Italy’s data protection authority has fined Meta €805 million over Facebook’s access to photos, videos and metadata stored on Android phones without separate, informed user consent. The case concerns a gallery-suggestion feature that had been enabled by default since 2023, affected an estimated 20 million people in Italy and must now be redesigned within 60 days.
The Italian Data Protection Authority, formally the Garante per la protezione dei dati personali, announced the decision on 14 November 2026. The penalty against Meta Platforms Ireland Limited is equivalent to about 0.47% of the group’s global revenue.
According to the regulator, Facebook relied on permission to read a phone’s gallery in a way that did not allow users to make an informed choice about whether their photos and videos could be used for this specific app feature.
Facebook relied on a single gallery permission
The proceedings focused on a feature that suggested photos and videos from a phone while the user browsed Facebook. It was designed to make publishing easier by proposing content stored on the device.
The feature had been available since 2023 and was switched on by default. Facebook used the same gallery-access permission that users had granted for other functions in the app.
The Garante found that the permission followed a general prompt about enabling additional Facebook capabilities. The prompt did not adequately explain that access would also allow Facebook to inspect photos and videos in order to suggest them for publication.
The regulator said full gallery permission could allow the app to read a user’s entire photo and video archive, usually without a time limit. Users also had no way to see exactly which information the feature used.
The findings concern improper access to data. They do not mean that Facebook copied every photo from users’ phones or made private material public.
System permission was not informed consent
The decision is based on Article 122 of Italy’s Privacy Code, which implements the European Union’s ePrivacy Directive. The provision protects information stored on users’ devices and requires valid consent before it can be accessed.
The Garante said granting an operating-system permission to an app did not amount to informed consent for every possible use of a phone’s contents. Users had to be told the specific purpose for which the app wanted to use their data.
The regulator also said a violation did not depend on proving that the information had been transmitted to the company’s servers or that a user had suffered actual harm.
Meta challenged the Italian authority’s jurisdiction and argued that the Irish regulator should handle the matter. The Garante rejected that position because ePrivacy rules do not contain the “one-stop-shop” lead-authority system used for some proceedings under the EU’s General Data Protection Regulation (GDPR).
Meta has 60 days to change the feature
The authority ordered Meta to introduce a separate consent mechanism for gallery suggestions within 60 days. It must clearly state why Facebook wants access to photos and videos and explain how users can switch the feature off.
The feature must be disabled by default, including for people who previously allowed Facebook to access their phone gallery.
If Meta does not comply by the deadline, it will not be allowed to activate the feature for users who have not provided valid consent.
The company must also tell the regulator within 30 days what work it has started and report within 90 days on the measures it has implemented.
The case covers about 20 million Android users
In setting the fine, the Garante considered both the scale of the infringement—an estimated 20 million Android users in Italy—and how long it lasted.
The authority said the problem continued even after Meta changed the app. It persisted for people using older Facebook versions and for users who had previously granted the relevant permissions.
The amount also reflected an earlier 2019 decision against the company and what the regulator described as limited cooperation by Meta during the proceedings.
As a mitigating factor, the authority acknowledged changes made after the complaint was filed. It nevertheless concluded that they came too late and applied only to users who updated the app.
A consumer complaint prompted the investigation
The case reached the Italian regulator in July 2025 following a complaint by the Consumer Protection Centre in Bolzano. The Garante then carried out its own technical analysis of how Facebook operated on Android devices.
The investigation did not examine whether photos and videos were used to train artificial intelligence models. Meta denies using the material for that purpose.
The Garante said it may separately investigate a feature launched in 2026 that enables cloud processing of gallery content. That feature was not covered by the €805 million decision.
Sources
Italian Data Protection Authority, “Facebook: il Garante Privacy sanziona Meta per 805 milioni di euro”, 14 November 2026, document no. 10321080.
Reuters, “Italy fines Meta $887 million over Android users’ data access”, 14 November 2026.
Original Polish-language article by the ManagerPlus editorial team: ManagerPlus.
