Maxi fine from the Privacy Guarantor, which imposed a fine of 805 million euros on Meta, equal to approximately 0.47% of the group's worldwide turnover. At the center of the provision is the Facebook app for Android devices, through which the company allegedly had access to photographs, videos and related metadata stored in the smartphones of Italian users without having obtained specific consent or provided adequate information. The reaction of the US giant was immediate, announcing an appeal. A Meta spokesperson stated that he "strongly disagrees with the assessment of the facts and the application of the legislation", judging the sanction to be disproportionate and reiterating that it is a simple publication support function, which can only be activated with prior authorization on the device and can always be modified from the settings. The story revolves around the "Get suggestions from the gallery when browsing Facebook" function, introduced in 2023 to propose contents present in the phone's memory as ideas ready for publication. The investigation, started in July 2025 following a report from the Bolzano Consumer User Protection Centre, highlighted serious technical criticalities: access to the tunnel was requested via a single authorization valid for the entire application, preceded by a generic notice ("enable other functions") which did not clarify the real purposes of the processing. Furthermore, the option was preset as active, potentially allowing the app to read the entire photo archive permanently and without the possibility of control by the user or the Authority. According to the Guarantor, this mechanism violates article 122 of the Privacy Code (which transposes the European ePrivacy Directive), a rule that protects the smartphone as an extension of the person's private sphere and imposes free and informed consent regardless of the transmission of data or the existence of damage. The Authority also rejected the objection of incompetence raised by Meta in favor of the Irish authority, clarifying that the ePrivacy regulation does not provide for the "one-stop shop" mechanism. Although the proceeding did not concern the use of files for training artificial intelligence - a practice denied by the company - the Guarantor reserved the right to carry out separate investigations on the new cloud processing function launched in 2026. The large audience involved (around 20 million Android users in Italy), the duration of the violation, a previous provision from 2019 and the lack of collaboration during the investigation weighed heavily on the quantification of the fine. Elements only partially mitigated by corrective changes judged to be late. Within 60 days Meta will have to keep the function deactivated by default, even for those who have already given the OK, and introduce a separate and transparent consent request; once the deadline has expired, the tool must be blocked for users without valid consent. The company will also have 30 days to communicate the initiatives launched and 90 days to report the measures adopted.
