Italian privacy watchdog fines Meta €805m over camera roll access

The Italian Data Protection Authority fined Meta €805 million on Saturday for drawing on photos and videos stored on Android phones without users' specific consent.

The penalty targets the "camera roll suggestions when browsing Facebook" feature, which proposes images from a phone's gallery for users to attach to posts. The authority said the feature breaches the Italian law that implements the EU's ePrivacy directive. It is by far the largest fine ever imposed by the Italian regulator.

An investigation opened in 2024 found that access to a user's camera roll is requested through a single permission covering the whole app, spanning features with different requirements. A generic warning preceded that request, the authority said, leaving users unable to understand that they were authorising picture and video suggestions. A full grant lets the app "read the device's entire photo archive", usually permanently, without users or authorities able to verify what is used, it said.

The regulator rejected Meta's argument that the Irish authority had jurisdiction, stating that the ePrivacy rules do not provide for a "one-stop-shop" mechanism.

Meta has 60 days to obtain consent separately and specifically for the feature and to switch it off by default, including for users who already authorised it. It must also explain clearly what the feature does and how it can be disabled. Meta did not immediately respond to a request for comment and has the right to appeal.