Italy Fines Meta €805 Million Over Facebook’s Quiet Access to Android Photo Galleries

A single permission prompt, 20 million users, and a legal route that bypassed the GDPR’s one-stop shop.

Italy’s data protection authority, the Garante, said on November 14, 2026 that it had fined Meta €805 million (about $887 million) after finding that the Facebook app for Android accessed photos, videos and their metadata on users’ phones without specific, informed consent. The regulator said roughly 20 million Italian Android users were affected by a “gallery suggestions” feature that has been available since 2023, which surfaces photos from a user’s phone as ideas for posts while they scroll.

The finding was not about data leaving the phone. Under Article 122 of Italy’s privacy code — the national implementation of the EU’s ePrivacy rules — a smartphone is treated as part of a person’s private sphere, and any access to what it stores requires free and informed consent, even if nothing is uploaded and no harm occurs. The Garante found that Facebook requested gallery access through a single app-wide permission, following a vague prompt to enable other features; users could not reasonably tell they were also switching on gallery suggestions.

Why Dublin didn’t get the case

Meta argued the matter belonged to Ireland’s Data Protection Commission, its lead EU regulator under the GDPR’s one-stop-shop mechanism. The Garante disagreed: because it acted under ePrivacy rules rather than the GDPR, there is no one-stop shop, and national authorities can act directly. That jurisdictional point may prove more consequential than the fine itself — it gives every EU member state a parallel enforcement lane for device-level access questions, precisely the kind of questions that AI features on phones keep generating.

In setting the penalty, the regulator weighed a 2019 decision against Meta and what it described as poor cooperation during the investigation. Changes Meta made after the complaint counted in its favor, but the Garante called them late and limited to users who update the app. The fine equates to roughly 0.47% of Meta’s global turnover.

The remedy is a default, not just a prompt

Within 60 days, Meta must ask for separate, specific consent for the gallery-suggestions feature and keep the feature off by default — including for users who previously granted access. That last clause is the operational sting: a one-time migration of existing permissions, not merely a new prompt for new users. Any product team that has shipped “consent once, use forever” flows on mobile should read the order as a template.

Two boundaries are worth noting. The investigation did not examine whether gallery content was used to train AI models — a use Meta denies. And the Garante said it will separately examine a cloud-processing feature Meta launched in 2026, so this file is not closed. Reuters reported that Meta was not immediately available for comment.

What it means for product and marketing teams

For platforms, the decision narrows the design space for on-device AI features: broad permissions bundled behind generic prompts are now demonstrably expensive in the EU, and “the data never leaves the device” is not a defense under ePrivacy. For advertisers and app marketers, the practical read-through is consent UX: expect more granular opt-ins, more default-off states, and more friction in exactly the permission flows that feed personalization and creative features.

The €805 million number will get the headlines. The durable story is the legal architecture: a national regulator, using ePrivacy rather than GDPR, fined a U.S. platform for reading a phone’s gallery — and won the jurisdiction argument. That combination is now precedent, and it travels.