Italy’s data protection authority has fined Meta €805 million, roughly $887 million, over how the Facebook app on Android handled photo galleries. The Garante says a feature that suggested photos and videos from your phone as post ideas was switched on by default and sat behind a vague permission prompt. If you use Facebook on an Android phone, the ruling comes down to one question: did you ever knowingly agree to let the app read your camera roll?
TL;DR: The Garante fined Meta €805 million on November 14, 2026, over Facebook gallery access on Android. About 20 million Italian users were affected. Meta has 60 days to turn the feature off by default and ask for separate consent. The ruling does not decide whether gallery content was used for AI training, which Meta denies.
How Facebook gallery access on Android worked
The feature is called “Get suggestions from your gallery when you browse Facebook” and has been available since 2023. While you scroll, it offers photos and videos from your phone as things you might post, according to the Garante’s decision announcement.
The authority opened its probe in July 2025 after a complaint from the Centro Tutela Consumatori Utenti in Bolzano, then ran its own technical analysis. That is why the findings go beyond what the complaint alleged.
| Detail | What the Garante states |
|---|---|
| Fine | €805 million, about 0.47% of Meta’s worldwide turnover |
| Company fined | Meta Platforms Ireland Limited |
| Users affected | About 20 million Android users in Italy |
| Feature live since | 2023 |
| Legal basis | Article 122, Italian Privacy Code (EU ePrivacy rules) |
A smartphone, in the Garante’s framing, is part of a person’s private sphere, so reading what is on it needs free and informed consent. It does not matter whether the data leaves the phone or anyone is harmed.
Why one permission prompt carries the case
Gallery access was requested through a single permission that covered the whole app and several functions with different purposes. The prompt that came first told users only that it would “enable other features,” and did not say gallery suggestions were among them.
The feature was also preset to active. Once the permission is fully granted, the app can read the entire photo archive, usually with no expiry, and neither the user nor the Garante can check what is actually used. Bundling a camera-roll grant under a line about other features is a design choice, and the Garante treated it as one rather than an oversight.
The authority also rejected Meta’s argument that Ireland’s regulator should handle the case, because the ePrivacy rules have no one-stop-shop mechanism. That sets up what Meta now has to do.
What Meta has to change, and by when
Meta has 60 days to ask for consent through a separate request for this feature, explaining its purpose, that it needs gallery access, and how to turn it off. The feature must stay off by default, including for people who already granted the permission.
If Meta misses that deadline, the feature cannot be activated for users without valid consent. The company must also report its initiatives to the Garante within 30 days and its adopted measures within 90 days.
The Garante counted the scale of the case against Meta, along with a prior 2019 measure and limited cooperation during the investigation. The violation was also still ongoing for people who had not updated the app or had already granted access. Changes Meta made after the complaint counted in its favor, but the Garante called them late and limited to users who update the app.
What the ruling does not decide
The proceeding did not examine whether gallery content was used to train AI models. Meta denies that it was, and the Garante’s statement leaves that claim untested.
The authority also reserved the right to assess separately a feature launched in 2026 that processes gallery content in the cloud. For anyone worried about where their photos go, that second feature may matter more than this fine.
What to check on your own phone
The Italian order applies to Meta’s Italian users, so nothing changes automatically elsewhere. Still, the pattern is easy to check yourself: open your Android app permissions, look at what Facebook can see in your photos and videos, and ask whether you remember saying yes.
If you do not, tightening that access takes a minute. The same habit of auditing permissions app by app, which we covered in our iPhone permissions audit, applies on Android as well, and Meta’s wider handling of your data shows up in how WhatsApp and Meta AI interact.
