The short version:
- Italy’s data protection authority, the Garante, fined Meta Platforms Ireland Limited €805 million (about $887 million) on Saturday 14 November — the largest fine the regulator has ever imposed.
- The Facebook app on Android read photos, videos and their metadata from users’ phone galleries without specific consent and without properly telling them.
- About 20 million Android users in Italy were affected. The feature, “Get suggestions from your gallery when you browse Facebook”, had been switched on by default since 2023.
- Meta has 60 days to switch the feature off by default and ask for separate, specific consent — or it cannot run at all.
- The fine is about 0.47% of Meta’s worldwide turnover.
It started with a feature that sounded helpful. Open Facebook on an Android phone, and the app would quietly look through your photo gallery and suggest pictures you might like to post. No upload, no tap, no obvious moment when your private photographs became Facebook’s raw material. The suggestion simply appeared, as if the app had known what was on your phone all along. It had.
On Saturday, Italy’s data protection authority, the Garante per la protezione dei dati personali, said that was unlawful — and put a price on it: €805 million, roughly $887 million, the largest penalty the regulator has ever imposed on anyone.
The case turns on consent, or rather the absence of it. The Garante found that the gallery-suggestion feature accessed photos, videos and their metadata without the specific, informed consent European law requires, and without adequately informing users that it was happening. The feature had been available since 2023 and was switched on by default, behind what the regulator described as a vague permission prompt. About 20 million Android users in Italy were in its reach.
The investigation began in July 2025, after a complaint from a consumer protection centre in Bolzano, in South Tyrol. The Garante then ran its own technical analysis of how the app behaved. Its decision rests on Article 122 of Italy’s Privacy Code, which implements the European Union’s ePrivacy rules on accessing information stored on a person’s device — the same kind of rule that governs cookies and tracking.
Meta now has 60 days to fix it. Within that window, the feature must be disabled by default, and consent must be collected through a separate, specific request that explains what the feature does, why it needs gallery access, and how to switch it off. If Meta does not do that, the feature cannot run for anyone without valid consent. The deadline falls in mid-January 2027.
What the ruling does not say
Two things are worth getting right, because they are easy to get wrong. First, the findings concern improper access to data. They do not mean Facebook copied every photo from users’ phones or made private material public. The Garante’s complaint is that the app reached into galleries without a proper yes — not that it published what it found there.
Second, the decision does not settle whether gallery content was used to train artificial intelligence models. That question was not examined, and Meta denies that it was. The authority has, however, reserved the right to assess separately a feature launched in 2026 that processes gallery content in the cloud — which suggests this is not the last word on the subject.
Why this matters
The fine is large in absolute terms and modest in relative ones: 0.47% of Meta’s global revenue. That tension is the story. European regulators have spent a decade trying to make privacy penalties hurt enough to change how the biggest platforms are built, and the pattern so far has been fines that make headlines and leave business models intact.
What may matter more than the money is the remedy. A feature that was on by default for three years must now be off by default, with consent asked for separately and plainly. That is a design change, not a cheque — and it sets a template other European regulators can copy. If the same logic is applied to the cloud-processing feature the Garante has flagged for separate assessment, the cost to Meta could grow well beyond €805 million.
For the 20 million Italians whose galleries were in scope, the practical question is simpler: check the setting. The ruling does not require anyone to do anything — but it does mean that, from January, Facebook will have to ask properly before it looks through your photos again.
Related: Anthropic now bans users from being cruel to Claude — seriously — and the FBI just seized two hacking tools from China’s Flax Typhoon operation.
Source: Garante per la protezione dei dati personali — press release (Doc-Web 10321080)
