Italy's Data Protection Authority fined Meta €805 million ($887 million) on Saturday, November 14, 2026, after determining that Facebook accessed photographs and videos stored on Android smartphones without obtaining sufficiently informed consent. The regulator found that a feature suggesting images from users' phone galleries was enabled by default and relied on a general permission request that failed to explain its specific purpose. Meta has rejected the findings and announced plans to appeal.
The decision affects Meta Platforms Ireland Limited, the company responsible for Facebook services in the European market. Italian officials estimate that approximately 20 million Android users in the country could have been affected by the practice. The regulator has ordered Meta to disable the feature by default and introduce a separate consent process within 60 days.
Facebook Feature Accessed Personal Photo Galleries
The investigation focused on a Facebook feature called "Get suggestions from gallery when browsing Facebook," which has been available since 2023. It offers users suggestions for photos and videos they might want to share while browsing the social network. To provide those suggestions, the application accesses material stored in the phone's personal gallery.
Italian investigators found that Facebook requested gallery access through a single Android permission covering several different functions. Users were presented with a general explanation before granting access, rather than a clear request describing the gallery suggestion feature. The authority determined that this approach did not allow people to understand precisely what they were authorizing.
The regulator also objected to the feature being activated by default once the broader permission had been granted. Under its interpretation of the applicable privacy rules, users should make a separate, informed decision about whether they want Facebook to examine their gallery for posting suggestions. Permission to access photographs for one purpose does not automatically justify using them for another.
The investigation concerned photographs, videos and associated metadata stored on Android devices. Metadata can contain information about a file, including when it was created and other technical details. The authority's decision focused on unauthorized access rather than requiring proof that the material had been publicly shared or caused measurable harm.
Italian Privacy Law Requires Specific Consent
The Italian regulator based its decision on national legislation implementing the European Union's ePrivacy Directive. These rules recognize that information stored on personal devices deserves protection because smartphones can contain highly private details about their owners. Access generally requires freely given and informed consent unless a specific legal exception applies.
Officials argued that a broad device permission was insufficient because it did not explain the separate purposes for which Facebook would use personal gallery content. The distinction matters because granting an application permission to access photographs does not necessarily mean agreeing to every possible use of those files. The regulator said Facebook needed to make the gallery suggestion function understandable and optional.
The authority rejected Meta's argument that the matter should be handled by Ireland's privacy regulator. Meta had challenged Italy's jurisdiction, but Italian officials determined that the applicable ePrivacy rules did not use the same one-stop-shop arrangement that governs certain other European privacy investigations. The Italian authority therefore proceeded with its own enforcement decision.
The penalty is the largest imposed by Italy's data protection authority against Meta. Officials said the amount reflected the number of people potentially affected, the duration of the practice and the company's response during the investigation. They also considered an earlier enforcement action against Meta in 2019.
Meta Rejects Findings and Plans Appeal
Meta disputed the regulator's interpretation of how its Facebook feature operates. A company spokesperson said users must grant permission on their devices before the feature can function and can change that permission through their settings. Meta also described the penalty as disproportionate and confirmed that it intends to appeal.
The company's position emphasizes the permission users provide through Android's operating system. Italian authorities, however, determined that the operating system's permission did not replace the need for a separate explanation and consent request for Facebook's specific feature. That disagreement is central to the dispute.
Meta will have 60 days to change the feature so that it remains disabled unless users provide appropriate consent. The company must also clearly explain that the function accesses personal gallery content and show users how to turn it off. Those requirements apply even to users who previously approved the broader device permission.
The regulator separately instructed Meta to report the steps it takes toward compliance. The company must provide an initial update within 30 days and information about the measures adopted within 90 days. An appeal could challenge the decision, but no court has yet overturned the regulator's findings.
Investigation Did Not Establish AI Training Misuse
The Italian investigation did not determine whether Meta had used photographs or videos accessed through the feature to train artificial intelligence systems. The regulator explicitly separated that question from its findings about consent and access to smartphone galleries. Meta has denied using the material for AI training.
Officials also identified another Facebook feature introduced in 2026 that allows gallery content to be processed through cloud services. The authority said it reserved the right to examine that function through a separate investigation. Saturday's penalty did not establish that the newer cloud-processing feature violated the law.
These distinctions are important because accessing files, transferring them to a remote server and using them to train AI models are different activities. The Italian decision addresses the legal basis for the gallery suggestion feature's access to personal content. It should not be interpreted as a finding that every affected photograph was uploaded, published or incorporated into an AI system.
The estimated 20 million affected users also represents the scale identified by the regulator, rather than a verified count of people whose private images were improperly distributed. The ruling concerns the design of the permission process and the potential access it enabled. The outcome of Meta's appeal could determine how those legal requirements are applied in the future.
Meta Faces Other Major Privacy Penalties
The Italian fine comes amid broader legal scrutiny of Meta's data practices in the United States. On October 21, a New Mexico judge ordered the company to pay $25 billion after a jury found violations of the state's consumer protection laws. The dispute involved allegations that Meta misled users about its handling of personal information and platform practices.
That judgment followed a September jury verdict, rather than a September order imposing the final penalty. Meta has disputed the ruling and said it plans to appeal. The New Mexico case is legally separate from the Italian investigation and concerns different conduct.
Meta also reached a major settlement with U.S. states in August 2026 over allegations that Facebook and Instagram exposed young users to harmful or addictive platform features. The agreement provides for payments of up to $17.1 billion to participating states and includes requirements for stronger protections for teenagers. Meta denied the underlying allegations, and the maximum payment depends on conditions specified in the agreement.
Although these proceedings involve different legal issues, they show the range of regulatory challenges facing social media companies. Authorities are examining not only how platforms collect personal information but also whether users understand and control the functions that affect their privacy. The cases also demonstrate how enforcement can differ between European privacy rules and American consumer protection laws.
Facebook Must Change Its Consent Process
For Android users in Italy, the immediate effect of the ruling is a requirement for Facebook to provide clearer control over its gallery suggestion feature. The application must no longer treat approval of a general permission as sufficient consent for that separate function. Users must be able to understand what access involves before deciding whether to activate it.
The decision does not prohibit Facebook from offering photo and video suggestions altogether. Instead, it requires Meta to obtain valid consent and explain the feature's operation more clearly. Users who choose not to enable it should still be able to use Facebook without that optional gallery access.
Meta's appeal will determine whether the company can successfully challenge the regulator's interpretation or the size of the penalty. In the meantime, Italy's privacy authority expects compliance updates within the deadlines established in its November 14 decision. The dispute now centers on whether Facebook's existing Android permissions meet the legal standard for informed consent.