Italy Fines Meta €805M Over Android Photo Access Without Consent
Italy's privacy watchdog has issued a record €805 million penalty to Meta after finding that a Facebook feature scanned Android photo libraries without explicit user consent.
Italy's data protection agency announced a major financial penalty on Saturday, 14 November 2026, targeting Meta Platforms over how the Facebook application handles personal media libraries on mobile devices.
According to Aiweekly, the Italian Garante issued a sanction against Meta Platforms Ireland Limited following an inquiry launched after a consumer protection tip-off in Bolzano. Regulators concluded that a specific Facebook tool bypassed explicit, informed user consent while scanning local photo and video archives on Android devices.
Media additions
The penalty stands as the largest ever levied by the Italian privacy watchdog against a major technology corporation. It represents approximately 0.47% of the group's global revenue, a figure highlighted by Dw and other reporting outlets. Officials also cited Meta's lack of cooperation during the probe and referenced a prior 2019 regulatory action as aggravating factors when calculating the sum.
The Disputed Feature and Privacy Violations
At the center of the regulatory action is a Facebook utility titled "Get suggestions from gallery when browsing Facebook." Introduced on the Android version of the application, the functionality automatically scanned personal photo and video archives — along with associated metadata — to recommend items for status updates and posts.
The Italian Data Protection Authority found that the system was enabled by default. Rather than asking for dedicated permission solely for gallery recommendations, the application relied on a single, broad authorization request covering multiple disparate app functions. Regulators determined this practice breached domestic legislation implementing the European Union's ePrivacy directive, which treats personal smartphone storage as part of an individual's private sphere requiring strict protection.
The enforcement order applies specifically to an estimated 20 million Android users across the country. Investigators emphasized that the ongoing infringement continued for individuals who had not updated their applications or who had previously granted general storage permissions without realizing the scope.
Jurisdictional Clashes and Corporate Defense
Throughout the proceedings, Meta maintained that the matter should fall under the authority of Ireland's Data Protection Commission, given that Meta Platforms Ireland serves as the company's European headquarters. The Italian watchdog rejected this jurisdictional challenge.
A company spokesperson strongly defended the software feature, characterizing the penalty as disproportionate.
"This is a simple feature that helps people share photos and videos on Facebook. Users must grant permission on their device before the feature can operate, and they can change that permission at any time in their settings,"
Meta spokesperson, via ChannelnewsasiaFurthermore, telecomlead.com noted that while investigators probed the local storage access, the formal inquiry did not examine whether the scraped content was utilized to train artificial intelligence models, a practice that Meta has consistently denied.
| Metric / Detail | Reported Figure |
|---|---|
| Fine Amount (Euros) | €805 million |
| Fine Amount (US Dollars) | $887 million |
| Share of Global Turnover | 0.47% |
| Affected User Base in Italy | ~20 million Android users |
| Compliance Window | 60 days |
Regulatory Scope and Broader Enforcement Context
The Garante's ruling isolates a single button and default configuration rather than targeting an entire platform model. However, the decision arrives amid escalating European scrutiny over digital design practices. According to Telecomlead, Italian authorities have pursued various actions across big tech firms, including prior penalties against TikTok subsidiaries over minor safety recommendations and earlier consumer transparency fines involving Meta's account suspensions.
European regulators have also reserved the right to evaluate newer cloud-processing features launched by Meta, signaling that oversight of mobile data pipelines will likely intensify.
What Happens Next
Under the terms of the administrative order, Meta faces a strict 60-day deadline from the ruling date to implement major software modifications. The company must completely disable the gallery suggestion feature by default, override previous general consent grants, and rewrite its prompt architecture to secure separate, explicit permission for local media scanning.
Meanwhile, industry analysts anticipate that the Italian ruling will serve as a persuasive precedent for privacy watchdogs across other European jurisdictions examining default mobile app permissions.
