Italy Fines Meta €805 Million Over Facebook’s Access to Android Photo Galleries

By Thorsten Meyer | November 14, 2026 | ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

Key takeaways

• The fine is official: Italy’s data protection authority, the Garante per la protezione dei dati personali, has fined Meta Platforms Ireland Limited €805 million. Its press release is dated Rome, November 14, 2026. The full decision was not yet on the Garante’s website when we last checked at 21:27 UTC.
• What it is about: a Facebook feature on Android, “Get tips from your gallery while browsing Facebook”, available since 2023. According to the Garante, the app accessed photos, videos and related metadata on Italian users’ phones “without obtaining specific consent and without properly informing them”.
• How it worked, per the Garante: one permission covered the whole app, a generic notice (“enable other features”) came before it, and the feature was on by default. Fully granted, that permission lets the app read the entire photo archive, “usually permanently”.
• What Meta must do: within 60 days, ask for separate, specific consent and keep the feature off by default, even for people who already granted the permission. Report to the Garante within 30 days on what it has started and within 90 days on what it has done.
• Meta’s answer: it will appeal. A spokesperson called the fine “disproportionate”, according to Reuters.
• The AI question is open: the case did not cover whether gallery content was used to train AI, which Meta denies. A new feature launched in 2026 that processes gallery content in the cloud may be assessed separately.

Products Worth Considering

DJI Mini 5 Pro Fly More Combo with DJI RC 2

AmazonView Latest Price

Jackery Explorer 2000 v2 Portable Power Station with Two 200W Solar Panels

AmazonView Latest Price

Bose Smart Dolby Atmos Soundbar, All-in-One Soundbar for TV, A.I. Dialogue Mode, Voice Control and Amazon Alexa Built-in, Supports Bluetooth

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

A “simple feature” with a very large price tag

You open Facebook on an Android phone, scroll, and the app suggests a photo from your own gallery that you might want to post. Meta calls it “a simple feature that helps people share photos and videos on Facebook”. Italy’s privacy regulator calls it unlawful access to your device, and it has put a price on that: €805 million.

Al Jazeera calls it “by far the largest fine ever imposed by the Italian regulator”. For scale: in June 2019, the same authority fined Facebook €1 million in the Cambridge Analytica case, under Italy’s former privacy code. The Garante says the new amount is about 0.47% of the group’s global revenue.

The case is not about a data leak or a hack. It is about a question every app that asks for photo access should be able to answer: did the user really agree to this specific use?

What the Garante found

The Garante published its press release in Italian with an English version. Quotes below are from that English version unless marked as our translation.

The decision concerns the feature “Get tips from your gallery while browsing Facebook”, which “during browsing shows users photos and videos from their phone gallery as suggestions to post”. The investigation started in July 2025 after a report by the Bolzano Consumer Protection Center (Centro Tutela Consumatori Utenti) and relied on a technical analysis by the authority itself.

According to the Garante:

• One permission for everything: “access to the gallery is requested with a single permission, valid for the entire app and for multiple functions with different need”.
• A vague prompt: the permission is preceded by a generic notice (“enable other features”) that does not let users understand they are also authorizing gallery suggestions.
• On by default: the feature “was set to be active by default”.
• The whole archive: if fully granted, this kind of permission “allows the app to read the entire photo archive on the device, usually permanently, without the user or the Authority being able to verify what information is actually being used”.

The legal basis is Article 122 of Italy’s Privacy Code, which implements the EU’s ePrivacy Directive. The Garante says the rule “protects the smartphone as part of a person’s private sphere”, so any access to the information on it requires free and informed consent, “regardless of data transmission or the existence of harm”.

Meta also argued that Italy was the wrong regulator and that the case belonged to the Irish authority. The Garante rejected that “because the ePrivacy rules do not provide for the ‘one-stop shop’ mechanism”.

The orders: 60, 30 and 90 days

Within 60 days, Meta must:

• ask for consent “with a separate and specific request for the feature” and clearly explain what it is for, that it involves access to the gallery, and how to disable it;
• “keep the feature turned off by default, even for those who have already given consent”.

If the deadline passes without compliance, “the feature cannot be activated for users who have not given valid consent”. Meta must tell the Garante within 30 days what it has started and within 90 days what measures it has taken.

To set the amount, the Garante weighed “the high number of people involved (around 20 million Android users in Italy)”, the duration of the violation, “a previous 2019 ruling against the company” and “the limited cooperation during the investigation”. It counted Meta’s changes after the complaint in its favour, but judged them “late and limited only to those who update the app”.

One detail differs between the two language versions. The English version says the violation is still ongoing “for those who haven’t updated the app”. The Italian original adds a second group: the violation is “still ongoing for those who have not updated the app and for those who have already granted the system permission” (our translation of “tuttora in corso per chi non ha aggiornato l’app e per chi ha già concesso l’autorizzazione al sistema”). Our reading: that second group fits the order to keep the feature off by default even for people who already said yes.

What Meta says

Meta will appeal. According to Reuters, a Meta spokesperson said the company strongly disagrees with the decision and called the fine “disproportionate”. The statement continued: “This is a simple feature that helps people share photos and videos on Facebook. Users must grant permission on their device before the feature can operate, and they can change that permission at any time in their settings.”

Il Sole 24 Ore, in its English edition (which the paper says is translated by AI), quotes Meta: “We strongly disagree with the Data Protection Authority’s assessment of the facts and its application of the law, and we consider the amount of the fine to be disproportionate.” We found no statement on Meta’s own newsroom.

Sorting out the numbers

The headlines on Saturday did not agree, so here is what holds:

• The amount is €805 million. That figure comes from the Garante’s own release. Dollar figures are conversions by the outlets.
• $887 million is Reuters’ conversion (“€805 million (US$887 million)”, as published by CNA). The Associated Press also gave $887 million.
• “$1.14 billion” in a Straits Times headline is Singapore dollars: its text reads “€805 million (S$1.14 billion)”.
• “$880m” is Al Jazeera’s headline; its text gives $887m.
• “Lacks official confirmation”: an early Crypto Briefing report, published at 07:24 EST on Saturday, said “no official announcement from Italy’s regulator confirming the penalty had surfaced”. The Garante’s release is now on its website, so the fine itself is confirmed. The full written decision is what is still missing.

What it means for businesses

This is not legal advice; for your own app or product, talk to a lawyer who knows the ePrivacy rules in your markets. But the Garante’s reasoning carries several lessons that go beyond Meta.

• Device access is the trigger, not data transfer. The Garante’s position is that reading information on the phone needs consent “regardless of data transmission or the existence of harm”. Our reading: an app or a third-party SDK inside it that reads the gallery, files or other device data for a new purpose may face the same question, even if nothing leaves the phone.
• One permission, many purposes is the risk. The Garante objected to a single permission for “multiple functions with different need” behind a generic prompt. A separate, specific request per feature, off by default, is what it ordered here.
• An EU base in Ireland is no shield for device access. Because the ePrivacy rules have no one-stop shop, the Garante decided this case itself. Companies that rely on their lead GDPR authority should not assume the same for device-access rules.
• Ask for less. Android’s own guidance points the way: since Android 14, users can grant “access to specific images and videos in their library, rather than granting access to all media of a given type”, and Google recommends the system photo picker, which works “without having to request any storage permissions”. If a feature only needs the photo a user picks, it does not need the whole gallery.
• Cooperation counts. The Garante counted “the limited cooperation during the investigation” against Meta, and fixes that came late and only reached users who update did not help much.

What Android users can check

The order covers users in Italy, but anyone can check what an app may see. Google’s steps for Android (menu names vary a little by phone maker and Android version):

1. On your device, open the Settings app.
2. Tap Apps, then the app (here: Facebook). If you can’t find it, tap See all apps.
3. Tap Permissions, then Photos and videos.
4. Choose what fits: full access, access to selected photos only (on Android 14 and later, when the app supports it), or Don’t allow.

Meta says users “can change that permission at any time in their settings”. In Italy, the Garante’s order means the gallery suggestions should be off by default once Meta complies, with a separate consent request if you want them. Apps you have not used for a while can also lose their permissions automatically: Google’s help page describes a “Pause app activity if unused” option.

What is not known

• The full decision. Only the press release is public. Exact time periods, the results of the Garante’s technical analysis and the detailed calculation of the fine are not yet known.
• What happened to the photos. The Garante says the permission works “without the user or the Authority being able to verify what information is actually being used”. The release does not say that photos left the phone or were stored by Meta.
• AI training. “The procedure did not concern the potential use of content to train artificial intelligence, which Meta denies.” The Garante “reserves the right to evaluate separately the new feature, launched in 2026, that allows cloud processing of gallery content.”
• Users outside Italy. The decision is about Italian users. Whether Meta will change the feature elsewhere is not known.
• The appeal. Meta says it will appeal. Where, when, and whether the orders are paused in the meantime is not known.
• Which 2019 ruling. The release mentions “a previous 2019 ruling against the company” without naming it. In 2019 the Garante fined Facebook €1 million in the Cambridge Analytica case, but the release does not say whether that is the ruling it means.

The bottom line

Italy’s fine is not about what Meta did with your photos. It is about whether Facebook had the right to look at them in the first place, through one broad permission and a feature that was switched on for you. For every app maker, the takeaway is simple: one purpose, one clear question, off until the user says yes. And the next question is already on the table: the Garante has flagged Meta’s 2026 feature that processes gallery content in the cloud.

I’m Thorsten Meyer. The full sources are below, and more reality checks are at thorstenmeyerai.com.

Sources

• Garante per la protezione dei dati personali: “Facebook: il Garante privacy sanziona Meta per 805 milioni di euro”, press release with English version, doc. web no. 10321080, Rome, November 14, 2026 (retrieved 20:30 to 21:27 UTC, November 14)
• Garante per la protezione dei dati personali: “Cambridge Analytica: Facebook fined 1 million Euro by the Italian Dpa”, press release, doc. web no. 9121506, Rome, June 28, 2019
• Reuters, via CNA: “Italy fines Meta US$887 million over Android users’ data access”, November 14, 2026
• Reuters, via The Straits Times: “Italy fines Meta $1.14 billion over Android users’ data access”, November 14, 2026
• Il Sole 24 Ore (English edition, AI-translated by the publisher): “Facebook: Data Protection Authority fines Meta €805 million. The company says: ‘We will appeal'”, November 14, 2026
• The Associated Press, via ABC News: “Meta fined $887M in Italy over Android gallery photos, videos on Facebook”, November 14, 2026
• Al Jazeera: “Italy fines Meta $880m over photo privacy”, November 14, 2026
• La Stampa: “Facebook accedeva alle foto degli utenti senza consenso: dal Garante multa da 805 milioni a Meta”, November 14, 2026
• Crypto Briefing: “Italy’s reported €805M Meta fine over Android photos lacks official confirmation”, November 14, 2026
• Google, Android Help: “Change app permissions on your Android phone” (retrieved November 14, 2026)
• Android Developers: “Grant partial access to photos and videos” (retrieved November 14, 2026)

Researched and drafted with AI assistance, including Anthropic’s Claude. No company or authority named here reviewed or sponsored this article. Our own text and graphics contain no affiliate links; offer and product boxes added by the site may contain Amazon affiliate links. This article is for information only. It is not legal advice. Translations from Italian marked as ours are my own. Statements as published by the Garante and as reported by the outlets above, as of 21:27 UTC on November 14, 2026; check the Garante’s website for the full decision. Images: AI-generated illustration (Runware) and graphics by Thorsten Meyer AI; no real people or logos are shown in our images. Boxes added by the site may show product photos or people.