🔍 Read the full analysis: Italy’s €805 Million Fine Targets Meta Over Facebook’s Android Photo Gallery Access on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Italy’s data protection authority fined Meta Platforms Ireland €805 million over Facebook’s Android feature that suggests photos and videos from users’ phone galleries. The regulator says the feature accessed galleries without clear, specific consent and must be off by default; Meta says it will appeal.
Italy’s data protection authority has fined Meta Platforms Ireland €805 million, saying Facebook’s Android photo-suggestion feature accessed users’ phone galleries without specific, informed consent. The Garante per la protezione dei dati personali also ordered Meta to make the feature opt-in and off by default; Meta said it will appeal, according to Reuters.
The case concerns Facebook’s “Get tips from your gallery while browsing Facebook” feature, available since 2023. It suggests photos and videos stored on a user’s phone while the person browses Facebook. The Garante said the feature was active by default and the app relied on a single gallery permission covering multiple functions, preceded by a generic notice to “enable other features.” The regulator said that wording did not adequately explain that users were authorizing gallery suggestions.
According to the Garante, granting the permission could allow Facebook to read the device’s entire photo archive, usually on an ongoing basis. The authority said users and the regulator could not verify which information was actually being used. Its investigation began in July 2025 after a complaint from the Bolzano Consumer Protection Center and included the authority’s own technical analysis. The decision applies to Meta Platforms Ireland, and the Garante said about 20 million Android users in Italy were involved.
The authority ordered Meta to make a separate, specific consent request that explains the feature, its access to the gallery and how to disable it. Within 60 days, the feature must be off by default, including for people who previously granted the Android system permission. Meta must report within 30 days on steps it has started and within 90 days on measures taken. If it misses the compliance deadline, the feature cannot be activated for users without valid consent.
Italy vs. Meta · decision of Nov 14, 2026
One permission, a whole gallery, a record fine
How the Facebook app for Android reached users’ photos, according to Italy’s data protection authority, and what Meta must change.
Phone gallery and app (schematic)
Suggestions from your gallerywhile you browse Facebook, available since 2023 Fully granted: the entire photo archive“usually permanently”, the Garante says Within 60 days: off by defaultand a separate, specific consent request
What the Garante found and ordered
- Since 2023“Get tips from your gallery while browsing Facebook” on Androidfeature
- 1 permissionfor the entire app and several functions, after a generic notice (“enable other features”)Garante finding
- On by defaultthe feature “was set to be active by default”Garante finding
- Whole gallerya fully granted permission lets the app read the entire photo archive, usually permanentlyGarante finding
- July 2025Bolzano Consumer Protection Center report; investigation with technical analysisinvestigation
- Nov 14, 2026Fine; within 60 days: separate consent, off by default, also for people who already allowed itdecision (Meta will appeal)
Source: Garante per la protezione dei dati personali, press release doc. web no. 10321080 (Italian with English version), Rome, Nov 14, 2026; Meta’s appeal as reported by Reuters. The full decision was not yet published. The phone and app picture is a schematic, not the real app.
Graphic: Powered by Thorsten Meyer AI
What the Consent Order Changes
The ruling concerns how an app obtains permission to access personal information stored on a phone, rather than an alleged data breach. The Garante said Article 122 of Italy’s Privacy Code, which implements the EU ePrivacy Directive, protects a smartphone as part of a person’s private sphere. Under the authority’s interpretation, access to device information requires free and informed consent, regardless of whether data is transmitted or harm is shown.
The order requires more than a revised explanation on a permission screen: it says the feature must be off by default and requires a separate choice for this particular use. That could affect how Italian Android users encounter gallery suggestions and whether they can use the feature without actively opting in. The €805 million penalty also makes the decision a major enforcement action against Meta, though its legal and practical effects remain subject to the company’s appeal and any further proceedings.
The Garante said it considered the number of people affected, the duration of the conduct, a prior 2019 ruling against Meta and what it described as limited cooperation during the investigation. It also credited changes Meta made after the complaint, but called them late and limited because they applied only to people who updated the app. The source material reports that the amount represents about 0.47% of Meta’s global revenue; that is the regulator’s stated scale for the penalty, not a separate finding about consumer losses.
Products Worth Considering
Samsung Odyssey OLED G5 27-Inch QHD Gaming Monitor
Jackery Solar Generator 1000 v2 with 100W Solar Panel
Samsung 32-inch Odyssey G5 G51F QHD 180Hz Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the Gallery Case Began
The Garante issued its decision and a press release in Rome on November 14, 2026. The full decision was not yet posted on the authority’s website at 21:27 UTC that day, according to the source report. The available press release describes the feature, the authority’s findings, the legal basis and the orders, but the full reasoning may provide further detail once published.
Meta argued that Italy was not the appropriate regulator and that the matter belonged with Ireland’s authority. The Garante rejected that position, saying the ePrivacy rules at issue do not use the EU’s “one-stop shop” mechanism. The authority also cited a 2019 ruling against Facebook when explaining how it set the penalty. The source report says that earlier Italian fine was €1 million and concerned the Cambridge Analytica case under Italy’s former privacy code.
The current proceeding is limited to the Android gallery-suggestion feature and the way consent was obtained. It is not described as a finding that gallery content was used to train artificial intelligence systems. Meta denies such use, according to the source material. A separate feature launched in 2026 that processes gallery content in the cloud may be considered separately; no finding about that feature is reported here.
““access to the gallery is requested with a single permission, valid for the entire app and for multiple functions with different need””
— Italy’s data protection authority, in its English-language press release
Appeal and AI Questions Remain
Meta’s appeal means the €805 million penalty is being challenged; the source material does not specify when an appeal will be filed, which court or process will hear it, or whether the fine will be suspended while proceedings continue. The Garante’s full decision was also not available on its website at the time recorded in the source report, leaving some detail of the authority’s reasoning and evidence unavailable.
The authority’s press release and the source report do not establish that Facebook used gallery contents to train AI models. Meta denies that use, and the case described here did not decide the issue. The source material says a separate cloud-processing feature launched in 2026 may be assessed separately, but it gives no timetable or indication of what that assessment will find.
There is also a difference between the authority’s English and Italian press-release versions about which users remained affected after changes to the app. The Italian version, as translated in the source report, refers both to people who had not updated the app and to those who had already granted system permission. The precise scope of that continuing violation should be checked against the full decision when it becomes available.
Deadlines Set for Meta
Under the Garante’s order, Meta must send an initial report within 30 days describing measures it has started, then report within 90 days on what it has done. Within 60 days, it must request separate consent for the feature, explain the gallery access and how to switch the feature off, and keep it off by default, including for people who already gave system-level permission.
Meta has said it will appeal, while the Garante may publish the full decision and further information on compliance. Until those developments occur, the outcome of the challenge, the final implementation of the order and any separate review of cloud-based gallery processing remain open.
Key Questions
Why did Italy fine Meta €805 million?
The Garante said Facebook’s Android gallery-suggestion feature accessed users’ photos and videos without a separate, sufficiently clear consent request. It also said the feature was active by default and that one broad permission covered multiple app functions.
What must Meta change?
The order requires a specific consent request explaining the feature and its gallery access. Meta must keep it off by default, including for users who previously granted the Android permission, and meet the Garante’s 30-, 60- and 90-day reporting and compliance deadlines.
Will Meta appeal the decision?
Yes. A Meta spokesperson told Reuters the company would appeal and called the fine “disproportionate.” The source material does not give a filing date or further details of the appeal.
Did the case find that Facebook used photos to train AI?
No such finding is described. The case concerned consent for the Android gallery-suggestion feature, not AI training. The source material says Meta denies using gallery content for training and notes that a separate cloud-processing feature may be assessed separately.
How many users were covered by the case?
The Garante said about 20 million Android users in Italy were involved. The source material does not give a more detailed breakdown of how many people used the feature or had it enabled.
Source: ThorstenMeyerAI.com
