On November 14, 2026, Italy's data protection authority fined Meta €805 million (about $887 million) after finding that the Facebook app for Android read photos and videos from users' phone galleries without obtaining their specific consent — or even informing them. It is the largest fine the authority has ever imposed, and about 20 million Android users in Italy were affected.
Which feature was fined, and how it was found
The feature at issue is called "Get suggestions from your gallery when you browse Facebook," switched on by default since 2023. It scans a user's phone gallery and suggests photos and videos the user might want to post. The Garante found that Meta accessed photos, videos and associated metadata stored on users' phones without specific consent and without proper information, in breach of Article 122 of the Italian Privacy Code — the provision that implements the EU ePrivacy rules on accessing information stored on a person's device. The investigation began in July 2025, after a complaint from the Consumer Protection Centre in Bolzano, and the authority then carried out its own technical analysis. Notably, the penalty rests on ePrivacy rules rather than the GDPR, which is one reason Rome could act directly without waiting for the Irish regulator to move first.
The fine does not answer whether the photos trained AI
One question the fine leaves open is whether the gallery content was used to train AI models. The Garante said explicitly that the investigation did not cover that question, and Meta denies that the content was used for training; the authority also reserved the right to assess separately a feature Meta launched in 2026 that sends gallery content to the cloud for processing. The fine amounts to about 0.47% of Meta's global revenue, and Meta has said the penalty is disproportionate and that it intends to appeal.
What to watch in the 60-day remediation window
Within 60 days, Meta must switch the feature off by default; to turn it back on, it will have to ask users for separate consent, explaining what the feature does, what it needs to access and how to switch it off. It must report its first corrective steps within 30 days and all measures adopted within 90 days. Four nonprofits sued five major AI companies earlier this month, asking a court to freeze development of more powerful models, and the EU AI Act will add two new bans on December 2. Regulation of Big Tech in Europe is tightening from several directions at once — this fine is only one part of it.
