Facebook’s photo-gallery suggestions cost Meta €805 million in Italy

Facebook‘s Android app has a feature that browses the photos and videos on your phone and suggests some of them as posts. Italy’s data protection authority says that feature reached the galleries of about 20 million Italians, including the metadata attached to each file, without their specific consent, and it has fined Meta €805 million. That is the largest penalty the Italian privacy regulator has ever imposed, and it comes with an order to make the feature opt-in.

The problem, according to the regulator, was a single tap. When Facebook asked for access to the gallery, one app-wide permission covered several functions at once, after a generic notice that never explained the app would also comb through the camera roll to generate suggestions. The suggestions were switched on by default, so a user who granted photo access for one reason also opened the whole archive for another. The authority stressed that reading information stored on a phone requires free and informed consent, whether or not anything leaves the device and whether or not anyone can show harm.

Meta now has 60 days to change how the feature works in Italy. It must ask for a separate consent, explain in plain terms what the suggestions do, and keep the option off by default, including for people who already said yes under the old prompt. The company has to report its first measures within 30 days and document the full changes within 90.

Meta rejects the decision and has said it will appeal. “This is a straightforward feature which helps people post photos and videos to Facebook,” the company told the BBC. “People must give permission on their device before it can operate and they can change this permission at any time via their settings.”

The ruling leaves several questions untouched. The regulator did not examine whether gallery content was used to train artificial intelligence models, something Meta denies, and it reserved a separate review of a newer Facebook option that processes gallery content in the cloud. The order covers the Android app and Italian users only; people elsewhere get no new consent screen from this decision. The amount is also smaller than it sounds for a company of Meta’s size: the regulator put it at roughly 0.47% of the group’s global turnover. And Italian penalties can shrink. Amazon‘s €1.1 billion competition fine from a different Italian authority was cut to €752 million on appeal.

The legal route matters beyond Italy. Meta argued that only its lead regulator in the European Union, Ireland’s Data Protection Commission, could rule on the case. The Italian authority disagreed: it applied Article 122 of Italy’s privacy code, which implements the EU’s ePrivacy Directive on information stored on devices, and that law has no one-stop-shop system that funnels complaints to a single national regulator. Every EU country has its own version of that directive, so the same reasoning is available to other national authorities. For scale, Ireland’s regulator fined Meta €1.2 billion in 2023 over transfers of European users’ data to the United States.

The investigation began in July 2025 after a complaint from the consumer protection centre in Bolzano, and it included a technical analysis of the app. The gallery-suggestion feature has been in the Facebook app since 2023. In setting the amount, announced on November 14, 2026, the regulator cited the number of people affected, how long the practice lasted, an earlier action against Meta in 2019 and what it called the company’s lack of cooperation.

Until the new prompt arrives, the control Meta itself points to already sits on every Android phone, in Italy or anywhere else: the system’s app-permission screen, where Facebook’s access to photos and videos can be limited or withdrawn. The Italian order turns that buried setting into a question Facebook has to ask out loud.

Tags: Italy, meta, privacy, Android, facebook, data protection