Italy fines Meta over Android gallery access

Overview

Updated 1 hour ago

Facebook's Android app could read a phone's entire photo gallery, and the feature that did it was switched on by default. On 14 November 2026, Italy's data protection authority fined Meta €805 million ($887 million) and gave the company 60 days to change how the feature asks for permission.

The penalty rests on a narrow legal point with wide reach. Italy applied its ePrivacy rules, which cover what is stored on a device, rather than the EU's General Data Protection Regulation. That distinction let Rome act alone instead of routing the case to Ireland, where Meta has its European headquarters.

Why it matters

If Italy's reading holds, any EU country can police what apps do on your phone without waiting for Ireland's regulator.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

$887M

Fine imposed on Meta

€805 million, the largest penalty the Italian regulator has ever issued.

0.47%

Share of Meta's global turnover

The regulator sized the fine against worldwide revenue, not Italian revenue.

20M

Italian Android users affected

The regulator's estimate of the exposed population.

60 days

Deadline to change the feature

Meta must disable the feature by default and add a separate consent request.

Voices

Curated perspectives — historical figures and your fellow readers.

Organizations Involved

Garante per la protezione dei dati personali

National data protection authority

Issued the fine and the compliance order

Italy's independent privacy regulator, which enforces both the GDPR and national ePrivacy rules.

Meta Platforms

Technology company

Appealing the decision

Owner of Facebook, Instagram and WhatsApp, and the target of the Italian penalty.

Centro Tutela Consumatori Utenti

Consumer advocacy group

Filed the original complaint

A consumer-protection center based in Bolzano, northern Italy, whose complaint started the case.

Timeline

2023 November 2026

4 events Latest: Today

Tap a bar to jump to that date

November 2026
Italy fines Meta €805 million
Today Legal

Garante orders the feature off by default and a separate consent request within 60 days.
Today
2026
Meta launches cloud processing for gallery content
Product

The regulator says it will assess the new feature in a separate proceeding.
2026
July 2025
Garante opens investigation after Bolzano complaint
Investigation

A consumer-protection center flags the feature; the regulator begins its own technical analysis.
July 2025
2023
Facebook adds gallery-suggestion feature on Android
Product

The feature proposes photos and videos from a phone's gallery as post ideas while a user browses.
2023

Scenarios

Meta switches the feature off by default in Italy

Likely Resolves by Jan 13, 2027

Discussed by: Garante's compliance order; Meta's public statement

The regulator gave Meta 60 days to disable the gallery-suggestion feature by default, including for users who already granted general photo access, and to build a separate consent prompt that explains what the feature does. Meta must also report its initial steps in 30 days and its completed measures in 90. If Meta meets the deadline, the feature stays available but only to users who opt in explicitly.

Italian court cuts or annuls the fine on appeal

Possible Resolves by Q2 2028

Discussed by: Meta, which said it will appeal and called the penalty disproportionate

Meta disputes both the facts and the legal basis, arguing the feature only works after a device-level permission and that Ireland should have handled the case. An Italian administrative court would review whether the ePrivacy rules apply as the Garante says and whether the fine was sized correctly. A ruling could take a year or more, and the penalty is roughly 0.47% of Meta's global revenue, so a reduction would still leave a substantial sum.

Garante opens a second case over cloud photo processing

Possible Resolves by End of 2027

Discussed by: Garante, which said it reserved the right to assess the 2026 feature separately

Meta launched a feature in 2026 that lets gallery content be processed in the cloud. The Garante explicitly carved that out of this decision and said it would examine it on its own. A new proceeding would test whether moving the processing off the device changes the legal analysis under the ePrivacy rules.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

March 2011

CNIL fines Google over Street View data collection (2011)

Google's Street View cars collected payload data from unencrypted home Wi-Fi networks across Europe. France's data protection authority, the CNIL, found the company had gathered personal content without informing users and fined it €100,000.

Then

Google was ordered to stop the collection and delete the data in France within a set period.

Now

The case established that data picked up incidentally from devices still requires a legal basis, a principle regulators have cited since.

Why this matters now

Both cases turn on data a company could read from a device or network without the user specifically agreeing to that use.

May 2023

Irish regulator fines Meta €1.2 billion over data transfers (2023)

Ireland's Data Protection Commission concluded that Meta's transfers of European user data to the United States lacked a valid legal basis after the EU's top court struck down the previous arrangement. The penalty was the largest GDPR fine issued to that point.

Then

Meta was given months to suspend the transfers and faced a compliance deadline.

Now

The decision pushed Brussels and Washington toward a new transatlantic data pact and showed fines could reach into the billions.

Why this matters now

It shows the scale European regulators now use against Meta, and why the company fights jurisdiction questions so hard.

March 2019

Garante fines Facebook over Cambridge Analytica (2019)

Italy's privacy regulator penalized Facebook for allowing third-party apps to harvest user data through the platform, part of the fallout from the Cambridge Analytica revelations.

Then

The fine was small relative to Meta's revenue but added to a stack of European enforcement actions.

Now

The Garante cited this record when sizing the 2026 penalty, treating repeat conduct as an aggravating factor.

Why this matters now

It is the prior enforcement action the regulator counted against Meta when setting the €805 million figure.