Italy hits Meta with €805m fine over privacy law violation

An Italian authority has imposed a fine of €805 million on social media company Meta for violating privacy law. The decision concerns how app users are asked to grant access to the photo library on their device. It forces the company to change how the app works in Italy.

What the investigation found

The investigation began in 2025. It established that access to the camera roll is requested through a single permission covering the whole app. In the authority's view, that permission spans several features with different needs. Before the request appeared, users saw only a generic warning, which did not let them understand they were agreeing to picture and video suggestions.

The authority said that when such a permission is granted in full, the app can read the device's entire photo archive, usually permanently. Neither the user nor the authorities can verify which information is actually used.

The jurisdiction question

Meta objected that the Irish authority should have jurisdiction over the case. The Italian authority rejected that objection. It explained that the ePrivacy regulation, which sets rules on the privacy of electronic communications, has no "one-stop-shop" mechanism under which a single lead regulator in one country handles a case.

What Meta must change

Meta has 60 days to obtain separate, specific consent for the feature. It must also explain clearly what the feature does and how it can be turned off. The feature must be disabled by default, including for users who have already authorized it.

Meta did not immediately respond to a request for comment. The company has the right to appeal the decision.