By asahifile 
Italy’s data protection authority fined Meta Platforms Ireland 805 million euros ($887 million) on Saturday over the way the Facebook app on Android reads a phone’s gallery. The feature, “Get tips from your gallery while browsing Facebook,” has been live since 2023, switched on by default: the app asks for gallery access with one blanket permission behind a generic prompt about “enabling other functions,” never saying the camera roll would be mined for post suggestions. The Garante counts about 20 million affected Android users and gave Meta 60 days to change the consent flow. Meta will appeal and calls the penalty “disproportionate.”
It is the largest fine an Italian regulator has imposed on a tech company, and in per-head terms one of the cheapest privacy settlements on record.
The number the regulator did not print
Divide the penalty by the people counted: 40.25 euros per affected Android user, or $44.35. Third-quarter 2026 revenue was $64.6 billion over 92 days, $702 million a day, so the fine equals 1.26 days of global turnover; restricted to European advertising — $14.2 billion a quarter, about $155 million a day — it buys 5.7 days.
Meta reported average revenue per person of $17.72 last quarter across every app and market, so the penalty is 2.5 quarters of that. Spread over the 1,413 days the feature has existed, camera-roll access is priced at about 2.8 cents per user per day.
Why 0.47 percent and 0.4 percent are both true
The authority says the fine is about 0.47 percent of worldwide revenue; Deutsche Welle and Le Monde reported 0.4 percent. Those are not competing claims, just two denominators in two currencies. Work backwards: 805 million is 0.47 percent of 171.3 billion euros, and Meta’s 2025 revenue of $201 billion converts to almost exactly that at $1.17 to the euro. The wires turned the fine into dollars and divided by a dollar figure.
Both pass a fact-check, which is the problem with the genre: comparisons that skip the conversion measure exchange rates and call it severity.
The jurisdictional side door
The interesting fact is not the size but the door. Meta argued the case belonged to its lead European regulator in Ireland, the GDPR’s one-stop-shop. The Garante rejected that because it had anchored the case in Italy’s implementation of the ePrivacy directive, which has no such mechanism. A rule about what an app may read off a device sits outside the machinery that lets Meta answer to Dublin alone.
Every member state has its own version of the directive, so each regulator can open a file without waiting for Ireland. This one began in July 2025 with a complaint from a Bolzano consumer centre and took 501 days.
What the 60 days actually require
The feature must be off by default for everyone, including users who already authorised it; consent has to be requested separately and specifically, explaining what gallery access enables and how to disable it. Meta reports its initiatives to the Garante within 30 days, by 14 December, and its measures within 90, by 12 February 2027. After the deadline the feature cannot be switched on for anyone without valid consent.
Note what the file excludes. The Garante says the investigation did not examine whether gallery content trained AI models, a practice Meta denies, and it reserved a separate assessment of a 2026 feature that processes gallery content in the cloud. The headline — Meta accessed users’ photos — describes a local read on the handset, not a transfer. The 805 million euros is a verdict on a permission dialog.
Japan’s ceiling is a rounding error
Japan has no equivalent price. Under the Act on the Protection of Personal Information the maximum corporate fine is 100 million yen, about $690,000, and it attaches only to breaches of an order from the Personal Information Protection Commission or to unlawful provision of a personal information database. A pre-ticked gallery permission has no rung on that ladder; the commission issues guidance, demands reports and orders. Italy’s penalty is roughly 1,290 times Japan’s ceiling.
That is not proof Japanese users are unprotected. It is proof the two regimes price different things: Europe prices consent design, Japan prices disobedience.
What to watch
- The appeal. If a court calls camera-roll suggestions GDPR processing and Dublin’s turf, the fine becomes an outlier, not a template.
- Copycat files. At 40 euros a head the arithmetic is portable; watch France and Spain.
- The cloud feature. The reserved 2026 file is where AI training enters, and the per-user price gets set again.
- 13 January 2027. A global consent flow means Meta expects the precedent to travel; an Italy-only one means it does not.
Sources: Garante per la protezione dei dati personali; Politico Europe; Reuters via CNBC; Deutsche Welle; Le Monde; Meta Q3 2026 results; DLA Piper on Japan. Per-day, per-user and currency figures are this site’s own calculations.