Italy's data protection authority has fined Meta 805 million over how its Android app handled photos and videos stored on users' phones. The Meta fine Android photo access case centers on a simple claim: according to the Authority, the company gained access to photographs, videos and related metadata stored on Italian users' smartphones without authorisation.
The details available so far are limited to the regulator's statement as reported by Il Sole 24 ORE. Still, the case is a useful prompt to check what your own apps can see.
What the Italian regulator found
The Authority says that, via the Facebook app for Android devices, Meta gained access to media files held on the phones of users in Italy. That includes not just the photos and videos themselves but also their metadata, meaning the background information attached to a file.
The key word in the regulator's finding is "without authorisation." The issue, as described, is not simply that an app can open a gallery. It is that the access happened without the proper permission from the people whose files were involved.
The summary we have does not spell out the technical mechanism, the time period, or how many users were affected, so we will not speculate on those points. Meta's response was also not included in the material available to us. As with most regulatory decisions, appeals and further clarification may follow.
Why photo and metadata access matters
A phone's gallery is one of the most personal data stores people own. Photos can show faces, homes, documents, children, and routines. Videos add more of the same.
Metadata deserves attention too. Depending on the file, it can include details such as when an image was taken, what device captured it, and sometimes where. Even when the picture itself is harmless, the surrounding data can reveal patterns about a person's life.
That is why regulators tend to treat unauthorised access to media as a serious matter. Once an app has access, the user has little visibility into what happens next. It is also why the decision fits into a wider pattern of scrutiny over Meta's data practices, which we covered in our look at the Meta $25 billion fine over data sharing and what organisations and users should verify afterward.
How to audit gallery and media permissions on Android
You do not need to wait for a regulator to review what your apps can reach. Android lets you check this in a few minutes. Exact menu names vary by phone maker and Android version, but the general path is similar.
- Open Settings, then Apps, and select Facebook.
- Tap Permissions.
- Look for Photos and videos, Files and media, or Storage.
- Choose the most restrictive option that still works for you, such as Don't allow or Ask every time.
Some versions of Android also offer limited access, where you pick specific photos to share rather than opening the whole library. If that option appears, it is usually the safer choice for social apps.
Then repeat the process for other social and messaging apps. You can also use Android's Privacy dashboard or Permission manager (where available) to see which apps hold media permissions across your whole device. Remove access from anything you no longer use, or uninstall it.
It is also worth reviewing in-app settings. Some apps offer features that ask to upload or suggest content from your gallery. If you do not use the feature, switch it off.
What a VPN can and cannot protect
This case is a good reminder of what a VPN does and does not do. A VPN encrypts your internet traffic between your device and the VPN server and hides your IP address from the sites you visit. That is valuable on public Wi-Fi and for limiting some forms of network-level tracking.
But the behaviour described by the Italian authority is about access on the device itself. If an app has permission to read files on your phone, a VPN does not change that. The app sits on your device, on the near side of the encrypted tunnel, so it can read what it is allowed to read.
In short, a VPN protects data in transit. App permissions control what an app can see at rest on your phone. Both matter, and one does not replace the other.
What This Means For You
If you use Facebook on Android, especially in Italy, this decision is a prompt to check your settings rather than a reason to panic. The regulator's finding concerns Meta's conduct, and you can reduce your exposure by limiting what any app can reach.
Treat media permissions like house keys: hand them out sparingly, and take them back when they are not needed. Apps often work fine with limited or no gallery access, and you can always grant access temporarily when you want to upload something.
Key takeaways
- Review the media and gallery permissions for Facebook and other social apps today.
- Prefer "Ask every time" or limited photo selection over full library access.
- Use Android's permission manager to spot apps with broad access you forgot about.
- Remember that a VPN will not stop an app from reading files it has permission to access.
- For wider context on regulatory action against the company, read our piece on the Meta $25 billion fine.
The Meta fine Android photo access story will likely develop as more details emerge. In the meantime, a few minutes in your settings is the most direct step you can take.
