Italy Fines Meta €805m for Accessing Android Users’ Photos Without Consent

Italy’s data protection authority, the Garante per la protezione dei dati personali, has fined Meta Platforms Ireland Limited €805 million (approximately $887 million) for accessing the photographs, videos, and metadata stored on Italian Android users’ smartphones without obtaining specific consent or adequately informing them.

The €805 million fine was announced on Friday, November 14, 2026, following an investigation that began with a complaint from a consumer group in Bolzano, ValidViewNetwork reports.

THE VIOLATION

The fine relates to a feature called “Get suggestions from your gallery when browsing Facebook,” which was introduced in 2023.

The feature proposes photos and videos from the user’s phone gallery as potential content to publish on the platform .

The Garante found that the Facebook app for Android requested access to the gallery through a single authorisation that applied to the entire app and multiple functions with different purposes.

The authorisation was preceded by a generic notice, “enable other functions”, that did not allow the user to understand that they were also authorising gallery suggestions.

The feature was also pre-set to active .If the authorisation was granted in full, the app could read the entire photo archive on the device, generally on a permanent basis, without the user or the Authority being able to verify which information was actually being used .

THE LEGAL BASIS

The Garante said the conduct violated Article 122 of the Italian Privacy Code, which implements the European ePrivacy Directive and protects the smartphone as part of a person’s private sphere.

Any access to the information it contains requires free and informed consent, regardless of whether the data is transmitted or whether any damage occurs.

The Authority also rejected Meta’s objection that the Irish data protection authority had competence over the matter. The Garante said the ePrivacy directive does not provide for the “one-stop-shop” mechanism, which allows a single authority to oversee a company’s compliance across the EU .

THE ORDER

Meta has 60 days to comply with the following orders:

· Request consent through a separate and specific request for the gallery feature, explaining clearly what it is for, that it involves access to the gallery, and how to disable it.

· Keep the feature disabled by default, including for users who have already granted authorisation.

· If the deadline passes without compliance, the feature cannot be activated.

The proceeding did not concern the potential use of the content to train artificial intelligence, which Meta denies. The Garante said it reserves the right to assess, through separate investigations, a new feature launched in 2026 that allows cloud processing of gallery content.

WHY IT MATTERS

This is the largest fine the Italian data protection authority has ever imposed, and it is a signal that European regulators are losing patience with Big Tech’s approach to consent.

The violation is not that Meta accessed user photos. The violation is that it did so without asking properly.

A generic “enable other functions” notice is not consent. It is a trick. It relies on users not reading, not understanding, or simply clicking “yes” to make the pop-up go away.

And it allows an app to read an entire photo archive, years of memories, private moments, sensitive images, without the user truly knowing what they have agreed to.

The €805 million fine is a punishment, but it is also a warning.

The Garante has told Meta, in the clearest terms, that it must ask specific consent, explain what it is asking for, and keep the feature off by default. If Meta does not comply within 60 days, the feature cannot be activated at all.

For Meta, the fine is a financial hit.

For Europeans, it is a victory for privacy.

ADVERTISEMENT

And for the rest of the world, it is a reminder that the data on your phone is yours, and no app has the right to it without your clear, informed permission. ValidViewNetwork reports.