Italy Fines Meta €805 Million Over Facebook Android App’s Access to User Photo Libraries

Italy’s data protection authority has fined Meta Platforms Ireland Limited €805 million over a Facebook Android feature that accessed users’ photo libraries without sufficiently specific and informed consent.

Announced on November 14, the decision concerns a feature that offered suggestions from a device’s gallery while people browsed Facebook. According to the regulator’s findings, the feature had been enabled by default since 2023 and could access photos, videos, and associated metadata on Italian users’ devices.

For crypto users, the case highlights a risk that extends beyond social media: a phone’s photo library can contain information that exposes wallet access, transaction activity, or personal identity. An app does not have to be a crypto wallet to encounter sensitive crypto-related information if it can read the device’s media.

What the Italian Regulator Found

The authority concluded that Facebook’s Android permission flow did not give users a sufficiently clear choice about the gallery-suggestion feature. A broad permission applied across the app, rather than a separate, informed decision about that particular use.

The regulator also found that this arrangement allowed continuing access to the device’s gallery, while neither users nor the authority could independently verify the full scope of how the material was used.

The decision relied on Article 122 of Italy’s privacy code, which implements protections under the EU’s ePrivacy Directive. The regulator emphasized that information stored on a phone belongs to an individual’s private sphere. In its assessment, access required valid consent regardless of whether the data was transmitted elsewhere or whether a specific harm had already occurred.

Meta argued that the matter should fall under the authority of Ireland’s privacy regulator. The Italian authority rejected that argument, finding that the EU’s cross-border “one-stop-shop” mechanism did not apply to this ePrivacy enforcement action.

Why the Penalty Was So Large

The authority considered several factors when setting the €805 million fine:

• Approximately 20 million Android users in Italy were potentially affected.
• The conduct had continued over an extended period.
• Meta had a previous enforcement record dating to 2019.
• The regulator considered the company’s cooperation during the investigation insufficient.

The amount represented approximately 0.47% of Meta’s global revenue, according to the enforcement assessment.

Meta was instructed to disable the feature by default within 60 days, explain its purpose and how to turn it off, and obtain separate, explicit consent before enabling it. The company must also report on its remediation progress after 30 and 90 days.

The case did not establish that the gallery content was used to train AI models; Meta denied such use. A separate cloud-based photo processing feature introduced for 2026 is to be assessed separately.

Why Photo Permissions Matter for Crypto Users

A gallery may look like a collection of ordinary images, but it can also reveal details about a person’s digital assets. Screenshots, downloaded files, and photos might contain:

• Recovery phrases or private keys captured during wallet setup.
• Wallet addresses, transaction histories, or account balances.
• QR codes used for wallet access, payments, or account recovery.
• Identity documents submitted during exchange verification.
• Travel, location, or contact information embedded in image metadata.

Not all of this information gives someone direct control over funds. A wallet address, for example, is generally public. But combining an address with a name or other identifying detail can make on-chain activity easier to associate with a real person. A recovery phrase or private key is far more sensitive: anyone who obtains it may be able to control the associated assets.

This distinction matters because blockchains offer transparency, not automatic anonymity. The Ethereum Foundation’s explanation of accounts describes how control depends on private keys. Protecting those keys is essential, but limiting unnecessary exposure of the surrounding personal information matters too.

How to Reduce Your Exposure

The ruling is a reminder to review what apps can access, especially on devices used for crypto transactions.

1. Check photo and video permissions. Review which apps can access your media and remove permissions they do not need. Where available, choose access to selected images rather than the entire library. Android explains the available options in its photo picker documentation.
2. Keep recovery phrases out of your gallery. Avoid photographing, screenshotting, or storing a seed phrase in a notes app or cloud photo library. Use an offline backup and store it securely.
3. Be selective with screenshots. Before saving or sharing an image, check whether it reveals balances, addresses, QR codes, account identifiers, or identity information.
4. Review cloud backups. Deleting a sensitive image from a phone may not remove every synced copy immediately. Check connected backup services and their deletion settings.
5. Revisit permissions after updates. Features and permission prompts can change. A periodic review helps ensure an old grant still matches how you want an app to operate.

The Broader Lesson for Digital Asset Security

The Meta decision illustrates a boundary that crypto users encounter every day: permission to use an app is not necessarily an informed choice about every way it can access device data.

Self-custody gives users responsibility for their keys, but practical security also includes the environment around those keys. A hardware wallet such as OneKey can help keep private keys separate from a phone or computer during normal use. It does not, however, prevent other apps from accessing photos you have permitted them to read—or protect a recovery phrase that has been photographed and stored in the gallery.

The strongest approach is to combine secure key storage with careful device permissions and an offline recovery backup.