Italy's privacy regulator fines Meta €805 million over Android photo access

Italy's data protection authority, the Garante, announced Saturday, Nov. 14, that it has fined Meta Platforms €805 million ($887 million). The regulator says the Facebook app on Android phones accessed users' photos, videos and associated metadata without specific consent and without telling them.

It is the largest fine the Italian regulator has ever imposed. The authority put it at roughly 0.47% of Meta's global revenue.

What the Garante says Meta did

The case centers on a Facebook feature called "Get suggestions from gallery when browsing Facebook." It pulls photos and videos from a phone's gallery and offers them as ideas for posts.

Facebook asked for access to the gallery through a single, app-wide permission. The Garante says the notice shown before that request did not make clear the permission would also let Facebook generate suggestions from gallery content.

The regulator called the consent process too generic for users to understand what they were agreeing to. It also found the suggestions option was switched on by default.

The authority said the conduct violates the Italian law that implements the EU's ePrivacy directive. It estimated that about 20 million Italian Android users could have been affected.

Why the number is so large

The Garante listed several factors behind the size of the penalty:

• "The high number of people affected."
• The fact that the practice is "still ongoing for those who have not updated the app and for those who have already given their consent to the system."
• "Meta's lack of co-operation" with the investigation.
• An earlier violation that led to a 2019 fine against the company.

The investigation began in 2025.

What Meta must do

Meta has 60 days to disable the feature by default and to seek users' consent for it separately. The company also has the right to appeal the decision.

Meta had not publicly commented on the decision at the time of writing.

What the case does not cover

The proceedings did not address whether the photos and videos were used to train artificial intelligence models. Meta denies it does that, the Garante noted.

The regulator also reserved the right to assess separately a newer feature, launched in 2026, that lets content from users' galleries be processed in the cloud. That feature was not part of this fine.

The narrow complaint

The regulator's complaint is narrow: a permission prompt that did not say what the permission was for. This case is about a single feature on a single operating system.

That narrowness is the point of the Garante's case. A user who taps "allow" on a photo-access prompt is entitled to know what the app will do with the pictures. The regulator says Meta's prompt did not tell them. Meta has not yet said whether it disputes that finding, and its only stated position on the matter so far, per the Garante, is its denial of any AI training use.

What comes next

The 60-day clock is the first test. Meta must either change the Android app's default settings and consent flow within that window or challenge the order. An appeal would put the €805 million figure and the Garante's reading of the ePrivacy rules in front of a court.

The cloud-processing feature launched this year is the second. The Garante has said it may examine it separately, which leaves open whether a second proceeding follows.