Meta has been fined €805 million by Italy's data protection authority for letting the Facebook app read photos, videos and metadata on the phones of around 20 million Android users in Italy, without specific consent and without clearly explaining what people had switched on.
The Meta fine, announced November 14 by the Garante per la protezione dei dati personali, is about 0.47 percent of group revenue. Italy did not uncover a hidden exploit. It found a single app-wide permission, a generic "enable other features" notice, and a gallery-suggestion tool left on by default.
The 2023 feature, "Get suggestions from your gallery while browsing Facebook," offers phone images as posts. It is not the 2026 cloud feature that uploads camera-roll media for AI edits, which the Garante has reserved for a separate investigation. Meta denies using gallery content to train AI, and this decision does not cover that question.
The inquiry followed a July 2025 complaint from the Centro Tutela Consumatori Utenti di Bolzano. The Garante found gallery access was requested through one authorization, valid for the entire app and for several functions with different purposes, after a notice that did not mention gallery suggestions. If fully granted, the app could read the entire photo archive on an ongoing basis, and neither the user nor the Authority could verify what was actually used.
The Garante said the smartphone is part of a person's private sphere.
"Any access to the information it contains therefore requires free and informed consent, regardless of whether the data is transmitted or any harm occurs."
The Garante, official press release, November 14, 2026
The cited rule is Article 122 of the Italian Privacy Code, implementing the ePrivacy Directive, not the GDPR. Meta said Ireland's Data Protection Commission should have the case. Italy refused, because ePrivacy has no one-stop-shop. If your CX stack touches the phone through an app, an SDK, cookies, or push notifications, a national regulator can act alone. Dublin is not your only problem.
Meta has 60 days to seek a separate, specific consent, explain the feature and how to turn it off, and keep it off by default, even for people who already gave the bundled permission. After that, it cannot run without valid consent. Plans are due in 30 days, measures in 90 days.
Meta will appeal. A spokesperson told the BBC:
"We strongly disagree with the [regulator's] assessment of the facts, its application of the law and the disproportionate level of the fine."
A Meta spokesperson, speaking to the BBC
It also called this "a straightforward feature which helps people post photos and videos to Facebook," and said people must give device permission and can change it in settings.