🔍 Read the full analysis: Italy’s Meta Penalty Highlights Facebook’s Access To Android Photo Galleries on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Italy’s data protection authority fined Meta Platforms Ireland €805 million over Facebook’s Android feature that suggests photos from users’ phone galleries. The regulator says the feature lacked specific, informed consent and must be turned off by default; Meta plans to appeal.
Italy’s data protection authority has fined Meta Platforms Ireland Limited €805 million, saying Facebook’s Android photo-suggestion feature accessed users’ galleries without sufficiently specific consent or clear notice. The Garante per la protezione dei dati personali also ordered Meta to seek separate consent and keep the feature off by default, including for users who previously granted Android photo access.
The case concerns Facebook’s “Get tips from your gallery while browsing Facebook” feature, available since 2023. It shows photos and videos from a user’s phone as suggestions for posts. In a press release dated November 14, the Garante said its investigation found that the app used one system permission for multiple functions, preceded the permission request with a generic notice about enabling other features, and had the gallery feature active by default.
According to the regulator, granting the relevant permission can allow an app to read the device’s entire photo archive, usually on an ongoing basis. The Garante said users were not adequately informed that the permission also enabled photo suggestions, and that the arrangement did not meet the consent requirements of Article 122 of Italy’s Privacy Code. The investigation began in July 2025 after a report from the Bolzano Consumer Protection Center and included a technical analysis by the authority.
Meta has 60 days to request separate, specific consent, explain the feature and how to disable it, and turn it off by default, even for people who have already given system-level permission. The company must report to the Garante within 30 days on steps it has started and within 90 days on measures taken. The regulator said the fine reflects the number of people involved—about 20 million Android users in Italy—the duration of the conduct, a prior 2019 ruling and what it described as limited cooperation. It also credited changes Meta made after the complaint, but called them late and limited to users who updated the app.
Italy vs. Meta · decision of Nov 14, 2026
One permission, a whole gallery, a record fine
How the Facebook app for Android reached users’ photos, according to Italy’s data protection authority, and what Meta must change.
Phone gallery and app (schematic)
Suggestions from your gallerywhile you browse Facebook, available since 2023 Fully granted: the entire photo archive“usually permanently”, the Garante says Within 60 days: off by defaultand a separate, specific consent request
What the Garante found and ordered
- Since 2023“Get tips from your gallery while browsing Facebook” on Androidfeature
- 1 permissionfor the entire app and several functions, after a generic notice (“enable other features”)Garante finding
- On by defaultthe feature “was set to be active by default”Garante finding
- Whole gallerya fully granted permission lets the app read the entire photo archive, usually permanentlyGarante finding
- July 2025Bolzano Consumer Protection Center report; investigation with technical analysisinvestigation
- Nov 14, 2026Fine; within 60 days: separate consent, off by default, also for people who already allowed itdecision (Meta will appeal)
Source: Garante per la protezione dei dati personali, press release doc. web no. 10321080 (Italian with English version), Rome, Nov 14, 2026; Meta’s appeal as reported by Reuters. The full decision was not yet published. The phone and app picture is a schematic, not the real app.
Graphic: Powered by Thorsten Meyer AI
Consent Rules Reach Phone Galleries
The decision is about access to information stored on a device, not a reported breach or hack. It focuses on whether a broad Android permission and a vague prompt can count as informed agreement to a particular use of personal photos. That question matters to users because a permission can expose far more content than the feature’s visible purpose—suggesting a picture to post—might imply.
The order also makes clear that, in the Garante’s view, previously granting an operating-system permission does not by itself settle whether users agreed to this specific Facebook feature. Requiring a separate choice and a default-off setting could affect how Meta presents gallery suggestions in Italy. The ruling may also be relevant to scrutiny of other apps that combine multiple functions under a single device permission, although the decision described here concerns Facebook’s feature and Italian law.
The authority said the applicable ePrivacy rules do not use the EU’s “one-stop shop” mechanism for this issue, rejecting Meta’s argument that the case belonged to Ireland’s regulator. That finding gives the Italian authority a direct role in enforcing the rules against the Ireland-based company for the conduct under review.
Products Worth Considering
Logitech MX Keys S Combo Wireless Keyboard and Mouse, Graphite
DJI Mini 3 Drone with DJI RC and 3‑Axis Mechanical Gimbal
Bose TV Speaker Compact Soundbar with Bluetooth and HDMI-ARC, Black
As an affiliate, we earn on qualifying purchases.
How the Italian Case Began
The Garante opened its investigation in July 2025 following a report by the Bolzano Consumer Protection Center. Its November 14, 2026, release sets out the findings and orders, but the full decision was not yet available on the authority’s website at 21:27 UTC that day, according to the source report. The release is therefore the available basis for the details presented here.
The regulator cited Article 122 of Italy’s Privacy Code, which implements the EU ePrivacy Directive. It said the rule protects smartphones as part of a person’s private sphere and requires free, informed consent for access to information on a device, whether or not information is transmitted or harm is shown. The Garante also referred to a 2019 ruling against Meta as one factor in setting the penalty. The €805 million amount is far above the €1 million fine the authority imposed on Facebook in 2019 in the Cambridge Analytica case, though the two cases concern different conduct and legal findings.
“The app accessed photos, videos and related metadata on Italian users’ phones “without obtaining specific consent and without properly informing them.””
— Italy’s data protection authority, the Garante
Appeal and Data-Use Questions
Meta’s planned appeal means the penalty and findings may be contested. The full written decision was not posted on the Garante’s website at the time reported, so details beyond the press release—including the regulator’s complete reasoning—remain unavailable in the source material.
The case did not decide whether photos or other gallery content were used to train artificial-intelligence systems. The source report says Meta denies such use, but the Garante’s action described here addressed access for Facebook’s photo-suggestion feature, not AI training. A separate feature launched in 2026 that processes gallery content in the cloud may be examined separately; no conclusion about that feature is established in the available material.
The authority’s English and Italian press-release versions also differ slightly in describing which users were still affected by the violation. The English version refers to people who had not updated the app; the Italian version also mentions people who had already granted system permission. The order itself says the feature must be off by default even for users who previously granted that permission. The full decision could clarify the difference.
Meta’s Appeal and Compliance Deadlines
Meta has said it will appeal the fine, according to the source report. The available information does not specify when that appeal will be filed or which court or procedure will hear it. The penalty’s status and any changes to the regulator’s findings could depend on that process.
Separately, the Garante’s orders set reporting and compliance milestones: Meta must tell the authority within 30 days what it has begun, report within 90 days on measures taken, and meet the 60-day deadline for the separate consent request and default-off setting. The authority said the feature cannot be activated for users who have not given valid consent if Meta misses the required deadline. The regulator’s monitoring of those steps, publication of the full decision and any separate examination of the cloud-based feature are developments to watch.
Key Questions
Why did Italy fine Meta?
The Garante said Facebook’s Android photo-suggestion feature accessed users’ galleries without specific, informed consent. It cited a broad app permission, a generic notice and a feature that was on by default.
What must Meta change?
Within 60 days, Meta must seek separate consent for the feature, explain its purpose and how to disable it, and keep it off by default—even for users who previously granted Android photo permission.
Did the ruling find that Meta used photos to train AI?
No. The case described in the regulator’s release concerned gallery access for photo suggestions. AI training was not decided in this proceeding; the source report says Meta denies using the content for that purpose.
Will Meta challenge the fine?
Yes. Meta said it will appeal, and a spokesperson called the fine “disproportionate,” according to Reuters as cited in the source material. The appeal’s timing and outcome are not yet clear.
Source: ThorstenMeyerAI.com
