Italy's data protection authority today fined Meta Platforms Ireland Limited 805 million euros, finding that the Facebook app for Android read photos, videos and their metadata from people's phones without specific consent and without telling them properly. The decision, announced in Rome by the Garante per la protezione dei dati personali, turns on a single feature that has been running since 2023. It comes with an order to switch that feature off by default for users in Italy within 60 days.

In Short

Italy's privacy regulator has fined Meta €805 million because the Facebook app on Android could read people's photo galleries for a "suggestions" feature without clearly asking them first. About 20 million Android users in Italy were affected, and the authority says the feature was switched on by default behind a vague permission prompt. Within 60 days Meta has to ask for a separate yes, keep the feature off for everyone who has not given it, and report back, or the feature cannot run for anyone without valid consent. The regulator also rejected Meta's argument that Ireland should handle the case, because the phone-privacy rule it applied does not send cases to a single lead authority.

A suggestions feature with a key to the whole archive

According to the Garante, the decision concerns a function labelled in Italian "Ottieni suggerimenti dalla galleria quando navighi su Facebook", which the authority's English version renders as "Get tips from your gallery while browsing Facebook". It has been available since 2023. While a person scrolls through Facebook, it surfaces photos and videos from the phone's gallery as ideas for something to post.

The description sounds modest. The access behind it was not. According to the release, an authorisation of the kind Facebook requested, "if fully granted," allows the app "to read the entire photo archive on the device, usually permanently, without the user or the Authority being able to verify what information is actually being used."

The authority's central finding is blunt. Through the Facebook app for Android devices, according to the Garante, Meta "accessed photos, videos, and related metadata stored on Italian users' smartphones without obtaining specific consent and without properly informing them."

Metadata carries as much weight in that sentence as the images do. Photo and video files typically record when they were taken and on which device, and depending on settings they can hold location coordinates. The release does not list which metadata fields the app read, or what happened to them afterwards.

Sixteen months from complaint to fine

The case began in July 2025 with a report from the Centro Tutela Consumatori Utenti di Bolzano, a consumer protection centre in the South Tyrol capital, according to the Garante. The authority did not rely on the complaint alone. It carried out its own technical analysis of the app, and the findings set out in the release come from that work.

From the July 2025 report to today's decision, the proceedings took about 16 months, by PPC Land's count. The release describes Meta's cooperation during that period as poor - "scarsa collaborazione" in the Italian text, rendered as "limited cooperation" in the English version - and counts it against the company when setting the amount.

How the permission flow worked, according to the Garante

The release reconstructs the route by which the feature reached the gallery. According to the Garante, it has five parts:

  1. One permission for everything. Facebook requests gallery access through a single authorisation that, according to the authority, is "valid for the entire app and for multiple functions with different need[s]." The same grant serves the gallery suggestions and every other part of the app that handles media.
  2. A generic notice first. Before the request appears, the app shows a notice inviting the user to "enable other features." According to the Garante, that wording "doesn't allow the user to understand that they are also authorizing gallery suggestions."
  3. The feature is on by default. The suggestions function "was set to be active by default," according to the release.
  4. Full access, usually permanent. Once the permission is fully granted, the app can read the device's entire photo archive, and neither the user nor the authority can check which items are actually used.
  5. Changes after the complaint. Meta modified the flow after the consumer group's report. The Garante counted those changes in Meta's favour but judged them late and limited to people who update the app.

The fifth point leaves a group of users exposed. According to the Italian text, the violation is still ongoing for anyone who has not updated the app and for anyone who has already granted the system permission. The English version mentions only the first group. Recent Android versions allow people to share selected photos instead of the full library; the authority's concern, as the phrase "if fully granted" indicates, is the complete grant.

Article 122 and the phone as private space

The rule Meta broke, according to the Garante, is Article 122 of the Italian Privacy Code, the provision that transposes the ePrivacy Directive into Italian law. It is the same provision that sits behind cookie consent in Italy, because it governs storing information on, and reading information from, a user's device.

The authority's reading of it is wide. According to the release, Article 122 "protects the smartphone as part of a person's private sphere. Any access to the information it contains therefore requires free and informed consent, regardless of data transmission or the existence of harm."

Two consequences follow from that wording. Whether the photos ever left the phone is not the test: reading them on the device is enough to require consent. Nor does the authority need to show that anyone suffered damage. For app developers who argue that local, on-device processing is lighter in privacy terms, the Garante's position is that the law is triggered at the moment of access.

Why Ireland was not an option

Meta Platforms Ireland Limited, the entity fined, is Meta's European headquarters in Dublin. Under the GDPR, cross-border cases against a company established in one member state usually run through a lead supervisory authority in that country, a system known as the one-stop shop. For Meta, that authority is Ireland's Data Protection Commission.

Meta asked the Garante to step aside in favour of the Irish authority. The Garante refused. According to the release, "the ePrivacy rules do not provide for the 'one-stop shop' mechanism." Under ePrivacy, each national authority enforces its own transposing law directly.

The distinction has already decided a case in Rome. On March 18, 2026, the Tribunale Ordinario di Roma annulled the Garante's 15 million euro fine against OpenAI, which had been imposed under the GDPR on November 2, 2024. The court held that the Irish Data Protection Commission had become OpenAI's lead authority on February 15, 2024, and it did not rule on the alleged violations. The Meta decision rests on a provision that, according to the Garante, falls outside that mechanism altogether.

France has used the same route. The CNIL fined Google 325 million euros on September 1, 2025 over ads placed between Gmail messages and cookies set without valid consent, relying on Article 82 of the French Data Protection Act, the French counterpart of Article 122, and on the French Electronic Communications Code.

The orders and the deadlines

The fine is only part of the decision. According to the Garante, Meta must change how the feature works in Italy within fixed periods. The release does not say when the clock starts; the dates in the final column assume the periods run from today and are PPC Land's calculation.

Obligation Deadline in the release Date if counted from November 14, 2026 (PPC Land calculation)
Tell the Garante what initiatives have been started 30 days December 14, 2026
Request consent through a separate, specific request for the feature, explaining what it is for, that it involves access to the gallery, and how to disable it 60 days January 13, 2027
Keep the feature turned off by default, including for people who have already granted the permission 60 days January 13, 2027
If the deadline passes without compliance, the feature cannot be activated for users who have not given valid consent After 60 days From January 13, 2027
Tell the Garante what measures have been adopted 90 days February 12, 2027

The wording of the second 60-day order differs slightly between the two language versions. The English text says the feature must stay off by default "even for those who have already given consent." The Italian text says "anche per chi ha già concesso l'autorizzazione" - even for those who have already granted the authorisation. The Italian version fits the logic of the decision more closely: in the Garante's view, tapping "allow" on an Android system prompt was never valid consent for this feature in the first place.

How the Garante set the amount

According to the release, the authority weighed four aggravating factors and one mitigating factor.

Factor Effect What the release says
Number of people involved Aggravating About 20 million Android users in Italy
Duration Aggravating Still ongoing for users who have not updated the app and, per the Italian text, for those who already granted the system permission
Prior decision Aggravating A previous 2019 measure against the company
Cooperation Aggravating Limited cooperation during the investigation
Changes made after the complaint Mitigating Judged late and limited to people who update the app

The fine equals about 0.47% of the group's worldwide turnover, according to the Garante. Working backwards, that implies a revenue base of roughly 171 billion euros, by PPC Land's calculation. The release does not say which financial year it used or at what exchange rate. For scale, Meta reported advertising revenue of $196.2 billion for 2025, when its fourth-quarter ad revenue alone reached $58.1 billion. Spread across the 20 million users the authority counted, the fine works out at about 40 euros per person, again by PPC Land's calculation.

The release does not identify the 2019 measure. In June 2019 the Garante fined Facebook 1 million euros in connection with the Cambridge Analytica affair, according to the authority's archive and Sky TG24's report at the time, but today's release does not confirm that this is the decision it means.

Measured against the Garante's other recent decisions, the amount sits in a different category. In March 2026 the authority fined Intesa Sanpaolo 31.8 million euros after one employee accessed 3,573 customers' accounts. In October it announced a 7 million euro fine against IQVIA over data on about one million patients that the company had treated as anonymous. The Meta fine is about 25 times the Intesa figure and 54 times the annulled OpenAI penalty, by PPC Land's calculation. It remains below the 1.2 billion euros the Irish Data Protection Commission imposed on Meta in May 2023 over transfers of European data to the United States.

What the case did not cover

Two questions sit outside the decision. The proceedings did not examine whether gallery content was used to train artificial intelligence, according to the Garante, and Meta denies that it was.

The second is a newer product. According to the release, the authority "reserves the right to evaluate separately the new feature, launched in 2026, that allows cloud processing of gallery content." The release does not name it. Meta announced an opt-in version of camera roll suggestions in October 2025 that uploads photos to Meta's cloud on an ongoing basis to produce AI edits and collages, launching first in the United States and Canada with tests in other countries to follow. Whether the 2026 feature the Garante refers to is the same product is not stated. If the authority applies the same reading of Article 122 to it, cloud processing would add a second step - transfer off the device - to an act of access that already requires consent on its own.

Why it matters for marketers and app developers

The decision lands in a crowded year for Meta in Europe. The company's quarterly filing in October said the Irish Data Protection Commission was still assessing its "subscription for no ads" consent model and that Meta had accrued significant amounts for loss contingencies tied to European inquiries. European consumer groups have argued that the consent-for-ads model still falls short of EU law. On Android specifically, Meta stopped a localhost-based method of linking web browsing to app identities in June 2025, after researchers disclosed the covert tracking technique.

The Garante's case reaches beyond Meta in three ways. The first is jurisdiction. Because the ePrivacy rules carry no one-stop shop, any national authority in the EU can act against any app that reads information from devices in its country, wherever the developer has its European base. The Rome court's OpenAI ruling showed how fragile GDPR fines can be when a non-lead authority acts; ePrivacy cases do not carry that particular weakness.

The second is permissions. Plenty of apps, including retail, social and photo-editing apps that feed advertising and personalisation systems, request broad media access once and use it for several features. The Garante has said that a single operating-system permission covering several functions, introduced by a generic notice, does not amount to specific consent for any one of them.

The third is defaults. A feature that reads stored content cannot start in the on position, according to the authority, and people who granted the system permission earlier have to be asked again. For software development kits and in-app features that touch device storage, that standard applies at the point of access, not at the point of upload.

What the release does not say

The release does not give the number of the underlying decision or link to its full text, does not name the legal provision used to set the amount, and does not say from which date the 30, 60 and 90-day periods run. It contains no response from Meta and does not mention whether the company intends to challenge the decision before the Italian courts, the route OpenAI took. It also does not describe the 2019 precedent or name the 2026 cloud feature.

Key facts

  • Authority: Garante per la protezione dei dati personali (Italian Data Protection Authority), Piazza Venezia 11, Rome
  • Source document: Press release "Facebook: il Garante Privacy sanziona Meta per 805 milioni di euro", with English version "The Garante has fined Meta Platforms Ireland Limited 805 million euros", Doc-Web 10321080, dated November 14, 2026 (Rome)
  • Source URL: https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10321080
  • Entity fined: Meta Platforms Ireland Limited
  • Amount: 805 million euros, about 0.47% of the group's worldwide turnover
  • Feature: "Ottieni suggerimenti dalla galleria quando navighi su Facebook" ("Get tips from your gallery while browsing Facebook"), Facebook app for Android, available since 2023
  • Provision violated: Article 122 of the Italian Privacy Code, transposing the ePrivacy Directive
  • Complainant: Centro Tutela Consumatori Utenti di Bolzano; investigation opened July 2025
  • Users affected: about 20 million Android users in Italy
  • Orders: report initiatives within 30 days; separate, specific consent and default-off within 60 days; report measures within 90 days
  • Jurisdiction: objection in favour of the Irish authority rejected; ePrivacy has no one-stop shop
  • Out of scope: AI training (Meta denies it); the 2026 cloud processing feature, to be assessed separately

Timeline

Summary

Who: The Garante per la protezione dei dati personali, Italy's data protection authority, and Meta Platforms Ireland Limited, which operates Facebook in the EU. The case was triggered by the Centro Tutela Consumatori Utenti di Bolzano and affects about 20 million Android users in Italy.

What: A fine of 805 million euros, about 0.47% of the group's worldwide turnover, for accessing photos, videos and metadata through the "Get tips from your gallery while browsing Facebook" feature without specific consent or adequate information, in breach of Article 122 of the Italian Privacy Code. Meta must request separate consent, keep the feature off by default and report to the authority within 30, 60 and 90 days.

When: The decision was announced today, November 14, 2026. The feature has been available since 2023, the investigation opened in July 2025, and the compliance periods run to early 2027.

Where: Italy, with the decision issued in Rome. The Garante rejected Meta's request to transfer the case to Ireland's Data Protection Commission.

Why: The Garante treats the smartphone as part of a person's private sphere, so reading anything stored on it requires free and informed consent whether or not data leaves the device and whether or not harm results. Because the ePrivacy rules have no one-stop shop, the authority could act directly against a company headquartered in Ireland, and it found that a bundled, app-wide permission introduced by a generic notice did not meet that standard.