Ethical Hacking News
Meta Fined €805 Million for Illicit Access to Android Users' Photo Galleries Without Consent. In a landmark case, Italy's data protection authority has fined Meta Platforms Ireland Limited €805 million for the company's default photo gallery access feature on the Facebook app for Android devices, highlighting the importance of data protection and consent in the digital age.
Meta Platforms Ireland Limited fined €805 million by Italy's data protection authority, the Garante, for its default photo gallery access feature on the Facebook app for Android devices. Facebook's feature, intended to make it easier for users to share content from their phone, compromised user consent and data protection by using a single permission to access the phone's photo gallery for multiple purposes. The Garante found that users were not fully aware of what data was being accessed and how it was being used, as the feature was enabled by default. The €805 million fine sets a precedent for how social media platforms should handle user data and may give users more control over their photo privacy. The Garante has ordered Meta to ask for consent through a separate request and explain what the feature does, and how to turn it off, with a 60-day deadline to fix the issue.
In a landmark case, Italy's data protection authority, the Garante, has fined Meta Platforms Ireland Limited €805 million for the company's default photo gallery access feature on the Facebook app for Android devices. This decision has significant implications for the way social media platforms handle user data and has raised important questions about consent and data protection.
According to the Garante, the issue at hand began in 2023 when Facebook introduced a feature that allowed users to share photos and videos from their phone gallery as suggestions while browsing Facebook. This feature, known as "Get tips from your gallery while browsing Facebook," was intended to make it easier for users to share content from their phone. However, the Garante found that this feature was implemented in a way that compromised user consent and data protection.
The Garante's investigation revealed that Facebook used a single permission to access the phone's photo gallery for several different purposes, including the feature at the center of the case. This meant that users were not fully aware of what data was being accessed and how it was being used. Furthermore, the feature was enabled by default, which meant that users were not given the option to opt-out of the feature.
The Garante pointed to Article 122 of Italy's Privacy Code, which carries the EU's ePrivacy Directive into Italian law. This rule treats the smartphone as part of a person's private sphere, so any access to what's on it needs free and informed consent. In this case, Facebook's actions were seen as a violation of this rule.
Meta argued that the Irish authority should have handled the case, but the Garante rejected this argument, stating that the ePrivacy rules do not include the one-stop-shop mechanism. The case also does not cover whether Meta used any content to train artificial intelligence, which the company denies.
The Garante's decision is significant, as it sets a precedent for how social media platforms should handle user data. The €805 million fine represents about 0.47% of Meta's global revenue and is unlikely to cause serious financial problems for the company. However, it may help give users more control over their photo privacy.
In a statement, Meta said that users must grant device-level permission to enable the feature and can revoke it at any time through their settings. However, the Garante's investigation found that users were not always aware of this, and that the feature was enabled by default.
The Garante has given Meta 60 days to fix the issue and has ordered the company to ask for consent through a separate, specific request and explain what the feature does, that it involves gallery access, and how to turn it off. If Meta misses the deadline, it can't activate the feature for anyone without valid consent.
This case highlights the importance of data protection and consent in the digital age. As social media platforms continue to grow and evolve, it is essential that they prioritize user data protection and transparency. The Garante's decision is a step in the right direction, but it also serves as a reminder that there is still much work to be done to ensure that user data is protected.
Related Information:
https://www.ethicalhackingnews.com/articles/Meta-Fined-805-Million-for-Illicit-Access-to-Android-Users-Photo-Galleries-Without-Consent-ehn.shtml
https://securityaffairs.com/203174/laws-and-regulations/meta-fined-e805-million-in-italy-over-facebooks-default-photo-gallery-access.html
Published: Sun Nov 15 13:19:16 2026 by llama3.2 3B Q4_K_M
