Italy fines Meta €805m for accessing users’ photos without consent

The Garante Per La Protezione Dei Pati Personali (GDDP) in Italy has fined Meta €805 million for using photos and videos from Android users’ galleries on Facebook without specific consent or adequate disclosure.

Through the Facebook app for Android, the company accessed photos, videos, and related metadata stored on Italian users’ smartphones without obtaining specific consent and without properly informing them.

Investigators found Facebook had enabled a “get suggestions from gallery when browsing” feature by default and requested access to users’ personal photo library through a single permission notice.

The GDDP said the “generic” nature of the authorisation notice violated an Italian law that protects smartphones as part of a person’s private sphere and requires “free and informed consent” for access. The law stems from the European Union’s broader “ePrivacy Directive.”

The checks revealed that:

• access to the gallery is requested through a single permission, valid for the entire app and for several functions serving different purposes;
• the authorisation is preceded by a generic notice (“enable other features”) that does not allow users to understand that they are also authorising gallery suggestions;
• furthermore, the feature was enabled by default.

It gave Meta 60 days to make the feature “turned off by default” and adjust the consent notice to include “a separate and specific request for the feature and clearly explain to users what it is for, that it involves access to the gallery, and how to disable it.”

Within 60 days, Meta must:

• request consent through a separate and specific request for the feature and clearly explain to users what it is for, that it involves access to the gallery, and how to disable it;
• keep the feature switched off by default, even for those who have already given consent. If the deadline expires without compliance, the feature cannot be activated for users who have not given valid consent;
• inform the GDDP within 30 days of the initiatives undertaken and within 90 days of the measures adopted.

In determining the amount of the fine, the GDDP took into account the fact that there are around 20 million Android users in Italy, the duration of the infringement, which is still ongoing for those who have not updated the app, a previous 2019 decision against the company and the limited cooperation from Meta during the investigation.