Italy’s data protection authority has fined Meta Platforms €805 million (approximately $887 million) over the way Facebook accessed photographs, videos and related metadata stored on Android smartphones. The regulator said the company failed to obtain specific user consent and did not adequately explain how the information would be accessed and used through a Facebook feature.
The decision, announced on November 14, 2026, concerns a feature called “Get suggestions from gallery when browsing Facebook”. It suggests photographs and videos from a user’s phone gallery that could be shared as Facebook posts. According to the Italian authority, the feature affected approximately 20 million Android users in the country. Meta has rejected the decision and said it intends to appeal.
Why Italy Fined Meta €805 Million
The case centres on how Facebook obtained permission to access users’ smartphone galleries.
According to Italy’s Data Protection Authority, known as Garante, Facebook relied on a single Android authorisation covering multiple functions within the application. Users were presented with a general notification asking them to enable additional features, rather than a clear and separate explanation that their photographs and videos could also be used to generate content suggestions while browsing Facebook.
The regulator said this arrangement did not provide users with enough information to make a specific and informed choice about the gallery-suggestion feature.
The investigation also found that the feature was enabled by default. Once the broader gallery permission was granted, the application could access the device’s stored photographs and videos, including associated metadata.
Garante argued that permission to access a smartphone’s contents must be based on clear information and freely given consent. It concluded that Meta’s approach violated Article 122 of Italy’s Privacy Code, which implements relevant European ePrivacy protections.
How Facebook’s Gallery Suggestion Feature Worked
The feature was introduced in 2023 and was designed to make sharing content easier.
While users browsed Facebook, the application could suggest photographs and videos stored in their Android phone galleries as potential material for posts. The recommendations were intended to help users discover and share personal content without manually searching through their galleries.
However, the Italian regulator questioned whether users understood that granting access to the gallery could enable this additional functionality.
The authority’s concern was not simply that Facebook requested permission to access photographs. It was that the permission covered multiple purposes without clearly distinguishing between them.
This distinction is important because permission to access a phone’s gallery for one purpose does not automatically establish that users have knowingly agreed to every other use of that access.
The regulator also said that the feature remained active for some users who had not updated their applications, contributing to the duration of the alleged violation.
Meta Must Change the Feature Within 60 Days
Alongside the financial penalty, Italy’s regulator has ordered Meta to change how the feature operates.
The company has been given 60 days to disable the gallery-suggestion functionality by default and introduce a separate, specific consent request.
The new consent process must clearly explain why the application needs access to the gallery, what the feature does and how users can disable it.
The authority also said the change must apply to users who had previously granted the broader Android permission. Meta cannot simply rely on an earlier general authorisation to keep the feature enabled.
The regulator has established additional reporting requirements:
| Requirement | Deadline |
|---|---|
| Disable the feature by default and introduce separate consent | Within 60 days |
| Inform the regulator about steps initiated | Within 30 days |
| Report the measures implemented | Within 90 days |
If Meta does not obtain valid consent after the deadline, the feature cannot be activated for users who have not provided that consent.
Meta Disputes the Decision and Plans to Appeal
Meta has strongly disagreed with the regulator’s findings and described the €805 million penalty as disproportionate.
A company spokesperson said the gallery-suggestion feature was a straightforward tool designed to help people share photographs and videos on Facebook.
Meta also argued that users must grant permission through their Android device settings before the feature can operate. According to the company, users can change or withdraw that permission whenever they choose.
The dispute therefore centres partly on what constitutes sufficiently informed consent. Meta maintains that its existing permission process gives users control, while Italy’s regulator believes the broader authorisation and generic explanation did not adequately communicate the feature’s specific purpose.
The company has said it will appeal the decision. The penalty and corrective requirements are therefore subject to any further legal proceedings.
What the Investigation Did Not Cover
The regulator clarified that its investigation did not examine whether Facebook used the photographs or videos accessed through the feature to train artificial intelligence models.
Meta has denied using the material for that purpose, according to the authority.
Garante also said it reserved the right to examine separately another feature introduced in 2026. That functionality allows content from users’ galleries to be processed in the cloud.
This means the €805 million decision should not be interpreted as a finding that Meta used the affected photographs to train AI systems. The investigation focused on access to gallery information, the consent process and the information provided to users.
The distinction is significant as technology companies increasingly introduce AI-powered features that process personal content stored on smartphones and other devices.
How Italy Calculated the Fine
The €805 million penalty reflects several factors considered by the regulator.
Garante cited the large number of potentially affected users, estimated at approximately 20 million Android users in Italy, and the duration of the alleged violation. It also considered a previous regulatory measure involving Meta in 2019 and what it described as limited cooperation during the investigation.
The authority did take into account changes Meta had introduced after the initial complaint. However, it considered those changes insufficient because they were limited and did not adequately address users who had not updated their applications.
The fine represents approximately 0.47% of Meta’s global revenue, according to the regulator.
The investigation began in July 2025 following a complaint from the Consumer Protection Centre in Bolzano. The authority subsequently conducted a technical assessment of the Facebook application and its permission process.
The Bigger Picture
The case highlights an increasingly important issue for technology companies: obtaining access to personal information is not necessarily the same as obtaining meaningful consent for every use of that information.
Smartphone applications often request permissions covering photographs, contacts, location, microphones and other sensitive information. When a single permission supports several different functions, users may struggle to understand exactly what they are authorising.
Italy’s decision reinforces the importance of explaining individual data uses clearly, particularly when applications introduce features that operate in the background or are enabled by default.
The ruling also adds to the regulatory scrutiny facing large technology platforms in Europe. Companies operating across the region must account for privacy requirements that extend beyond the technical permission systems provided by mobile operating systems.
Looking Ahead
Meta’s planned appeal will be an important next step in determining whether the Italian authority’s findings and financial penalty withstand legal scrutiny. The company will also need to address the regulator’s requirements concerning default settings and separate consent within the prescribed deadlines, unless those obligations are changed through further proceedings.
For Android users, the case is a reminder to review application permissions and understand why an app requests access to personal photographs, videos and other information. As social media platforms introduce more automated recommendations and AI-powered services, clear consent and control over personal data are likely to remain central issues for regulators and technology companies.
Get the day’s top stories in your inbox
One concise email. No spam, unsubscribe anytime.
