Italy’s data protection authority fined Meta Platforms Ireland €805m, about 0.47% of the group’s global revenue, for reading Android users’ photos without specific consent, it said on Saturday.
The Garante, as the authority is known, also ordered Meta to ask for consent afresh and to switch the feature off by default within 60 days. The decision is dated 14 November 2026.
The regulator said the company, through the Facebook app for Android, accessed photos, videos and related metadata on Italian users’ phones “without obtaining specific consent and without properly informing them”.
The measure concerns a gallery-suggestions feature in the Facebook app, available since 2023. It shows users pictures and videos from their phone gallery as suggestions to post.
The Garante said access to the gallery was requested through a single permission covering the whole app and several functions with different purposes. That permission was preceded by a generic notice, “enable other features”, which did not let users see they were also authorising gallery suggestions. The feature was also enabled by default.
The authority said a fully granted permission of this kind lets the app read the whole photo archive on the device on an ongoing basis. Neither the user nor the authority can then verify which information is actually used.
The provision breached is Article 122 of the Italian Privacy Code, which implements the European ePrivacy Directive.
The Garante said it treats the smartphone as part of a person’s private sphere, so any access to its contents needs free and informed consent, whether or not the data is transmitted or any harm occurs.
Meta had argued that the Irish authority had jurisdiction. The Garante rejected that, saying the ePrivacy rules do not provide for the “one-stop-shop” mechanism.
Within 60 days Meta must request consent through a separate, specific prompt that explains what the feature is for, that it involves gallery access and how to disable it.
It must also keep the feature off by default, including for users who have already given permission.
If the deadline passes without compliance, the feature cannot be activated for users who have not given valid consent. Meta must tell the Garante within 30 days what it has started and within 90 days what measures it has adopted.
In setting the amount, the Garante cited around 20 million Android users in Italy and an infringement it said is still ongoing for those who have not updated the app.
It also cited a previous 2019 decision against the company and limited cooperation during the investigation.
It treated as mitigating the changes Meta made after the complaint, though it judged them late and limited to users who update the app.
The investigation began in July 2025 after a complaint from the Bolzano Consumer Protection Centre and relied on a technical analysis by the authority itself.
The decision does not cover whether content was used to train artificial intelligence, which Meta denies. The Garante said it reserves the right to assess separately a new feature launched in 2026 that allows cloud processing of gallery content.
