Italy’s privacy regulator has fined Meta €805 million (about $887 million) after finding that the Facebook app on Android read photos, videos and metadata from users’ phones without specific consent — and it has given Meta 60 days to switch the feature at the centre of the case off by default. Why it matters: the ruling draws a hard line on apps reading your camera roll behind a vague permission prompt, and it explicitly leaves open a separate question about a newer feature that processes gallery content in the cloud.
Rome, November 14, 2026
What happened
The Garante per la protezione dei dati personali, Italy’s data protection authority, announced the fine against Meta Platforms Ireland Limited on Saturday, November 14. The case concerns a Facebook feature labelled “Get suggestions from your gallery while browsing Facebook,” available since 2023 and set to be active by default. While a person scrolls, the feature surfaces photos and videos from the phone’s gallery as ideas for something to post.
According to the Garante, that modest-sounding feature sat behind broad access: a fully granted permission let the app read the device’s entire photo archive, usually permanently, with neither the user nor the authority able to verify what was actually used. The authority found that Meta accessed photos, videos and related metadata stored on Italian users’ smartphones without obtaining specific consent and without properly informing them. About 20 million Android users in Italy were affected, and the fine equals about 0.47% of the group’s worldwide turnover.
The details
The case began in July 2025 with a report from a consumer protection centre in Bolzano, and the Garante says it ran its own technical analysis of the app rather than relying on the complaint alone. The legal basis is Article 122 of Italy’s Privacy Code, which transposes the EU’s ePrivacy Directive: in the authority’s reading, the smartphone is part of a person’s private sphere, so reading information from it requires free and informed consent whether or not the data ever leaves the device.
Meta asked for the case to be handed to Ireland’s regulator, its usual lead authority under the GDPR. The Garante refused, saying the ePrivacy rules do not provide for that one-stop-shop mechanism, so each national authority enforces its own law directly. The authority also counted Meta’s limited cooperation during the investigation against it when setting the amount, while crediting — as late and limited — changes Meta made to the permission flow after the complaint.
Within 60 days, Meta must keep the feature off by default, including for people who already granted the permission, and may only turn it on through a separate, specific consent request that explains what the feature is for, that it involves gallery access, and how to disable it. Meta must also report back to the authority on the steps it has started and adopted. Meta was not immediately available for comment, according to Reuters.
What this case did not decide
Two questions sit outside the decision. The proceedings did not examine whether gallery content was used to train artificial intelligence models, and Meta denies that it was. Separately, the Garante reserved the right to evaluate a new feature, launched in 2026, that allows cloud processing of gallery content. That follow-on is where the AI question will actually be tested — this fine itself is about consent for access, not about training.
Why it matters
For anyone who uses Facebook on Android, the practical takeaway is simple: a single system permission is no longer treated in Italy as a blank cheque for every feature that wants your photos. For app makers, the standard is now clear at the point of access — a feature that reads stored content cannot start switched on, a generic notice is not specific consent, and people who tapped “allow” before have to be asked again, properly. And because ePrivacy enforcement has no lead-authority shortcut, other national regulators in Europe can apply the same logic in their own countries.
Frequently asked questions
Why did Italy fine Meta €805 million?
Because the Garante found that Facebook’s Android app accessed users’ photos, videos and metadata for its gallery-suggestions feature without specific consent and without properly informing them, in breach of Article 122 of Italy’s Privacy Code.
Was this fine about AI training on people’s photos?
No. The authority said the proceedings did not cover possible use of the content to train AI models, a practice Meta denies. It reserved a separate assessment of a 2026 feature that processes gallery content in the cloud.
What does Meta have to do now?
Within 60 days it must disable the gallery-suggestions feature by default in Italy — including for users who already granted permission — seek separate, specific consent before reactivating it, and report its measures back to the Garante.
How many people were affected?
About 20 million Android users in Italy, according to the Garante, which weighed that number, the still-ongoing violation for users who have not updated the app, and Meta’s limited cooperation when setting the fine.
Sources: Reuters, PPC Land (reporting the Garante’s decision), CEO Magazine Poland