Italy’s data-protection authority, Garante, has fined Meta €805 million and ordered a concrete change to Facebook: a general Android permission can no longer stand in for explicit consent where the app can continuously read an entire photo gallery and its metadata.
According to Der Spiegel, the case concerns a Facebook feature available since 2023 that suggests photos and videos from a phone’s gallery for users’ own posts. Access could be activated through one broadly worded permission covering several functions. About 20 million Android users in Italy were affected, the report said.
The size of the penalty is significant, but the 60-day order is the more immediate change for users. Meta must obtain explicit consent for access to photo galleries and switch the feature off by default. Der Spiegel reports that this also applies to users who had previously granted a general permission. Garante’s position draws a practical boundary: broad app access is not a substitute for a specific decision about continuing access to a personal photo archive.
Meta had challenged Italy’s jurisdiction, arguing that Ireland’s data-protection authority should handle the matter because the company’s European headquarters is there. Garante rejected that argument. The supplied report does not say whether Meta will appeal or how compliance will be monitored.
The ruling also does not establish whether Facebook operates the same feature in Germany or elsewhere in the EU. But it puts the real issue with mobile permissions into focus: the relevant question is not simply whether a user clicked “allow” once, but whether they were clearly asked to agree to the scope of ongoing access.
Sources
- Der Spiegel · Source date: 2026-11-15
Independent editorial content. WUA is not affiliated with any political party. 2026-11-15