Italy fines Meta €805m over Facebook's Android gallery access

Italy fines Meta €805m over Facebook's Android gallery access

14 November 2026: Italy's data protection authority, the Garante, has fined Meta Platforms Ireland Limited 805 million euros because the Facebook app for Android read photos, videos and their metadata on Italian users' phones without asking for specific consent and without telling them properly. Meta has 60 days to switch the feature off by default and ask for consent separately, or it may not run for anyone who has not given valid consent.

Not yet independently verified. The account comes from the Garante's own press release of 14 November; we have not read the decision itself or a statement from Meta, and the release does not say whether Meta will appeal. We will update this when it can be confirmed, and remove this note.

The feature at the centre of the case

The decision concerns "Get tips from your gallery while browsing Facebook", a feature available since 2023 that shows users photos and videos from their phone's gallery as suggestions to post while they browse. The Garante says it was switched on by default.

The authority's concern is the breadth of the permission behind it. If granted in full, the release says, a permission of this kind lets the app read the device's whole photo archive, as a rule permanently, without the user or the authority being able to check which information is actually used.

The investigation began in July 2025 after a complaint from the Centro Tutela Consumatori Utenti, a consumer association in Bolzano, and the Garante ran its own technical analysis of the app.

Why Italy, not Ireland, decided it

The legal basis is Article 122 of Italy's Privacy Code, which carries the European ePrivacy Directive into national law. The Garante said that rule treats a smartphone as part of a person's private sphere, so any access to what it holds needs free and informed consent, whether or not data is sent anywhere and whether or not harm follows.

Meta argued that the Irish Data Protection Commission, its lead authority under the GDPR, should handle the case. The Garante rejected that, because the ePrivacy rules have no one-stop-shop mechanism. That reasoning matters well beyond Facebook: any company whose app reads device storage, contacts or other on-phone data can be pursued by each national authority under ePrivacy, rather than only by the authority of its EU headquarters.

The Garante set the amount with the number of people affected in mind, about 20 million Android users in Italy.

What Meta has to do, and when

Within 60 days, Meta must:

• ask for consent through a separate, specific request for the feature, and explain clearly what it is for, that it involves access to the gallery and how to switch it off;
• after that deadline, stop the feature running for any user who has not given valid consent;
• tell the Garante within 30 days what it has started doing, and within 90 days what measures it has taken.

What the case did not cover

The proceedings did not look at whether gallery content was used to train artificial intelligence, which Meta denies. The Garante said it reserves the right to assess separately a newer feature, launched in 2026, that processes gallery content in the cloud.

For a business with an Android app of its own, the decision is a reminder that the consent screen for a storage or media permission is judged on its own terms: switched on by default, bundled with other permissions or explained only in general words, it can fail Article 122 regardless of what the app later does with the files.

Related on TrustList:

• CNIL fines Fnac Darty €7m over an app tracker used without consent
• Spain opens consultation on the EU Kids Act and its under-15 account ban
• Irish regulator fines Google €403 million over location data

Sources

• Garante per la protezione dei dati personali: Facebook, il Garante Privacy sanziona Meta per 805 milioni di euro (press release, Italian and English), 14 November 2026