🔍 Read the full analysis: Why Facebook’s Access To Android Photo Galleries Cost Meta €805 Million In Italy on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Italy’s data protection authority fined Meta Platforms Ireland €805 million over Facebook’s Android feature that suggests photos from a user’s gallery while browsing. The regulator said the feature accessed gallery content without sufficiently specific consent and was on by default; Meta plans to appeal. The decision does not address whether gallery content was used to train AI.
Italy’s data protection authority has fined Meta Platforms Ireland Limited €805 million, finding that Facebook’s Android photo-suggestion feature accessed users’ gallery content without specific, informed consent and was on by default. The Garante ordered Meta to change how consent is requested and to report on its response, while Meta said it would appeal.
The case concerns Facebook’s “Get tips from your gallery while browsing Facebook” feature, which displays photos and videos stored on a phone as suggestions for posts. The Garante said the app relied on one Android permission covering multiple functions, preceded by a general prompt to “enable other features.” In its view, users were not adequately told that accepting the permission would enable gallery suggestions.
The regulator said the feature was active by default. It also said that granting the relevant permission could allow the app to read the device’s entire photo archive, usually on an ongoing basis, without users or the authority being able to verify which information was actually used. The decision concerns the conditions of access and consent; it is not a finding of a data breach.
Under the order, Meta has 60 days to seek separate, feature-specific consent, explain the gallery access and how to disable it, and keep the feature off by default, including for users who previously granted system permission. The company must tell the Garante within 30 days what steps it has begun and within 90 days what measures it has taken. The authority said the feature cannot be activated for users who have not given valid consent if the company does not meet the requirements.
Italy vs. Meta · decision of Nov 14, 2026
One permission, a whole gallery, a record fine
How the Facebook app for Android reached users’ photos, according to Italy’s data protection authority, and what Meta must change.
Phone gallery and app (schematic)
Suggestions from your gallerywhile you browse Facebook, available since 2023 Fully granted: the entire photo archive“usually permanently”, the Garante says Within 60 days: off by defaultand a separate, specific consent request
What the Garante found and ordered
- Since 2023“Get tips from your gallery while browsing Facebook” on Androidfeature
- 1 permissionfor the entire app and several functions, after a generic notice (“enable other features”)Garante finding
- On by defaultthe feature “was set to be active by default”Garante finding
- Whole gallerya fully granted permission lets the app read the entire photo archive, usually permanentlyGarante finding
- July 2025Bolzano Consumer Protection Center report; investigation with technical analysisinvestigation
- Nov 14, 2026Fine; within 60 days: separate consent, off by default, also for people who already allowed itdecision (Meta will appeal)
Source: Garante per la protezione dei dati personali, press release doc. web no. 10321080 (Italian with English version), Rome, Nov 14, 2026; Meta’s appeal as reported by Reuters. The full decision was not yet published. The phone and app picture is a schematic, not the real app.
Graphic: Powered by Thorsten Meyer AI
Consent Rules Reach Phone Galleries
The decision addresses the distinction between an operating-system permission and consent to a specific use. The Garante said that allowing an app technical access does not, by itself, establish that a user was clearly informed about a separate feature that draws suggestions from a photo archive.
The order could affect how Facebook presents the feature to Italian Android users, including people who already granted the broader permission. The case concerns how apps explain access to areas of a phone, including when that access supports a convenience feature rather than being linked to a reported security incident.
The Garante said it considered the roughly 20 million Android users in Italy, the duration of the conduct, a previous 2019 ruling and what it described as limited cooperation during the investigation when setting the fine. It also considered Meta’s changes after the complaint in the company’s favor, while noting that the changes were late and limited to people who updated the app. The supplied account cites Al Jazeera as describing the penalty as the Italian regulator’s largest; the Garante’s stated factors explain its reasoning in this case.
Products Worth Considering
Apple MacBook Air 13.6-inch Laptop with M5 Chip, 24GB Memory, 1TB SSD, Midnight
LG UltraGear evo 27-inch 5K Mini-LED Gaming Monitor
Logitech MX Keys S Combo Wireless Keyboard and Mouse, Graphite
As an affiliate, we earn on qualifying purchases.
How the Italian Case Began
The Garante’s press release is dated November 14, 2026. Its investigation began in July 2025 after a report from the Bolzano Consumer Protection Center, and included a technical analysis by the authority. Meta argued that Italy was not the proper regulator and that the case should be handled by Ireland. The Garante rejected that argument, saying the ePrivacy rules at issue do not use the EU’s “one-stop shop” mechanism.
The authority applied Article 122 of Italy’s Privacy Code, which implements the EU ePrivacy Directive. It said the rule protects a smartphone as part of a person’s private sphere, requiring free and informed consent for access to information on the device, regardless of whether data is transmitted or harm is shown. For comparison, the same regulator fined Facebook €1 million in 2019 in the Cambridge Analytica case under Italy’s former privacy code. The 2026 penalty is a different case and rests on the gallery-access findings described in this decision.
The source material reports that the full decision was not yet on the Garante’s website at 21:27 UTC on November 14. Its account therefore relies on the regulator’s press release, including an English version, rather than the full published reasoning.
“The feature “was set to be active by default.””
— Italy’s data protection authority, in its press release
Full Ruling and AI Use Remain Open
The full decision had not been posted on the Garante’s website at the time reported, so the press release does not provide the complete legal reasoning or every detail of the authority’s evidence. The regulator’s English and Italian summaries also differ slightly: the English version says the violation remained ongoing for people who had not updated the app, while the Italian version additionally refers to people who had already granted system permission. The Italian wording is presented in the source account as a translation, not as a separate finding.
The decision does not determine whether gallery content was used to train artificial-intelligence systems. Meta denies such use, according to the source material. A separate feature launched in 2026 that processes gallery content in the cloud may be assessed separately; no finding about that feature is reported here. It is also not yet clear when Meta will file its appeal or whether the regulator’s order will be challenged or changed.
Meta Faces Consent Deadlines
Meta has said it will appeal. Separately, the company must meet the Garante’s reporting deadlines: an update on steps begun within 30 days, and a report on measures taken within 90 days. The 60-day deadline covers the new consent request and the requirement to keep the feature disabled by default, including for users who previously gave Android permission.
The next developments to watch are publication of the full decision, Meta’s appeal and any response from the Garante on compliance. The supplied material does not state whether the appeal automatically pauses the order, so the effect of any appeal on the deadlines remains unclear.
Key Questions
Why did Italy fine Meta €805 million?
The Garante said Facebook’s Android photo-suggestion feature accessed gallery content without sufficiently specific, informed consent and was active by default. It cited the number of people affected, the duration of the conduct and other factors when setting the penalty.
What must Meta change?
Within 60 days, Meta must request separate consent for the feature, explain what gallery access involves and how to disable it, and keep it off by default, including for users who previously granted the Android permission.
Did the ruling find that Meta used photos to train AI?
No. The case did not decide whether gallery content was used to train AI. The source material says Meta denies such use, and a separate cloud-processing feature may be considered separately.
Will Meta appeal the fine?
Yes. A Meta spokesperson said the company would appeal and called the fine “disproportionate,” according to Reuters. The supplied material does not give a filing date or describe the appeal’s arguments.
Source: ThorstenMeyerAI.com
