Italy’s data protection authority, the Garante per la protezione dei dati personali, announced on November 14, 2026, that it has fined Meta €805 million. According to the authority, the Facebook app for Android accessed photos and videos stored on Italian users’ phones, along with their metadata. Metadata is the information attached to each file, such as the date a photo was taken. The Garante says users had not given specific consent and had not been properly informed.
The fine is imposed on Meta Platforms Ireland Limited, Meta’s subsidiary in Ireland. Meta disputes the decision and says it will appeal. A spokesperson quoted by the Italian news site Open said the company “strongly disagrees” with the Garante’s assessment and considers the amount “disproportionate” (our translation).
The Garante also threw out a procedural argument. Meta wanted the case sent to the data protection authority in Ireland, where its subsidiary is based. Meta faces a separate case in Britain, where the competition watchdog opened an investigation into Meta’s business terms on October 30. That case falls under competition law.
A photo suggestion feature and a consumer complaint
The decision covers a Facebook feature available since 2023. As users scroll through Facebook, it suggests photos and videos from their phone’s gallery as ideas for posts. In Italian, the feature is called “Ottieni suggerimenti dalla galleria quando navighi su Facebook,” roughly “get suggestions from your gallery while you browse Facebook” (our translation).
The investigation began in July 2025, after a complaint from the Centro Tutela Consumatori Utenti, a consumer group in Bolzano, in northern Italy. For its findings, the Garante relied on its own technical analysis.
One permission for the whole app
The Garante’s press release sets out three findings. First, Facebook asks for gallery access through a single permission. That one permission covers the whole app and several features with different needs.
Second, the request comes after a generic message, “enable other features” (“abilitare altre funzioni” in Italian). According to the Garante, that message does not make clear to users that they are also turning on suggestions drawn from their gallery. Third, the feature was switched on by default.
Once this kind of permission is granted in full, the app can read the phone’s entire gallery, the authority says. As a rule, that access is permanent. Neither the user nor the Garante can then check which information the app actually uses.
The law at issue and the dispute over jurisdiction
The decision applies Article 122 of the Codice privacy, Italy’s personal data protection code. That article implements the EU’s ePrivacy Directive in Italian law. The directive, adopted in 2002 and amended in 2009, sets the rules for accessing information stored on a user’s device, such as a phone. According to the Garante, Article 122 protects the phone as part of a person’s private sphere.
As a result, the authority says, any access to information on a phone requires the user’s free and informed consent. That holds whether or not the data leaves the device, and whether or not anyone is harmed.
The Garante also rejected Meta’s argument that the Garante lacked jurisdiction. The General Data Protection Regulation (GDPR), the EU’s main data protection law, has a system called the “one-stop shop.” Under it, a company operating in several EU countries deals mainly with one regulator, in the country of its main establishment, meaning its main base in the EU.
WhatsApp, another Meta service, says in its European privacy policy that its lead authority under the GDPR is the Irish Data Protection Commission. We noted this when reporting on the hidden instructions WhatsApp gave its support chatbot. The Garante answered that the ePrivacy rules, which govern this case, have no one-stop shop.
Sixty days to change the feature
The Garante is giving Meta 60 days to ask for separate, specific consent for this feature. That consent request must explain what the feature is for, state that it accesses the gallery and show how to turn it off. The feature must also be switched off by default, including for people who have already granted gallery access.
If Meta misses that deadline, the feature cannot be turned on for users who have not given valid consent. Meta must also report to the Garante twice: within 30 days on the steps it has started, and within 90 days on the measures it has put in place. The press release does not say when these deadlines start running.
How the Garante set the amount
To set the fine, the Garante first points to the number of people affected: about 20 million Android users in Italy. It also weighs how long the violation has lasted. In the Garante’s view, the violation is still going on for people who have not updated the app and for those who already granted the Android system permission.
The Garante also cites a 2019 decision that had already targeted the company, as well as what it calls Meta’s “limited cooperation” during the investigation (our translation). Changes Meta made after the complaint counted in its favor, although the authority found them late and limited to users who update the app.
According to the Garante, the fine equals about 0.47% of Meta’s worldwide revenue. In dollars, the Associated Press (AP) puts it at about $887 million.
For comparison, France’s data protection authority, the CNIL, fined two Google companies a combined €325 million on September 1, 2025. The Italian fine is about two and a half times that total. The French fines covered two issues: ads inserted into the Gmail inbox, and cookies. Like the Italian case, they rested on the ePrivacy rules.
Meta’s response and the limits of the case
Meta defends what it calls “a simple feature that helps people post photos and videos on Facebook,” according to the spokesperson’s statement published by Open. “Users must grant a permission on their device before the feature can work, and they can change that permission at any time in their settings,” the spokesperson added. “We intend to appeal,” the spokesperson concluded (our translation). The AP reported that Meta had not commented by the time it filed its story.
The dispute centers on the permission users grant on their phones. Meta points to that permission, which it says users can change at any time. In the Garante’s view, a single permission that covers the whole app, introduced by a vague message, falls short of the specific consent the law requires.
The Garante itself set out what the case does not cover. The proceeding did not examine whether the gallery content could have been used to train artificial intelligence. According to the Garante, Meta denies any such use. The Garante also reserves the right to separately review a new feature, launched in 2026, that processes gallery content on remote servers.
The press release does not link to the full text of the decision or say when the decision was adopted. It also says nothing about other EU countries or the iPhone.
What it means
The Italian decision rests on two legal points that reach beyond Facebook. The first concerns consent: in the Garante’s view, a single Android permission granted for the whole app is not enough when a specific feature reads what is on the phone. For this feature, it requires its own, separate consent. The Garante’s reasoning covers any app that accesses information stored on a device.
The second is about jurisdiction, meaning which authority can impose a penalty. The GDPR’s one-stop shop does not apply to the ePrivacy rules. According to the Garante, a national authority can therefore fine a platform based in Ireland directly, without going through the Irish regulator. The CNIL in France reached the same conclusion before it.
In France, the same EU rule is written into Article 82 of the French data protection law, the loi Informatique et Libertés, which the CNIL enforces. The CNIL’s restricted committee, the body that issues its penalties, set out its position in a decision dated December 31, 2021. On the ePrivacy Directive, it wrote: “le mécanisme de guichet unique prévu par le RGPD ne peut être appliqué aux traitements visés par la directive” (the GDPR’s one-stop-shop mechanism cannot be applied to processing covered by the directive). The CNIL said so again in September 2025 when it fined Google.
The case also turns on default settings: the Garante faults Meta for switching the feature on by default. On November 11, the European Commission proposed the Digital Fairness Act. That proposal also targets defaults that customers have to undo, but from a consumer protection angle. It is still only a proposal.
The technical findings come from the Garante, and Meta disputes them. The press release does not include the full decision. How far the case reaches will depend on the appeal. Its date and the court that will hear it are not known yet.
Several deadlines come next. Meta has 30 days to report to the Garante on the steps it has started, and 60 days to change the feature. It is not yet known whether the company will also change the feature outside Italy. It is also unknown whether the Garante will open its separate review of the 2026 feature that processes gallery content on remote servers.
Sources
- Facebook: il Garante privacy sanziona Meta per 805 milioni di euro, Garante per la protezione dei dati personali, press release, November 14, 2026
- Meta, maxi multa da 805 milioni dal Garante Privacy: le foto Android usate senza consenso. L’azienda annuncia il ricorso, Open (Cecilia Dardana), November 14, 2026
- Meta fined $887M in Italy over Android gallery photos, videos on Facebook, Associated Press, via ABC News, November 14, 2026
- Publicités insérées entre les courriels et cookies : la CNIL sanctionne GOOGLE d’une amende de 325 millions d’euros, CNIL, September 3, 2025
- Délibération SAN-2021-023 du 31 décembre 2021, CNIL restricted committee, Légifrance, December 31, 2021
Header image: MACCUS diagram. Data: press release, Garante per la protezione dei dati personali, November 14, 2026
