Italy Fines Meta €805 Million Over Facebook's Android Gallery Suggestions
Italy's privacy regulator says Facebook's Android app read users' galleries behind a vague permission. Here is the setting it appears to mean, how to switch it off, and why €805 million is a fraction of the maximum.
Three words on a Facebook notice, "enable other features," helped cost Meta €805 million in Italy.
Italy's data protection authority, the Garante per la protezione dei dati personali, fined Meta Platforms Ireland Limited on Saturday, Nov. 14, after finding that Facebook for Android read photos, videos and their metadata on users' phones without specific consent. About 20 million Android users in Italy are involved, the regulator said.
The order covers Italy, but the app, the toggle and the phone permission behind it are the same elsewhere. And the Garante said it may separately examine a 2026 feature that processes gallery content in the cloud.
Its description of what Facebook's permission allowed is blunt.
"If fully granted, such authorisation allows the app to read the entire photo archive on the device, on an ongoing basis, without the user or the Authority being able to verify what information is actually being used."
Garante per la protezione dei dati personali, press release, Nov. 14, 2026
The feature is called "Get tips from your gallery while browsing Facebook" in the Garante's decision announcement. Available since 2023, it shows users photos and videos from their phone gallery as ideas to post.
The case began in July 2025 with a complaint from the Bolzano Consumer Protection Centre in South Tyrol, and the Garante said it rested on its own technical analysis of the app.
It found three problems. Gallery access is requested through a single permission covering the whole app and several functions. That request follows a generic notice, "enable other features" ("abilitare altre funzioni"), which does not tell users they are also authorising gallery suggestions. And the feature was on by default.
Put plainly, Facebook on Android asks once for photo access. A user who taps "allow" to share a holiday picture has also, without being told, let the app comb the gallery for posting ideas.
The legal hook is Article 122 of Italy's Privacy Code, which implements the EU's ePrivacy Directive and treats the phone as part of a person's private sphere. "Any access to the information it contains therefore requires free and informed consent, regardless of whether the data is transmitted or any harm occurs," the Garante wrote.
So Italy did not need to show that photos left the phone or that anyone was hurt.
The Garante added that the case did not concern training artificial intelligence on the content, which Meta denies doing.
Meta rejected the decision outright. "We strongly disagree with the Italian Data Protection Authority's assessment of the facts and its application of the law, and we believe the fine is disproportionate," a Meta spokesperson said, according to the Italian news agency LaPresse.
"Users must grant permission on their device before the feature can work, and they can change this permission at any time in their settings. We intend to appeal."
Meta spokesperson, via LaPresse
The two sides collide on one point. Meta's defence rests on the device permission; the Garante's finding is that this single app-wide permission is exactly what fails as consent.
Two features, one permission
Facebook has two camera-roll features, and only one of them was judged.
The fined one appears to be what the app calls "Camera roll sharing suggestions." The UK consumer group Which? quoted Facebook's description in October 2025: it uses "basic metadata (e.g. when photos were taken or which are favourited) to make sharing suggestions from your camera roll while you browse Facebook."
Meta has not publicly said which menu item matches the Italian feature name, but the description fits the Garante's.
The second feature is newer. On Oct. 17, 2025, Meta launched an opt-in tool in the US and Canada that "suggests the best photos and videos from your camera roll and creates fun collages and edits." MacRumors reported that it "scans your camera roll for your best photos and videos, uploads those images to the cloud" and then applies AI.
On April 16, 2026, the tool reached the EU and UK, according to Meta's own announcement, which said camera-roll media is not used for ad targeting.
The Garante did not name the cloud feature it may assess, but Meta's European launch fits the description.
Here the regulator's own logic bites. If reading a gallery on the phone required consent "regardless of whether the data is transmitted," a feature that, by MacRumors' account of the US version, uploads gallery images to the cloud is the obvious next test, though Meta can point out that this one is opt-in.
How to switch it off
The Italian order changes nothing for anyone outside Italy, but the controls are the same. Menu labels vary by app version and phone brand.
- In the Facebook app. Tap your profile picture or the menu, then Settings & Privacy > Settings, and switch off "Camera roll sharing suggestions," Which? advises (MacRumors finds it under Preferences). Meta says the AI suggestions are managed in the same camera roll settings.
- On Android. Open Settings > Apps > Facebook > Permissions > Photos and videos and choose "Don't allow," according to Which?. On Android 14 and later, apps built for that version can be limited to selected photos.
- On iPhone. Go to Settings > Privacy & Security > Photos > Facebook and select None, Which? says. The Italian decision concerns Android only.
Google's guide to Android's permission settings also describes a Permission manager, under Security & Privacy > Privacy, listing every app with photo access. (More on newer controls in our look at Android 17's privacy features.)
The trade-off: under "Don't allow," Google says, the app "cannot use the permission, even when you're using the app," so Facebook loses its broad view of your gallery. Android also offers a system photo picker that apps can use without that permission. The in-app toggle switches off only the suggestions.
Under an eighth of the ceiling
Meta's EU privacy cases normally go to Ireland's Data Protection Commission under the GDPR's "one-stop shop," which hands the lead to the regulator where a company has its European base.
Meta argued exactly that. The Garante rejected it, saying the ePrivacy rules behind Article 122 have no one-stop shop.
The same law sets the price. Article 166 of the Privacy Code sends Article 122 breaches to the GDPR's top tier, which allows fines of up to 4% of worldwide annual turnover.
The Garante put its fine at about 0.47% of Meta's global turnover, so Italy charged about 12% of the maximum, a little under one-eighth.
On Meta's 2025 revenue of $200.97 billion, the maximum would have been about $8 billion. Still, the €805 million (about $887 million at the AP and Reuters conversion) is by far the largest fine the Italian regulator has ever imposed, Al Jazeera reported.
The Garante weighed the number of people involved, a previous 2019 decision against the company and limited cooperation during the investigation. Its Italian text says the breach continues for people who have not updated the app and for those who already granted the permission.
It credited Meta's changes after the complaint, while calling them late and limited to users who update. The Garante has not said which 2019 decision it means; that year, it fined Facebook €1 million over Cambridge Analytica.
Set beside four other European penalties against Meta, the Italian fine ranks second:
| Date | Regulator | Amount | Over |
|---|---|---|---|
| May 22, 2023 | Ireland's Data Protection Commission | €1.2 billion | Transfers of EU users' data to the US (GDPR) |
| Nov. 14, 2026 | Italy's Garante | €805 million | Facebook Android gallery access (ePrivacy, Privacy Code art. 122) |
| Nov. 14, 2024 | European Commission | €797.72 million | Facebook Marketplace (EU antitrust) |
| Jan. 4, 2023 | Ireland's Data Protection Commission | €390 million (€210 million Facebook, €180 million Instagram) | Legal basis for processing (GDPR) |
| June 28, 2019 | Italy's Garante | €1 million | Cambridge Analytica |
The Italian fine caps a rough autumn for the company, which was also hit with a $25 billion judgment in New Mexico last month.
The order does not ban the feature. Within 60 days, Meta must ask for consent through a separate, specific request and keep the feature off by default, even for people who already said yes.
If Meta misses that deadline, the feature cannot be switched on for anyone who has not given valid consent.
Meta also owes the Garante reports at 30 and 90 days. Counted from the decision, the 60-day mark is Jan. 13, 2027, though the Garante has not said when its clock starts.
Italy has now priced a feature that looked at photos on the phone. The one Meta has offered Europeans since April appears to be the cloud-processing feature Rome has only said it may take a look at.
-1200x630.jpg)
