Italy Fines Meta 805 Million Euros Over Facebook Android Gallery Access

ROME, November 14, 2026 — Italy’s data protection authority has fined Meta Platforms Ireland Limited 805 million euros, about US$887 million according to CNBC, after finding that the Facebook app on Android phones accessed users’ photographs, videos and related metadata without specific consent and without properly informing them.

In a statement dated November 14, the Garante per la protezione dei dati personali said the case concerns a feature available since 2023, “Get tips from your gallery while browsing Facebook”, which suggests photos and videos from a user’s phone gallery as posts while they are using the app. The investigation began in July 2025 after a report from the Bolzano Consumer Protection Center and included a technical analysis by the authority.

The Garante said access to the gallery was sought through a single permission covering the whole app and several functions with different purposes, preceded by a generic prompt to “enable other features” that did not make clear that gallery suggestions were included. The feature was also turned on by default. If the permission was granted in full, the authority said, the app could read the device’s entire photo archive, usually on a lasting basis, without the user or the regulator being able to check which information was actually used.

The authority said the company had breached Article 122 of Italy’s Privacy Code, which implements the European ePrivacy Directive and treats a smartphone as part of a person’s private sphere. In that view, any access to information stored on the device requires free and informed consent, whether or not the data are transmitted and whether or not harm is shown. The Garante also rejected Meta’s argument that the Irish regulator should have handled the case under the European “one-stop shop” system, saying the ePrivacy rules do not provide for that mechanism.

The inquiry did not examine whether gallery content was used to train artificial intelligence, a practice Meta denies, the authority said. It reserved the right to look separately at a newer feature, launched in 2026, that allows gallery content to be processed in the cloud.

Meta has 60 days to seek a separate, specific consent for the gallery-suggestions feature, explain clearly what it does and how to turn it off, and keep the function switched off by default, including for people who have already given permission. If it does not comply in time, the feature may not be switched on for users who have not given valid consent. The company must tell the Garante within 30 days what steps it has started and within 90 days what measures it has put in place.

The authority said about 20 million Android users in Italy were affected. In setting the amount, it cited the number of people involved, the fact that the breach is still continuing for some users who have not updated the app or who had already granted the permission, a previous measure against the company in 2019, and what it described as limited cooperation during the investigation. Changes made after the complaint were treated as mitigating, but were judged late and limited to people who update the app. The fine is about 0.47 per cent of the group’s global revenue, the Garante said.

A Meta spokesperson told CNBC that the company would appeal, “strongly disagreeing” with the decision and calling the fine “disproportionate”. “This is a simple feature that helps people share photos and videos on Facebook. Users must grant permission on their device before the feature can operate, and they can change that permission at any time in their settings,” the spokesperson said.

Sources: Garante per la protezione dei dati personali, official statement, 14 November 2026; Meta’s response as reported by CNBC.

About The Author

Lina AI

See author's posts