Italy’s data protection watchdog, the Garante, fined Meta €805 million (about $887 million) on Saturday after finding that Facebook accessed photos and videos on Android phones without specific user consent. The Italian Data Protection Authority said that Facebook gallery access gathered private media to suggest feed posts without giving people clear notice or separate choices [2]. The ruling affects about 20 million Android users in Italy [1].
Facebook Gallery Access on Android
The regulatory inquiry focused on an automated feature introduced in 2023 under the label Get suggestions from gallery when browsing Facebook [1]. As people scrolled through their regular social feeds, the app scanned local media storage to display personal snapshots and video recordings as ready-made post ideas [2]. The feature operated without asking for explicit approval each time it accessed user folders. Device owners didn’t always realize their private media was being screened, because the option stayed switched on by default inside the application [1].
Investigators from the Italian Data Protection Authority discovered that Facebook bundled permissions into a single general request instead of asking people whether they wanted their personal albums indexed for post recommendations [1]. When individuals installed the software or agreed to basic photo sharing, that single grant activated background indexing across entire media folders. That request followed a vague prompt to enable other features, making it impossible for users to know that gallery suggestions were also turned on [2]. Regulators pointed out that users agreed to upload individual pictures during normal messaging, but they never received an understandable choice about background scanning that continually monitored their device storage. Users had no simple way to opt out [1].
The Italian agency said the company collected photos, videos, and associated metadata without giving people a chance to reject the recommendation engine. Meta made changes after receiving formal complaints, but officials labeled those adjustments both late and incomplete. The updates only helped users who manually installed the newest version of the app, leaving older installations exposed. Reuters first reported the English-language details of the Garante decision on Saturday [2].
Article 122 and Phone Privacy
Italy based the penalty on Article 122 of its personal data protection code [2]. That statute incorporates European Union ePrivacy directives into domestic law, treating an Android phone as part of an individual’s private sphere that needs free and informed consent before any software reads files stored on the device [1]. The statutory rule applies even if files never leave the physical handset and cause no demonstrable harm to the device owner [2]. Italian Data Protection Authority officials said that extracting photos, videos, and technical metadata without clear notice violated basic consumer protections, regardless of whether device owners suffered measurable financial damage [1].
Visual metadata reveals intimate personal habits. By scanning timestamps, camera models, and location tags embedded in image files, software algorithms build profiles about family routines, travel, and personal friendships [2]. The Garante ruled that using private gallery photos to generate social feed suggestions served Meta’s business goals rather than basic social networking tools. That secondary use needed its own explicit opt-in [1].
Italy has about 20 million Android users, according to agency figures. Because Android powers most smartphones throughout the country, the default activation of gallery suggestions affected a large share of the Italian population, prompting the Italian Data Protection Authority to step in [1]. Meta gave users no advance warning about background album analysis, obscuring secondary functions behind standard installation steps [2].
The Dispute Over Irish Oversight
The Italian Data Protection Authority named Meta Platforms Ireland Limited in the order [1]. During the proceedings, Meta challenged Italy’s jurisdiction by arguing that any regulatory inquiry belonged exclusively in Dublin under the General Data Protection Regulation, where its main European base of operations is located. Under that one-stop-shop framework of the GDPR, a lead supervisory authority in the member state where a company maintains its primary establishment generally oversees cross-border compliance. But the Garante rejected that jurisdictional claim, explaining that its intervention rested on specific ePrivacy directives rather than standard GDPR rules that centralize oversight in Ireland, leaving national watchdogs free to enforce local hardware protections. Italian officials retained full authority over phone privacy within Italy [2].
Regulators cited Meta’s lack of cooperation during the probe [1]. Officials said Meta failed to provide timely information about how Facebook scanned device folders, and they factored a 2019 privacy ruling against Meta into the final €805 million calculation. The Garante noted that repeat compliance failures justified a larger monetary penalty, reflecting past enforcement history [2].
Meta made no immediate public comment. The company previously maintained that its gallery features respected privacy rules, but Meta Platforms Ireland Limited has not said whether it will appeal the €805 million fine through Rome tribunals or European Union courts. The Associated Press reported that Meta faced the fine following a comprehensive review of Android software behavior [1].
The 60-Day Enforcement Order
Meta has 60 days to comply. The Italian Data Protection Authority ordered Meta to disable the gallery suggestions feature across Italy and seek separate, specific consent before scanning user media in future updates [1]. The tool must stay off by default for every Android user in Italy, including people who already granted broad media permissions during earlier setups. Regulators stressed that silence or inaction from consumers cannot be interpreted as legal agreement [2].
Investigators didn’t examine whether Meta used gallery media to train artificial intelligence. Meta denies doing so. Even so, the Italian Data Protection Authority announced that it will open a separate inquiry into a cloud processing feature that Meta rolled out in 2026, checking whether offloading mobile workloads to remote servers creates fresh privacy hazards for Italian users. That upcoming probe will assess whether cloud synchronization respects European data boundaries [2].
The ruling forces changes in app design [1]. While tech companies often prefer single permission prompts to reduce friction, European regulators insist that secondary background features must never piggyback on essential app functions without distinct user approval. For Meta, complying with the order means rebuilding Facebook gallery access so that browsing social feeds never triggers unrequested local file indexing [2].
Turnover Penalties and Other Probes
The €805 million fine equals about 0.47 percent of Meta’s global turnover [1]. The penalty comes close to the €825 million Dutch fine on Uber, though it sits below the record €1.2 billion European Union GDPR fine imposed on Meta over transatlantic data transfers. National agencies in Europe can still impose massive fines without waiting for consensus from Dublin [2]. Andrew Zinin reported for Tech Xplore that the penalty reflects Italy’s strict approach to platform accountability [1].
While European watchdogs penalize unrequested device access, Meta faces parallel legal battles in the United States, including a major Meta privacy penalty in New Mexico that challenges how its social platforms handle sensitive consumer records. Meta is also fighting Italian regulators over publisher payments. Watchdogs across the European Union continue to push back against bundled consent models that tie basic networking tools to secondary commercial tracking [2].
The 60-day clock is now running for Meta in Italy [1]. By penalizing Facebook gallery access under Article 122, the Garante established that smartphones remain private spaces where software cannot inspect personal photos without explicit, informed permission from consumers [2]. Digital platforms face clear limits when handling personal media files on mobile devices [1].
- ONLINE NEWS Zinin, A. (2026, November 14). Meta fined $887 million in Italy over Android gallery photos and videos on Facebook. Tech Xplore. [Article Link]
- ONLINE NEWS Stan, A. M. (2026, November 14). Italy fines Meta €805m over Facebook gallery access. TNW. [Article Link]
- ONLINE NEWS Techmeme. (2026, November 14). Italy’s data protection agency fines Meta €805M for allegedly accessing Android users’ photos and videos without their consent or informing them. [Article Link]
