Italy Fines Meta €805 Million Over Facebook’s Access to Android Users’ Photos
Italy has fined Meta €805 million — about $887 million — after finding that the Facebook app on Android phones reached into users’ photo galleries without their specific consent, the country’s data protection authority announced on Saturday, November 14, 2026.
The Garante per la protezione dei dati personali said Facebook accessed photographs, videos and related metadata stored on Italian users’ smartphones “without obtaining specific consent and without properly informing them.” The penalty, imposed on Meta Platforms Ireland Limited, is the largest fine the Italian regulator has ever handed down, and it comes with an order to change how Facebook asks for gallery access within 60 days.
The feature at the center of the case
The case turns on a Facebook feature called “Get suggestions from your gallery while browsing Facebook.” Introduced in 2023, it scans photos and videos stored on a phone and suggests them as ideas for new posts while the user browses the app. The Garante said the feature was switched on by default.
The problem, according to the regulator, was not the idea of photo suggestions. It was the way permission was collected. Facebook asked users for a single, general permission to access their photo gallery — one permission covering the whole app and several different functions — without clearly explaining that granting it also switched on the gallery-suggestion feature. Under Italian privacy law, that did not count as specific, informed consent.
The authority estimated that about 20 million Android users in Italy could have been affected. It said the practice amounted to unlawful processing of personal data on a mass scale.
Why Italy, not Ireland, issued the fine
Meta argued that the case should have been handled by Ireland’s Data Protection Commission, its lead privacy regulator in the European Union, because Meta Platforms Ireland Limited is the company’s main European subsidiary. The Garante rejected that objection.
The regulator acted under Article 122 of Italy’s Privacy Code, which implements the European Union’s ePrivacy Directive — the rule that protects the confidentiality of information stored on a person’s device, such as a phone. Because the case was brought under that provision rather than under the EU’s General Data Protection Regulation, Rome was able to act without waiting for Dublin.
The fine equals about 0.47 percent of Meta’s worldwide turnover, the authority said. In setting the amount, the Garante said it took into account the number of people affected, the length of the violation, a previous enforcement measure against the company in 2019, and what it described as a lack of cooperation from Meta during the investigation.
What Meta must change, and by when
Within 60 days, Meta must switch the gallery-suggestion feature off by default — including for users who already granted access — and ask for consent through a separate, specific request. That request must explain what the feature does, that it involves access to the user’s photo gallery, and how to turn it off. If Meta misses the deadline, the feature cannot be turned on for anyone who has not given valid consent.
The investigation began in July 2025, after a complaint from the Centro Tutela Consumatori Utenti, the consumer protection center in Bolzano. The Garante carried out its own technical analysis of how the feature worked before issuing the decision.
What the ruling does not decide
The decision leaves one high-profile question open. The investigation did not examine whether photos or videos accessed through the feature were used to train artificial intelligence models. Meta has denied using content accessed this way for AI training, and the Garante’s statement leaves that claim untested.
The authority also reserved the right to assess separately a newer feature Meta launched in 2026 that processes gallery content in the cloud. That means the company could face a second proceeding over how it handles users’ photos.
Meta was not immediately available for comment when Reuters and CNBC reported the decision on Saturday. One later report said the company described the €805 million penalty as disproportionate and intended to appeal. The ruling can be challenged in court, and Meta has the right to appeal rather than simply pay.
Related Articles
Why this matters
The fine is significant for reasons that go beyond its size. By using the ePrivacy route, Italy showed that national regulators can move against a global technology company without waiting for the lead regulator in Ireland — a process that has often been criticized as slow. Other European regulators watching the case may follow the same path when an app’s permission practices are at issue.
For users, the decision draws a clear line between a general permission to access a phone’s gallery and a specific agreement to let an app mine that gallery for content suggestions. The Garante’s position is that the two are not the same thing, and that an app must ask separately — and explain itself — before it starts scanning private photos.
The penalty also adds to a difficult stretch for Meta on privacy enforcement. It comes weeks after authorities in New Mexico ordered the company to pay $25 billion in a separate data privacy case, and days after Meta and TikTok paid millions to settle lawsuits brought by teenagers over social media addiction. The FTC and five states joined a lawsuit against Hims & Hers over health data in a separate enforcement action, underscoring that regulators on both sides of the Atlantic are pressing technology companies harder on how they handle personal information.
For American users, the Italian ruling has no direct effect: it applies to Facebook’s Android app in Italy. But the underlying question — what counts as consent when an app asks to see your photos — is the same one regulators and lawmakers in the United States are debating, and the Italian decision gives them a concrete example of how another major jurisdiction has answered it.
Latest developments
The Garante published its decision on Saturday, and Meta now has 60 days to redesign the consent flow for the gallery-suggestion feature. The regulator has not said when it will begin its separate assessment of the 2026 cloud-processing feature. Whether Meta appeals, and how quickly it changes the feature for Italian users, will be the next developments to watch.
Frequently Asked Questions
Why did Italy fine Meta €805 million?
Italy’s data protection authority, the Garante, found that the Facebook app on Android accessed photos, videos and metadata from about 20 million Italian users’ phone galleries without specific consent. The feature suggesting gallery photos as post ideas was switched on by default and sat behind a single, vague app-wide permission.
What is the “Get suggestions from your gallery” feature?
It is a Facebook feature, available since 2023, that suggests photos and videos stored on a user’s phone as ideas for new posts while they browse the app. The Garante said the feature was enabled by default and that users were not adequately told what granting gallery access would switch on.
What does Meta have to do now?
Within 60 days, Meta must keep the gallery-suggestion feature off by default — even for users who already granted access — and ask for consent through a separate, specific request that explains the feature, the gallery access it involves, and how to switch it off.
Does the ruling say Meta used people’s photos to train AI?
No. The investigation did not examine whether gallery content was used to train AI models, and Meta denies that it was. The Garante said it will separately assess a newer 2026 feature that processes gallery content in the cloud.
The Garante’s decision is now public, and the 60-day clock is running. The next test will be whether Meta changes the feature for Italian Android users on time — and whether it challenges the fine in court.
Sources: Reuters (Milan, November 14, 2026); CNBC; Garante per la protezione dei dati personali, official statement (doc. 10321080); Euronews; Il Sole 24 Ore.
