Ing. Pietro Maiorana
Italy's data protection authority, the Garante per la protezione dei dati personali, has fined Meta Platforms Ireland Limited 805 million euros. The decision, dated Rome, 14 November 2026, concerns the Facebook app for Android, which accessed photos, videos and metadata from Italian users' galleries without specific consent. Meta has 60 days to change the feature. The case matters because it sets out how permissions must be requested on a smartphone.
A few terms before we get into the facts. Metadata is the information that accompanies a photo, for example when it was taken or added to favourites. Article 122 of the Privacy Code is the rule that implements the European ePrivacy directive and requires free and informed consent to access data stored on a device. One-stop-shop is the mechanism that assigns a case to the authority of the country where the company has its European headquarters. Default setting refers to how a feature is presented before the user makes a choice.
What did the Garante decide about Facebook for Android?
According to the Garante, Meta used gallery content without specific consent and without adequately informing users. The feature is called "Get suggestions from your gallery when browsing Facebook", has been available since 2023, and proposes photos and videos from the phone as posting ideas.
The investigation started in July 2025 from a complaint by the Centro Tutela Consumatori Utenti of Bolzano and was based on a technical analysis by the Authority. Punto Informatico also reports the case.
Where was the permission problem?
The checks point to three issues.
- Access to the gallery was requested with a single authorisation, valid for the whole app and for several features with different needs.
- The authorisation was preceded by a generic notice, "enable other features", which did not make clear that it also covered gallery suggestions.
- The feature was preset as active.
A permission granted in full allows the app to read the entire photo library, usually permanently. Neither the user nor the Authority can verify which information is actually used.
Why is the fine 805 million euros?
The Garante considered around 20 million Android users in Italy and a violation still ongoing for those who have not updated the app or have already granted the permission. A 2019 decision and limited cooperation during the investigation also weighed heavily.
As mitigating factors it considered the changes introduced after the complaint, judged however late and limited to users who update the app. The amount equals about 0.47% of the group's worldwide turnover. For comparison, we also covered GM's 220 million dollar settlement over sold driving data.
What must Meta do within 60 days?
Meta must request consent through a separate and specific request, explaining what the feature is for, what it involves in terms of gallery access and how to turn it off. It must keep the feature disabled by default, including for those who have already granted the permission.
If the deadline passes without compliance, the feature cannot be activated for users who have not given valid consent. The company must report to the Garante the initiatives launched within 30 days and the measures adopted within 90 days.
The Authority rejected the objection of lack of competence in favour of the Irish authority, because the ePrivacy rules do not provide for the one-stop-shop mechanism.
Limits to know
The proceedings did not cover any use of the content to train artificial intelligence, which Meta denies. The Garante reserves separate checks on the new 2026 feature, which processes gallery content in the cloud. Punto Informatico notes that the equivalent feature in the iOS app is not mentioned. We do not know whether Meta will appeal.
What changes for people working in digital
If you build apps, the principle is clear. A single system permission covering several features is not enough as consent, a specific request with an understandable explanation is needed. A feature that reads phone data cannot start already switched on. If you manage a company app, review the texts shown before permission requests and the logic of default settings. Those who do marketing with user content, as in UGC creatives, need clear consent foundations. For custom apps, our iOS and Android app development also starts from these criteria.
Our take
The decision hits a point that designers know well. A vague notice in front of a broad permission is not information, it is a way of getting a yes. It is striking that the Garante does not require proven harm, unauthorised access is enough. Doubts remain about effectiveness, since the changes only apply to users who update the app. Whether the amount will really push a redesign of permissions we will see from the measures communicated. On data and platforms we have also written about data on Meta Quest headsets.
Frequently asked questions
How much must Meta pay?
805 million euros, about 0.47% of the group's worldwide turnover. The fine was decided by the Garante per la protezione dei dati personali in Rome on 14 November 2026.
Which users are affected?
Users of the Facebook app for Android in Italy, around 20 million according to the Garante. The violation is still ongoing for those who have not updated the app and for those who have already granted the permission.
What must change in the app?
The feature must be switched off by default and consent must be requested separately. Meta must also explain what it is for, what it involves in terms of gallery access and how to turn it off.
Did the Garante address AI training?
No, the proceedings did not cover it. Meta denies using the content to train artificial intelligence. The Garante may assess the 2026 cloud-based feature through separate checks.
Could Meta have referred the case to the Irish authority?
According to the Garante, no. It rejected the objection of lack of competence because the ePrivacy rules do not provide for the one-stop-shop mechanism.
The 30, 60 and 90 day deadlines will decide whether the fine changes the app
The decision sets precise timelines. In the coming months it will become clear whether Meta complies and whether the Garante opens the chapter on the cloud.
- Mark the 30, 60 and 90 day deadlines for Meta's communications to the Garante.
- Check the settings of Facebook for Android to see whether gallery suggestions are on, and turn them off if you do not want them.
- Follow any proceedings on the 2026 feature that processes content in the cloud.
