Italy's privacy regulator fines Meta 805 million euros over Facebook photo access

The fine

Italy's data protection authority, the Garante per la protezione dei dati personali, has fined Meta 805 million euros over the Android version of the Facebook app. The authority's findings describe access to images and related data kept on Italian users' handsets, with no specific consent and no proper notice. The contested feature, 'Get suggestions from the gallery when you browse Facebook' in translation, has been available since 2023. While users browse, it proposes photos and videos from the phone's gallery as material to publish. The penalty is one of the highest the Italian authority has ever imposed, and about 20 million Android users in Italy are affected, according to La Stampa.

“the company accessed photographs, videos and related metadata stored on the smartphones of Italian users without obtaining specific consent and without adequately informing them.”

How the permission worked

The Garante found that the app requested gallery access through one permission covering the whole application and several functions with different purposes. That request came after a generic notice inviting users to 'enable other functions', which did not reveal that gallery suggestions were included. The feature was preset to active. Once the full permission was granted, the app could in principle read the entire photo archive on the device, generally on a permanent basis. Neither the user nor the authority could verify which information was actually used.

Legal basis and jurisdiction

The violated provision is Article 122 of the Privacy Code, which transposes the EU ePrivacy Directive and protects the smartphone as part of a person's private sphere. Under that rule, any access to information stored on the device requires free and informed consent, whether or not data is transmitted and whether or not harm follows. The authority rejected the company's objection that the Irish authority should handle the case, because the ePrivacy framework does not provide a one-stop-shop mechanism. The proceeding did not examine whether the content was used to train artificial intelligence, a use Meta denies. The probe was opened in July 2025 after a complaint from the Centro Tutela Consumatori Utenti di Bolzano and relied on a technical analysis carried out by the authority.

What happens next

Meta has 60 days to disable the function by default, according to Rai News. The dated steps reported so far run from the feature's launch in 2023 to the July 2025 complaint and the 14 November 2026 decision. The timeline below sets them out.