Italy’s data protection authority has fined Meta Platforms Ireland €805 million ($887 million) over a Facebook feature that accessed photos, videos and metadata stored on Android phones without specific consent or adequate notice.
The Garante announced the penalty on November 14 and ordered Meta to change how the feature works within 60 days. The decision covers “Get suggestions from your gallery when browsing Facebook,” a feature available since 2023 that surfaces items from a user’s phone as possible Facebook posts.
About 20 million Android users in Italy were potentially affected. Meta plans to appeal and told The Guardian that it strongly disagrees with both the regulator’s assessment and the size of the fine.
What Italy’s regulator found
The case is about more than whether Facebook displayed private photos publicly. The regulator focused on how the app obtained access in the first place.
According to the Garante’s technical investigation, Facebook used one gallery permission for several app functions with different purposes. A generic prompt to “enable other features” did not make clear that the same approval would also power gallery suggestions. The feature was also enabled by default.
Once the broad permission was granted, the app could read the phone’s full photo archive on an ongoing basis, the authority found. Neither users nor the regulator could verify which files and metadata the feature actually used.
That distinction shaped the decision. Article 122 of Italy’s Privacy Code implements the European ePrivacy rules protecting information stored on a person’s device. In the regulator’s reading, access requires free and informed consent even if the information is not transmitted elsewhere and no separate harm is proven.
Meta argued that Ireland’s privacy authority should have jurisdiction because Meta Platforms Ireland operates Facebook in Europe. The Italian regulator rejected that objection, saying the ePrivacy framework does not use the GDPR’s one-stop-shop system.
What Meta must change within 60 days
The order requires Meta to separate gallery suggestions from other Facebook permissions and controls. Within 60 days, the company must:
- Ask for consent through a request specific to gallery suggestions.
- Explain what the feature does, that it accesses the phone’s gallery and how to disable it.
- Keep the feature off by default, including for people who previously granted the broader permission.
- Prevent activation for users who have not supplied valid consent if Meta misses the deadline.
Meta must tell the regulator within 30 days what work it has started and report the measures implemented within 90 days.
The €805 million penalty equals roughly 0.47% of Meta’s global annual revenue. The Garante cited the number of users, the length of the conduct, a 2019 decision involving the company and what it described as limited cooperation during the investigation. It also credited post-complaint changes as a mitigating factor, but considered them late and limited to users who updated the app.
The ruling does not decide the AI training question
The order applies to the gallery-suggestion feature that has existed since 2023. It does not establish that Meta used private camera-roll media to train AI models. The regulator explicitly said that issue was outside this investigation, and Meta denies doing so.
The Garante also separated the older feature from a newer, cloud-based camera-roll tool launched in 2026. Meta describes that newer feature as opt-in and says camera-roll suggestions remain private unless a user chooses to share them. In its April rollout announcement, Meta said users can disable it through Facebook’s camera-roll settings and that photos are not used to improve Meta AI unless a user publishes them or shares them with an AI feature. Italy’s authority reserved the right to examine the cloud-processing feature separately.
What Android users should check now
The Italian order applies directly to Meta’s treatment of users in Italy, but the permission review is useful anywhere Facebook is installed on Android.
- Check Facebook’s in-app camera-roll setting. In Facebook settings, search for “camera roll” and review any sharing suggestions, cloud processing or creative-suggestion options. Menu names can vary by app version and country.
- Review the Android permission. Open Settings > Apps > Facebook > Permissions > Photos and videos. Google’s Android permission guide explains how to allow or deny access. Some Android versions also offer access to selected photos only.
- Use the narrowest access that fits. Denying gallery access can affect uploads and other Facebook media features. Selected-photo access, where available, reduces the amount the app can see while still allowing individual uploads.
- Read the next prompt carefully. A system permission and consent to a particular Facebook feature are not the same decision. The Italian case turned on the app bundling several purposes behind one broad authorization.
- Update Facebook. The regulator said Meta had made changes after the complaint, but those changes were limited to people running an updated app.
Why the order matters beyond Facebook
The decision targets a common mobile design pattern: an app asks for a powerful device permission, then uses that access across multiple convenience features. Italy’s regulator treated a broad Android permission as insufficient when the product purpose was not disclosed clearly and separately.
That creates a practical compliance test for any app that mines a camera roll, contact list or other on-device store for recommendations. An operating-system permission may make access technically possible, but it does not automatically provide informed consent for every feature built on top of that access.
