Diwali Sale is live — Enjoy up to 60% off →

Italy fines Meta €805 million over Facebook's default-on access to Android photo galleries

Italy's privacy regulator says a single vague permission prompt gave the Facebook app standing access to the photos, videos and metadata of about 20 million Italian Android users.

14 November 2026 • 8 min read

Italy fines Meta €805 million over Facebook's default-on access to Android photo galleries

Italy announced an €805 million ($887 million) fine against Meta on Saturday for using photos and videos from Android users' galleries on Facebook without specific consent or adequate disclosure.

Nobody hacked anything and no database leaked.

Italy's privacy regulator, the Garante per la protezione dei dati personali, objected to a design choice in a single permission screen: one broad "yes" on an Android phone gave the Facebook app standing access to everything in the gallery. Many people have tapped the same kind of prompt without thinking about it, which is why the mechanism deserves more attention than the sum.

What the Garante actually found

A Facebook feature called "Get suggestions from gallery when browsing Facebook" is at the centre of the case. Available since 2023, it suggests photos and videos from the user's phone gallery as things to post while they browse. According to the regulator, the company used it to reach photographs, videos and related metadata stored on Italian users' smartphones without obtaining consent and without adequately informing them.

How permission was asked for is the core objection. According to the Garante, the app used one permission for the entire app and multiple functions, showed a generic notice about enabling other features before requesting permission, and had gallery suggestions turned on by default. Italian outlet Virgilio, citing ANSA, described the prompt as a single go-ahead to the gallery, valid for the whole app, preceded by a generic notice about the possibility to "enable other functions" (our translation).

That is why the case reaches past Italy's 20 million affected Android users. A user who allowed gallery access so they could upload one profile picture may also have given a recommendation engine ongoing access to their whole camera roll, including the photo of a passport taken for a visa application or the screenshot of a crypto wallet's recovery phrase. Metadata adds timestamps and often location on top.

According to the regulator, the problem has not gone away. It found the violation still ongoing for those who have not updated the app and for those who have already granted the authorisation (our translation). Meta got some credit for changes it made after the complaint, but the regulator called them late and limited to users who update the app. To set the amount, the Garante weighed the number of people affected, how long the breach lasted, an earlier order against the company and Meta's "lack of cooperation" with the investigation. That earlier order dates from 2019, when the same Garante fined Facebook €1 million in the Cambridge Analytica case. The new penalty is by far the largest fine ever imposed by the Italian regulator, Al Jazeera reported. For Meta it is equivalent to about 0.47% of the group's global revenue.

Beyond the fine, the decision orders Meta to change the product. Meta has 60 days to make the feature "turned off by default" and to add "a separate and specific request for the feature and clearly explain to users what it is for, that it involves access to the gallery, and how to disable it." According to Italian news site Open, Meta also has 30 days to report the initiatives it has started and 90 days to account for the measures taken (our translation). Tech site Think.it reports that the default-off rule also covers users who had already given consent.

Meta says it will fight the decision. A spokesperson told Reuters the company would appeal and called the fine "disproportionate", adding: "This is a simple feature that helps people share photos and videos on Facebook." The company also said users must grant permission on their device before the feature can operate, and can change that permission at any time in their settings.

That device permission is the very step the Garante says fell short of valid consent.

Why Italy, not Dublin

Meta's EU operations sit in Ireland, and the company argued that Ireland's Data Protection Commission, its lead EU privacy regulator, should handle the case. The Garante rejected that objection. It ruled under Article 122 of Italy's privacy code, which implements the EU ePrivacy directive. That directive, the regulator told AP, protects smartphones as part of a person's private sphere and requires "free and informed consent" for such access. Under the GDPR's "one-stop shop", cross-border cases usually go to the regulator in the country where a company has its EU base. As PPC Land's summary of the decision puts it, ePrivacy has no such mechanism. The same summary notes that on March 18, 2026, Rome's ordinary court annulled the Garante's 15 million euro OpenAI fine on one-stop-shop grounds. My reading is that the Garante picked a legal route the Irish lead-authority argument cannot easily block. If the ruling survives appeal, any national regulator in the EU could use the same law against an app that reaches into phones in its country.

Two questions remain open. The investigation, which began in 2025, did not cover the possible use of the content to train artificial intelligence models, a practice Meta denied, the authority said. The Garante also reserved the right to assess separately a new feature, launched in 2026, that allows content from users' galleries to be processed in the cloud.

What to check on your phone

This ruling only covers Italy, and the Garante's release deals only with the Facebook app on Android. The in-app controls are not new, though. A year ago the UK consumer group Which? pointed readers to a Facebook page called Camera roll sharing suggestions, used to 'manage how your camera roll can be used to help you create and share on Facebook'. Wording varies by country and app version, and Italian users may see it labelled as gallery suggestions.

Start with Android itself. Go to Settings, then Apps, then Facebook, then Permissions, then Photos and videos. If it says "Allow all", the app can read your whole library. Switch it to "Allow limited access", which hands over only the photos and videos you pick in that moment, or to "Don't allow". This option is available on Android 14 and later, though the exact wording varies by manufacturer.

Then open Facebook's menu and go to Settings & privacy, then Settings, and find Camera roll sharing suggestions. Droid Life reported last year that it holds two toggles, "Get camera roll suggestions when you're browsing Facebook" and "Get creative ideas made for you by allowing camera roll cloud processing." Turn both off.

Any other app that holds full gallery access it doesn't need deserves the same check. ID scans and recovery phrases are safer kept out of the camera roll entirely.