Pierluigi Paganini
November 15, 2026
Italy’s data protection authority, the Garante, has fined Meta Platforms Ireland Limited €805 million. The reason is that the Facebook app for Android reached into photos, videos, and their metadata on Italian users’ phones without specific consent and without telling people properly what was happening.
“The Italian Data Protection Authority (Garante) has fined Meta Platforms Ireland Limited €805 million. Through the Facebook app for Android devices, the company accessed photos, videos, and related metadata stored on Italian users’ smartphones without obtaining specific consent and without properly informing them.” reads the Garante’s announcement.
“The measure concerns the ‘Get tips from your gallery while browsing Facebook’ feature, available since 2023, which, while browsing, shows users photos and videos from their phone gallery as suggestions to post.”
The feature at the center of the case suggests photos and videos from users’ phone gallery as things to post while they scroll Facebook. It has been available since 2023. The Garante opened its investigation in July 2025, after a complaint from the Bolzano Consumer Protection Centre, and backed it with its own technical analysis.
The analysis found three main problems. Facebook used a single permission to access the phone’s photo gallery for several different purposes. The notice shown to users was unclear and did not explain that granting permission would also enable photo suggestions. On top of that, the feature was enabled by default.
This is important because, once users grant full access, the app can continuously read all the photos and videos stored on their devices. Neither users nor the Garante can see exactly which data the app accesses or uses.
“The checks revealed that:
Meta told Reuters users must grant device-level permission to enable the feature and can revoke it at any time through their settings.
“This is a simple feature that helps people share photos and videos on Facebook. Users must grant permission on their device before the feature can operate, and they can change that permission at any time in their settings,” the company spokesperson said in a statement
The Garante pointed to Article 122 of Italy’s Privacy Code, which carries the EU’s ePrivacy Directive into Italian law. That rule treats the smartphone as part of a person’s private sphere, so any access to what’s on it needs free and informed consent.
Meta argued that the Irish authority should have handled the case. The Garante said no, since the ePrivacy rules don’t include the one-stop-shop mechanism. The case also doesn’t cover whether Meta used any content to train artificial intelligence, which the company denies. The Garante did keep the option open to look separately at a new feature launched in 2026 that processes gallery content in the cloud.
Meta now has 60 days to fix things. It has to ask for consent through a separate, specific request, and explain what the feature does, that it involves gallery access, and how to turn it off. It also has to keep the feature off by default, even for people who already said yes. If Meta misses the deadline, it can’t activate the feature for anyone without valid consent.
The company also owes the Garante two reports. One is due within 30 days, on what it has started doing, and another within 90 days, on the measures it has adopted.
Several factors led to the high fine. Around 20 million Android users in Italy were affected, and the violation is still ongoing for users who have not updated the app. Meta had also been fined by the Garante in 2019 and provided only limited cooperation during the investigation.
One factor worked in Meta’s favor: the company changed the feature after the complaint. However, the Garante said these changes came too late and only applied to users who updated the app.
The fine represents about 0.47% of Meta’s global revenue. It is unlikely to cause serious financial problems for the company, but it may help give users more control over their photo privacy.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Meta)
