taly’s Data Protection Authority has fined Meta Platforms Ireland €805 million after finding that Facebook’s Android app accessed users’ photos, videos and related metadata without adequately informing them or obtaining specific consent. The case involves a gallery-suggestion feature that could have affected approximately 20 million Android users in Italy.
On November 14, 2026, Italy’s Data Protection Authority, known as the Garante per la protezione dei dati personali, announced an €805 million fine against Meta Platforms Ireland Limited over its Facebook application for Android devices.
The investigation focused on a feature called “Get suggestions from gallery when browsing Facebook,” which has been available since 2023.
The feature suggests photos and videos stored in a user’s smartphone gallery while they browse Facebook, allowing them to use that content when creating posts.
According to the regulator, Facebook accessed photos, videos and associated metadata stored on Italian users’ Android devices without adequately explaining this specific use or obtaining separate, informed consent.
The issue was not simply that Facebook requested access to a phone’s gallery. The regulator’s concern was that users were not clearly informed that granting a general gallery permission could also activate the photo-suggestion feature.
How Facebook’s Gallery Access Feature Worked
The feature was designed to make sharing photos and videos easier by suggesting content directly from a user’s phone gallery while browsing Facebook.
However, the Italian regulator identified problems with how the application requested permission.
Its investigation found that:
- Facebook used a single gallery permission covering multiple application functions with different purposes.
- Before requesting permission, the application displayed a generic notification referring to enabling additional features.
- The notification did not clearly explain that the permission would also allow Facebook to suggest content from the user’s gallery.
- The gallery-suggestion feature was enabled by default.
- When full gallery access was granted, the permission allowed the application to read the device’s entire photo archive, generally on an ongoing basis.
The regulator also highlighted that neither users nor the authority could verify which specific information from the gallery was actually being used by the feature.
This raised concerns about transparency, user control and the way mobile applications obtain permission to access personal information.
Why Did Italy Fine Meta €805 Million?
The Garante concluded that Meta violated Article 122 of Italy’s Privacy Code, which implements the European Union’s ePrivacy rules concerning access to information stored on users’ devices.
The provision protects information stored on smartphones and other electronic devices. Access requires free and informed consent, regardless of whether the information is subsequently transmitted elsewhere or whether a specific financial or other harm is demonstrated.
The regulator also rejected Meta’s objection that the matter should fall under the jurisdiction of Ireland’s data protection authority. It explained that the ePrivacy framework applicable to this case does not provide the GDPR’s one-stop-shop mechanism.
Several factors were considered when determining the penalty:
- The estimated number of affected people, approximately 20 million Android users in Italy.
- The duration of the alleged violation, which the authority said remained ongoing for certain users.
- A previous regulatory decision involving Meta in 2019.
- Meta’s limited cooperation during the investigation.
- Changes introduced by Meta after the original complaint, which the authority considered late and limited in their scope.
The €805 million penalty represents approximately 0.47% of Meta’s global group turnover, according to the regulator.
Around 20 Million Android Users Could Be Affected
The Italian authority estimated that approximately 20 million Android users in Italy were involved in the case.
The investigation concerned the possibility that Facebook could access the complete photo archive through the broader permission granted by users.
Importantly, this figure does not mean that 20 million users’ photographs were publicly leaked or misused. The regulatory finding concerned access to gallery information without sufficiently specific and informed consent.
The distinction matters because accessing information stored on a device, transmitting it to an external server and publicly exposing it are different technical events.
The authority’s decision focused on the first of these issues: access to the gallery and the lack of adequate consent.
Investigation Began After a Consumer Complaint in 2025
The investigation began in July 2025 after the Bolzano Consumer Protection Centre (Centro Tutela Consumatori Utenti) submitted a report to the Italian regulator.
The Garante subsequently conducted a technical analysis of Facebook’s Android application and examined how the gallery permission and suggestion feature operated.
The investigation assessed whether users were properly informed about the purpose of the gallery access and whether the application obtained the specific consent required under Italian privacy law.
The authority ultimately concluded that the permission process did not provide users with sufficient clarity or control over this additional use of their gallery.
What Must Meta Change Within 60 Days?
Alongside the financial penalty, the Garante ordered Meta to change how the gallery-suggestion feature works.
Within 60 days, Meta must:
- Disable the feature by default: The gallery-suggestion feature must remain switched off by default, including for users who have already granted the broader gallery permission.
- Request separate consent: Meta must obtain specific consent for the gallery-suggestion feature rather than relying on a general application permission.
- Explain gallery access clearly: Users must be informed that the feature accesses their phone’s gallery and understand its purpose.
- Provide clear controls: Users must be told how to disable the feature.
If Meta does not comply within the specified period, the feature cannot be activated for users who have not provided valid consent.
The regulator also established separate reporting deadlines:
- Within 30 days, Meta must inform the authority about the initiatives it has started.
- Within 90 days, Meta must report the measures it has adopted.
Meta Disagrees With the Decision and Plans to Appeal
Meta has strongly disagreed with the Italian regulator’s assessment and described the €805 million penalty as disproportionate.
A company spokesperson argued that the gallery-suggestion feature is a simple tool designed to help people share photos and videos on Facebook.
Meta also stated that users must grant permission through their device settings before the feature can operate and that they can change those permissions at any time.
The company has said it plans to appeal the decision.
This creates a clear disagreement between the regulator’s position on specific, informed consent and Meta’s argument that users had already granted the required permission through Android’s device settings.
Did Facebook Use These Photos to Train Artificial Intelligence?
The Italian investigation did not examine whether Facebook used users’ gallery content to train artificial intelligence models.
Meta has denied using the content for that purpose.
However, the Garante has reserved the right to investigate separately a newer feature launched in 2026 that allows content from users’ galleries to be processed in the cloud.
This means the €805 million decision should not be interpreted as a finding that Meta used the affected photographs to train AI models. That question was outside the scope of this particular investigation.
Why This Case Matters for Mobile Application Privacy
Smartphone photo galleries can contain highly personal information, including family photographs, identity documents, screenshots, private conversations and other sensitive material.
When an application requests access to a gallery, users should be able to understand exactly why that access is required and what the application intends to do with the information.
The Italian case highlights several important privacy and application-security principles:
- Purpose limitation: Access to personal information should be linked to a clearly explained purpose.
- Informed consent: Users should understand what they are authorising before granting permission.
- Privacy by default: Optional features involving personal information should not automatically be enabled without an appropriate legal basis.
- Transparency: Applications should explain what information they access and how users can control that access.
- User control: Users should have clear options to enable or disable individual features.
The case also demonstrates that a permission granted at the operating-system level does not automatically resolve every legal question about whether an application has adequately explained a particular data-processing purpose.
Previous Privacy Penalties Against Meta
The €805 million Italian penalty adds to a series of privacy-related enforcement actions involving Meta.
Previous cases include:
- €17 million in Ireland: The Irish Data Protection Commission fined Meta in connection with 12 personal data breaches.
- €251 million in Ireland: Meta was fined over a 2018 Facebook data breach involving user accounts.
- €1.2 billion in Ireland: The company received a major penalty concerning transfers of Facebook users’ personal data to the United States.
- South Korea: Authorities also penalised Meta over its handling of sensitive user information.
These cases involved different legal issues and regulatory findings. They should not be treated as identical to the Italian Android gallery-access case.
Frequently Asked Questions
Why did Italy fine Meta €805 million?
Italy fined Meta because Facebook’s Android application accessed users’ photos, videos and related metadata through a gallery-suggestion feature without adequately informing users or obtaining specific, informed consent.
How many users were potentially affected by the Facebook gallery issue?
The Italian Data Protection Authority estimated that approximately 20 million Android users in Italy could be affected.
Did Facebook publicly leak users’ private photographs?
The Italian investigation focused on access to users’ photo galleries without adequate consent. It did not establish that the photographs were publicly leaked or that all affected users’ images were misused.
What must Meta do after the Italian regulator’s decision?
Meta must disable the gallery-suggestion feature by default, request separate and specific consent, clearly explain why gallery access is required and tell users how to disable the feature within 60 days.
Is Meta planning to appeal the €805 million fine?
Yes. Meta has disagreed with the regulator’s findings, described the penalty as disproportionate and said it plans to appeal.