Meta fined €805M by Italy's privacy watchdog over photos

Italy’s data protection authority, the Garante per la protezione dei dati personali, has fined Meta Platforms Ireland Limited 805 million euros: the fine concerns the Facebook app for Android, which allegedly accessed photos, videos and metadata on the smartphones of Italian users without specific consent.¹² Within 60 days the feature must be disabled by default. Meta responded that it strongly disagrees and intends to appeal.³² The measure is dated 14 November 2026.²

Which feature is under scrutiny

It is called ‘Get suggestions from your gallery when browsing Facebook’ and has been available since 2023. While the user browses the social network, the app shows them images and videos stored on the phone, presenting them as ideas for a new post.⁴² The proceedings began in July 2025 after a complaint from the Centro Tutela Consumatori Utenti di Bolzano. The Authority also carried out its own technical check.⁵²

What the Garante is challenging

To access the gallery, the app asks for a single permission, which applies to the entire application and covers features with different needs. First a vague message appears, referring to ‘enabling other features’, without making clear that it also opens the door to suggestions. Moreover, the feature was already active from the start.⁵² According to the Garante, granting that permission without limits would allow the app to scroll through the phone’s entire image collection, generally with no expiry. Neither the user nor the Authority can check which data are actually used.² The provision cited is Article 122 of the Privacy Code, which transposes the European ePrivacy Directive. Under this provision, the smartphone is part of a person’s private sphere, so any access to what it contains requires free and informed consent, even if the data are not transmitted and even if no harm occurs.⁶²

Metadata and specific consent: where the difference lies

The contested access concerns not only images. It also covers metadata, that is, the information associated with files: Punto Informatico cites, for example, the moment a photo was taken and when it was added to favourites.⁶² Meta argues that users must grant permission on the device before the feature operates and can change it at any time from the settings. For the Garante, however, a single generic permission is not equivalent to specific consent for gallery suggestions.³⁷²

What Meta must do

Within 60 days the company must propose a separate consent request, dedicated solely to this feature, explaining its purpose, the fact that it involves access to the camera roll, and how to switch it off. The default setting must be ‘off’, including for those who had already given the general permission.⁵² If Meta does not comply by the deadline, the feature may not be switched on for anyone who has not given valid consent. The company must also inform the Garante of the initiatives launched within 30 days and of the measures adopted within 90 days.²

How the fine was calculated

The amount corresponds to about 0.47% of the group’s worldwide turnover. Factors considered include the size of the audience, estimated at around 20 million Android users in Italy, and a violation that continues for those who have not installed the update or had already authorised the system.⁸² A previous 2019 measure against the company and its limited cooperation during the investigation also weighed in. The changes Meta introduced after the report were treated as mitigating factors but judged late and limited to those who update the app.⁵²

The jurisdiction issue and artificial intelligence

Meta had requested that the matter be transferred to the Irish regulator, where its European base is located. The Garante turned down that objection, since the ePrivacy framework lacks the ‘one-stop-shop’ system, a mechanism that does apply under the GDPR.⁷² The proceedings did not concern any possible use of photos and videos to train artificial intelligence models, a circumstance Meta denies. The Garante reserves the right to examine later, through separate checks, the feature introduced in 2026 that allows gallery material to be processed in the cloud.⁵²

What changes

The case shows that, for the Garante, a permission granted on the phone is not enough if it covers many functions and comes after a generic notice. According to the Authority, consent must relate to the individual feature and its purpose.³² The Garante also keeps open the question of the cloud processing feature launched in 2026, on which it could open a separate file.⁶²

This article was written by artificial intelligence from the sources cited, without human review. Automatic newsroom by Redazia.

Sources

Footnotes

1. Uso di foto senza consenso, il Garante sanziona Facebook per 805 milioni di euro, agi.it, 2026-11-14 ↩

2. Facebook: il Garante Privacy sanziona Meta per 805 milioni di euro - Garante Privacy, garanteprivacy.it ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰ ↩¹¹ ↩¹² ↩¹³ ↩¹⁴ ↩¹⁵ ↩¹⁶ ↩¹⁷ ↩¹⁸

3. Garante privacy: 805 milioni di multa a Meta per l’uso di foto su Facebook senza consenso, Sky TG24 ↩ ↩² ↩³

4. Meta multata per 805 milioni: Facebook accede alle foto degli smartphone senza consenso, Euronews · Italiano, 2026-11-14 ↩

5. Maxi multa da 805 milioni a Meta dal Garante della Privacy: così Facebook accedeva alle foto degli utenti Android senza consenso, Open, 2026-11-14 ↩ ↩² ↩³ ↩⁴ ↩⁵

6. Accesso a foto e video senza consenso, multa di 805 milioni a Meta, Punto Informatico, 2026-11-14 ↩ ↩² ↩³

7. Meta multata per 805 milioni di euro dal Garante Privacy: Facebook accedeva alle foto degli smartphone senza consenso specifico, Hardware Upgrade | il sito italiano sulla tecnologia, 2026-11-14 ↩ ↩²

8. Italia multa a Meta con 805 millones de euros por acceder sin permiso a fotos de usuarios, La Vanguardia, 2026-11-14 ↩