose and how to turn it off, and set it to off by default. That default change is required even for users who previously accepted the relevant permission request.
Meta is reportedly preparing an appeal.
What Italy says was wrong with Facebook’s photo permission
Modern Android apps often ask for permission to access sensitive parts of a device, such as the camera, microphone, location, contacts or media gallery. The core dispute here is not simply that Facebook could access a gallery. It is that the authority says the app’s permission structure did not clearly and specifically tell users that access would be used for camera-roll posting suggestions.
For more context, explore GameCube, PlayStation 2 and Dreamcast Disc Region and Edition Checks Before You Buy.
Italy’s authority said Facebook used a single permission request applying across the app’s multiple functions. In the regulator’s view, that approach gave Meta broad, ongoing access to photos, videos and related metadata without obtaining consent that was sufficiently specific to this particular recommendation feature.
Metadata is information connected to a file rather than the visible image or video itself. The supplied findings do not specify exactly which metadata was involved in this case, but the term can broadly mean data associated with media files. That distinction is important in privacy disputes because access to a gallery may involve more than merely displaying thumbnails on a screen.
The authority also took issue with the feature’s default setting. Its position is that camera-roll suggestions should not be enabled automatically. Users should actively agree after being told, in clear terms, that their gallery access is being authorized for the purpose of generating suggestions about what to share on Facebook.
The order requires “separate and specific” consent, clear information about the feature’s purpose and instructions for disabling it.
Why a single broad permission can be a problem
A permission prompt can be technically functional while still being challenged on whether it provides meaningful choice. A person might grant an app access because they expect it to upload one photo they selected for a post. That is a different expectation from allowing an ongoing feature to inspect a wider gallery in order to surface suggested posts.
The regulator’s decision turns on that gap between a general permission and a defined purpose. Its argument is effectively that an app should not treat approval of a broad media-access prompt as blanket approval for every feature that could make use of a library. When a function is designed to examine a camera roll and recommend content, the user should be directly informed of that function and make a decision about it specifically.
This is also why an off-by-default requirement has practical weight. Defaults affect what happens when users do nothing. An opt-in design asks a person to make a positive choice before the suggestions begin. An opt-out design starts the feature and places the burden on the person to notice it, understand it and switch it off later.
The ruling does not say that photo-sharing suggestions are inherently forbidden. Rather, the reported requirements focus on the conditions surrounding the feature: separate consent, understandable disclosure, an available disable control and a default state that does not activate it automatically.
The investigation and the deadline
Italy’s data protection authority began its investigation in July 2025 after a complaint from the Bolzano Consumer Protection Centre. The resulting order gives Meta 60 days to alter the consent flow and default behavior described in the decision.
For affected Facebook users, the important practical changes requested by the authority are straightforward:
- The camera-roll suggestion feature must be off by default.
- The off-by-default treatment also applies to people who had already accepted the broader permission request.
- Meta must ask for consent separately and specifically for this function.
- The company must explain what the feature is for.
- Users must be told how they can disable it.
Those steps concern the Facebook app on Android and its access to phone-gallery media for the stated suggestion feature. The available information does not establish broader changes to Meta services, other operating systems, or every type of media permission. The order is specific in the details supplied: camera-roll sharing suggestions, Android gallery access, meaningful consent and default settings.
What the decision means for users
The immediate takeaway is that phone permissions are not always a one-time, all-purpose yes-or-no decision. A single permission can support several distinct app features, and the Italian authority’s action emphasizes that users should be able to understand which feature is asking, what it will do and whether it needs to be on at all.
That does not mean every app that offers a photo picker or upload button works the same way. A user who chooses a single image to attach to a Facebook post is making a different kind of interaction from enabling suggestions based on material already in a gallery. The latter is proactive: the app uses gallery access to recommend possible posts. The regulator’s concern is precisely that this more persistent, recommendation-oriented use should be distinctly explained and accepted.
Users in Italy may therefore see a more explicit decision point if Meta complies with the order as written. They may also see the suggestion function disabled until they choose to enable it. The supplied information does not describe the exact wording, design or rollout date of any revised screen, so those details should not be assumed ahead of Meta’s response or an appeal outcome.
A major monetary penalty, plus a product-design order
Large privacy penalties often draw attention because of the headline number, and €805 million is unquestionably substantial. Yet the requested product changes are the more direct day-to-day consequence. The authority is not only seeking a financial sanction; it is demanding changes to how the Facebook Android app presents choice around access to personal media.
That combination is notable because it connects privacy compliance to interface design. Consent is not solely a legal statement buried in a policy. In practice, it is also the placement of a prompt, the precision of its wording, the default selected for a switch and whether users can understand how to reverse their decision.
Meta now faces the stated 60-day compliance window while reportedly planning to contest the fine. An appeal could affect how the matter proceeds, but the reported order sets out a clear regulatory expectation: permission to access a person’s photo library must not be treated as an indistinct pass for camera-roll recommendation features without clear, separate consent.
The case is also separate from another reported legal matter involving Meta. A New Mexico judge has required the company to pay $25 billion in penalties tied to the Cambridge Analytica personal-data harvesting scandal. The Italy action concerns a different issue: Facebook’s Android camera-roll suggestions and the consent and disclosure surrounding access to users’ media galleries.
