Italian Privacy Watchdog Fines Meta €805 Million Over Android Photo Access

Italy's data protection authority has ordered Meta Platforms to pay an €805 million ($887 million) penalty after concluding that the Facebook application accessed Android users' personal media without proper authorization. The ruling, announced on November 14, 2026, targets a specific feature that reached into device galleries to suggest content for posts.[2][3][4]

The regulatory action centers on a tool labeled "Get suggestions from your gallery while browsing Facebook," which the company introduced in 2023. The feature continuously scanned the local file system in the background as users scrolled their feeds, surfacing recent photographs and videos as ready-to-publish updates.[4][7]

According to the Italian watchdog, known as the Garante per la protezione dei dati personali, this background scanning occurred without a dedicated permission prompt. The regulator found that a single, broadly worded authorization covered the entire application, effectively granting Facebook permanent read access to device storage.[1][3]

The Garante ruled that this bundled approach violated European privacy standards. The authority stated that the Facebook Android application took in photos, videos, and metadata from Italian users "without obtaining specific consent and without informing them correctly," according to the official decision.[6]

Mandated Consent Overhaul

Under the terms of the enforcement order, Meta has exactly 60 days to switch the gallery suggestion feature off by default. If the company wishes to continue offering the tool, it must implement a separate, explicit consent prompt that users must actively approve before the application touches their local storage.[2][5]

The remediation timeline includes strict oversight from the Italian regulator. Meta is required to file formal progress reports at the 30-day and 90-day marks to prove that the default background scanning has ceased and that the new consent architecture meets the Garante's standards.[1][4]

As the 60-day compliance window begins, the immediate result for Android users in Italy will be a quieter Facebook application. The software will no longer proactively surface recent camera roll additions, requiring users to manually navigate to their galleries when they wish to share an update.[3]

The Garante has also signaled that its scrutiny of Meta's photo-handling practices is not over. The regulatory authority indicated that it may next examine a newer, cloud-based photo processing tool that the company recently introduced, ensuring it complies with the same strict consent requirements.[1][6]

Bypassing the Irish Regulator

During the investigation, which opened in 2025, Meta attempted to move the case out of Italy. The company argued that the Irish Data Protection Commission should hold primary jurisdiction over the matter under the European Union's established one-stop-shop mechanism for cross-border data disputes.[1][4]

The Italian regulator formally rejected that jurisdictional defense by invoking the ePrivacy Directive. Because the violation involved direct access to a user's physical terminal equipment—the smartphone itself—the Garante asserted that national authorities retain the power to act directly, bypassing the centralized Irish regulatory bottleneck.[1][4]

The Garante's legal strategy relied heavily on Article 5(3) of the ePrivacy Directive, commonly known as the "cookie law." This specific provision strictly governs the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber.[4]

Because Article 5(3) operates independently of the General Data Protection Regulation, it does not trigger the GDPR's cooperation and consistency mechanism. This legal nuance allowed the Italian authority to issue the €805 million penalty directly, establishing a roadmap for other national regulators to penalize device-level access violations.[4]

The ruling affects an estimated 20 million Italian Facebook users, but its legal precedent extends across the European Union. Italy's privacy watchdog has established itself as one of the most aggressive regulatory bodies in Europe, previously making headlines by temporarily banning OpenAI's ChatGPT in early 2023 over data collection practices.[4][7]

AI

The AI Training Question

The Garante explicitly noted that its 2025 investigation focused entirely on the unauthorized access to the device storage, not on what happened to the data afterward. The probe did not examine whether the accessed photographs and videos were ingested to train artificial intelligence models.[2][5]

Meta has formally denied using the gallery content accessed through this specific Android feature for any artificial intelligence training purposes. The €805 million penalty therefore punishes the access violation alone—the act of reading a person's camera roll without a separate, informed agreement.[2][5]

Meta has not yet issued a formal public response to the Garante's decision, and the company remains "not immediately available for comment," according to initial reports from Investing.com. Industry analysts expect the technology giant to appeal the ruling through the Italian court system.[1]

An appeal would likely focus on the Garante's interpretation of the ePrivacy Directive and its decision to bypass the Irish Data Protection Commission. However, Meta must still comply with the 60-day order to disable the default gallery scanning while any legal challenge proceeds.[1]

Shifting Mobile Architectures

The Meta decision highlights a growing regulatory intolerance for bundled mobile permissions. Historically, Android applications often asked for sweeping storage access upon installation, allowing them to read the entire file system to support various secondary features without prompting the user again.[3]

The technical root of the violation lies in how the Facebook application utilized Android's legacy external storage permissions. Once a user granted this broad access during their initial setup, the application retained the ability to index new media files without triggering any further system-level alerts.[4]

European regulators are now pushing developers toward a just-in-time consent model. Under this framework, an application should only request access to a user's photo gallery at the exact moment the user actively decides to upload an image, rather than maintaining continuous background access.[4]

AI

Modern mobile operating systems have attempted to deprecate this all-or-nothing approach. Recent Android updates introduced a dedicated photo picker that isolates specific images, but many legacy applications continue to rely on broad storage permissions to power background features like automated content suggestions.[4]

The ruling also underscores a divergence in how major mobile operating systems handle privacy. While recent versions of Apple's iOS allow users to grant applications access to only specific selected photos, Android's legacy permission architecture often forced users into a binary choice regarding their local storage.[4]

Financial and Industry Impact

The €805 million penalty represents approximately 0.47 percent of Meta's global revenue. While substantial, the figure falls short of the record €1.2 billion fine that Irish regulators levied against the company in May 2023 over transatlantic data transfers.[1][6]

While the fine ranks among the largest privacy penalties issued in Europe this year, it represents a fraction of Meta's financial capacity. The company routinely generates billions in quarterly profit, making the operational mandate to rebuild its consent architecture more impactful than the monetary loss.[1]

The enforcement action adds to a complex web of European regulatory challenges for the social media company. Meta is currently navigating separate disputes over its "pay or consent" advertising model, cross-border data transfers, and the deployment of artificial intelligence features across its messaging platforms.[3]

For the broader technology industry, the penalty serves as a costly warning about feature design. Developers building proactive tools that scan local device data to generate suggestions must now ensure those features are strictly opt-in, rather than enabled by default.[7]

The ultimate test of the Garante's enforcement will be how Meta implements the required changes by the mid-January 2027 deadline. Regulators across the European Union will be watching closely to see if the company's new consent prompts genuinely offer users a free and informed choice.[2][5]