Italy fines Meta $887 million over Android gallery photo access

Italy’s data protection authority fined Meta Platforms Ireland Limited €805 million ($887 million) on Nov. 14, 2026, for accessing Android users’ photos and videos through a Facebook feature without specific consent or adequate disclosure. The authority imposed the fine on Meta’s Irish subsidiary.

The penalty concerned a Facebook feature for Android, available since 2023, that suggested photos and videos from a phone’s gallery as ideas for posts. Facebook turned the feature on by default and requested gallery access through one permission covering the whole app and several functions instead of separate consent. The regulator said Meta failed to inform users adequately or obtain consent, and a general notice did not reveal that users also authorised gallery suggestions. About 20 million Android users in Italy were affected.

Regulators found the single permission let Facebook read the phone’s entire photo archive, including metadata, on an ongoing basis without clear disclosure. Italy’s regulator relied on Article 122 of Italy’s Privacy Code, implementing the EU ePrivacy Directive. The ruling treats a smartphone as belonging to private life, so reaching its stored content needs free and informed consent whether or not data is sent anywhere and whether or not harm results, the authority said. The dispute asks whether Meta’s current device-permission setup gave enough transparency and genuine consent before an app could view personal photos and video clips.

Meta has 60 days to turn the feature off by default. It must obtain separate, specific consent, even from users who already granted access. The company must explain the feature’s purpose, that it accesses the photo gallery, and how to turn it off. Meta must report to the authority within 30 days on work started.

It must report within 90 days on the measures taken. If Meta misses the 60-day deadline, Meta cannot turn on the feature for anyone who has not given valid consent.

Meta said Ireland’s Data Protection Commission should handle the case under GDPR one-stop-shop rules since Meta’s European headquarters is in Ireland. The Italian regulator rejected the jurisdiction objection because ePrivacy rules do not provide a one-stop-shop mechanism. Meta Platforms Ireland Limited challenged Italy’s jurisdiction.

The inquiry included the authority’s own technical analysis. The investigation began in July 2025 after a tip-off from the Bolzano consumer protection center Centro Tutela Consumatori Utenti, whose complaint started the case. The authority weighed the number of people affected and the duration, still ongoing for non-updating users and those who already consented. Meta’s lack of cooperation during the investigation factored into the penalty, as did a 2019 decision against Meta that weighed in setting the fine; post-complaint changes counted in its favor but the authority judged them late and limited to app updaters.

Meta plans to appeal and strongly disagreed with the regulator’s assessment, its application of the law, and the disproportionate fine. Meta defended the feature, saying users must grant permission on their device before it operates and can change that permission anytime in settings. In a statement, Meta said, “We strongly disagree with the [regulator’s] assessment of the facts, its application of the law, and the disproportionate level of the fine.”

Five of the six sources put the fine at about 0.47% of Meta’s global turnover or revenue, while one said roughly 0.4% of annual turnover. Jang_Akhbar also cites Meta’s 2025 annual turnover of $201 billion and net profit of $60.5 billion. The fine is among the largest penalties an Italian authority has imposed on a technology company.

In 2021, Italy fined Amazon more than €1.1 billion for breaching competition law, later reduced to €752 million on appeal. In October, a New Mexico court ordered Meta to pay $25 billion for misleading the public about handling Facebook users’ personal information.

The probe did not examine the question of using gallery content for AI training. Meta denied that it used gallery content for AI training. Regulators kept the right to assess separately a 2026 feature that sends gallery content to cloud processing.