Practical fixes for the tech you already own. Free, a few times a week.
Italy’s data-protection authority, the Garante, on 14 November 2026 fined Meta Platforms Ireland Limited €805 million over a Facebook feature on Android phones that suggested photos from a user’s gallery.
In its decision published in Rome, the Authority said Meta accessed photos, videos, and related metadata stored on Italian users’ smartphones without obtaining specific consent and without properly informing them.
The Garante is Italy’s national data-protection regulator. The decision covers the Facebook app for Android devices and applies to users in Italy.
The investigation began in July 2025 after a report from the Centro Tutela Consumatori Utenti di Bolzano, the Bolzano Consumer Protection Center. The Authority then ran its own technical analysis.
How the gallery suggestions feature worked on Android
The feature has been available since 2023. In Italian it is called “Ottieni suggerimenti dalla galleria quando navighi su Facebook,” which translates as “Get suggestions from your gallery while browsing Facebook.”
While a person browses, it shows photos and videos from the phone gallery as suggestions to post.
Access to the gallery was requested through a single permission, valid for the entire app and for multiple functions at once.
That authorization was preceded by a generic notice about “abilitare altre funzioni,” or “enable other features.” The Garante said the wording does not make <a href="https://myappsplus.com/how-to-clear-the-cache-on-your-xbox-series-x/” title=”How to clear the cache on your Xbox Series X”>clear that the user is also authorizing gallery suggestions.
The feature was on by default.
When such an authorization is fully granted, the Authority said, the app can read the entire photo archive, usually permanently, with no way for the user or the regulator to verify what is actually used.
The Garante applied Article 122 of the Italian Privacy Code, which implements the European ePrivacy Directive. The rule treats the smartphone as part of a person’s private sphere.
Under that article, access requires free and informed consent. That holds regardless of whether data is transmitted, and regardless of whether any harm occurred.
On that reading, a broad permission covering the whole app does not stand in for consent to one specific function.
The procedure did not concern the possible use of the content to train artificial intelligence. Meta denies using the content for that purpose.
What Meta must change within 60 days
The remedies concern consent, information, and the default setting rather than withdrawal of the feature.
Within 60 days, Meta must request separate, specific consent for the feature from users in Italy.
The company must also state clearly what the feature is for, that it involves access to the gallery, and how to disable it.
The feature must stay off by default.
The default-off requirement also applies to people who had already granted the app-wide permission.
If the deadline passes without compliance, the feature cannot be activated for users who have not given valid consent.
Meta must tell the Garante about the steps taken within 30 days, and about the measures adopted within 90 days.
The 60-day window covers the consent request and the default setting. The reporting duties run on their own clocks of 30 and 90 days.
Separately from the order, Android users who want to act now can review the Facebook app’s photo permissions in their phone settings, and Android’s Privacy Dashboard shows which apps have been using sensitive permissions. Readers weighing a bigger step can look at our guide to leaving Meta’s apps behind.
The size of the fine, jurisdiction, and Meta’s response
The Garante set the penalty at €805 million, which it said is about 0.47 percent of the group’s worldwide turnover.
Scale weighed on the amount. The Authority counted roughly 20 million Android users in Italy.
It said the violation is still ongoing for people who have not updated the app and for those who already granted the authorization.
It also cited a 2019 precedent against the company and limited cooperation during the investigation.
As a mitigating factor, the Garante counted changes Meta made after the Bolzano report. It judged those changes late, and limited to people who update the app.
Meta had argued that the Irish regulator should handle the case. The Garante rejected that, saying ePrivacy rules do not provide for the one-stop-shop mechanism, so the case remained with the Italian Authority rather than the Irish regulator.
A Meta spokesperson told the BBC that the company planned to appeal.
“We strongly disagree with the [regulator’s] assessment of the facts, its application of the law, and the disproportionate level of the fine,” the spokesperson said.
Meta also told the BBC: “This is a straightforward feature which helps people post photos and videos to Facebook. People must give permission on their device before it can operate, and they can change this permission at any time
The BBC put the fine at about £670 million and $887 million, and called it among the largest an Italian authority has ever imposed on a tech giant.
One item sits outside the decision. The Garante said it reserves the right to evaluate separately a new feature, launched in 2026, that allows cloud processing of gallery content.
That feature was not part of the proceeding that produced the €805 million fine. Meta’s report on the measures adopted for the gallery suggestions feature is due within 90 days.
Enjoyed this?
Get the next one by email. A few times a week, no fluff.
