ROME — Nov. 15, 2026. Italy’s data protection authority imposed an €805 million penalty on Meta Platforms Ireland Limited on Nov. 14, finding that the Facebook app for Android accessed users’ photographs, videos and related information without adequate, specific consent. The regulator ordered changes to a gallery-suggestion feature and set deadlines for the company to report its response.
The Italy Meta privacy fine raises a question larger than the size of the penalty: when an app already has permission to access a phone’s photos, does that permission cover every additional use? Italy’s decision says it does not, putting meaningful user choice at the centre of the case.
How the Italy Meta privacy fine arose
The disputed Facebook function offered users suggestions for posts while they browsed the social network, drawing on material stored in their Android phone galleries. The feature had been available since 2023, but the Italian investigation focused on whether people understood and specifically authorised that particular use.
The authority began its inquiry in July 2025 after a complaint from a consumer-protection organisation in Bolzano. It also conducted its own technical examination of the feature. The resulting order concerns the application of Italian privacy law to access to information stored on a user’s device.
The regulator’s finding is not that every Facebook user uploaded every image to the platform. It is that the permission design allowed access to gallery material without the distinct, informed agreement required for this purpose. That distinction prevents exaggeration.
Why a single phone permission was not enough
Investigators identified one permission request that applied across the app, including functions serving different purposes. They also found that the advance explanation was too general to tell users the photo-suggestion function would use their gallery.
Another problem was the feature’s default setting: it was enabled rather than waiting for an affirmative, function-specific choice. The authority said a broadly granted permission could potentially allow the app to read a user’s full photo library on an ongoing basis, while leaving users unable to determine precisely which information had been used.
That potential reach matters even when a regulator has not identified every file accessed. The issue is not simply whether Android displayed a permission prompt, but whether the particular use was explained.
Italy applied Article 122 of its Privacy Code, which implements European ePrivacy protections. The authority reasoned that access to data held on a personal device requires free and informed consent, regardless of whether the material was transmitted elsewhere or measurable damage had already occurred.
What Meta must do within 60 days
The order requires Meta to obtain a separate, specific consent choice for the gallery-suggestion feature. The explanation must tell users what the feature does, that it involves photo-gallery access and how to switch it off.
The company must also keep the feature disabled by default, including for people who previously approved the broader app permission. Once the 60-day compliance period expires, the function must not be enabled for users without valid consent.
There are two further reporting deadlines. Meta must tell the regulator within 30 days what steps it has begun and, within 90 days, describe the measures it has implemented. These deadlines do not establish compliance.
For Android users, the practical lesson is to review the permissions granted to social-media apps and the in-app settings controlling optional suggestions. Changing a device-level photo permission is not necessarily identical to giving or withholding consent for every individual feature.
Why the €805 million penalty matters
The authority estimated that roughly 20 million Android users in Italy were affected. It said the amount represented about 0.47% of the Meta group’s global turnover.
In setting the penalty, it considered the scope and duration of the conduct, a previous 2019 measure involving the company and what it characterised as inadequate cooperation with the investigation. It also recognised some corrective changes made after the complaint, but viewed them as late and limited because they depended on app updates.
The regulator rejected Meta’s argument that Italian authorities lacked jurisdiction because the company’s relevant European entity is based in Ireland. Its reasoning was that this ePrivacy issue does not operate under the same one-stop-shop mechanism used for certain other European data-protection matters.
These issues are distinct from the US litigation examined in WWC’s earlier reporting on Meta’s New Mexico privacy penalty. Different laws, alleged conduct and legal procedures should not be treated as a single worldwide ruling.
What the decision does not say about AI
The Italian proceeding did not examine whether gallery material was used to train artificial intelligence systems. The regulator recorded Meta’s denial of such use, but it did not resolve that separate question in this case.
It also reserved the possibility of examining a different feature introduced in 2026 that enables cloud processing of gallery content. That reservation is not a finding that the newer function violated the law.
For readers, this distinction prevents an avoidable jump from a documented consent problem to a much broader allegation about AI training. Strong scrutiny of technology companies still requires identifying exactly which feature, legal obligation and evidence are at issue.
The case is relevant to the Philippines without making Italian law applicable here. WWC has covered Philippine discussions about how authorities should deal with Meta’s platforms and the privacy challenges raised by proposed youth social-media safeguards. Both debates show why data transparency matters.
What happens next
The immediate test is whether Meta implements a distinct opt-in design, leaves the suggestion function off by default and satisfies Italy’s reporting requirements. Any appeal or further company response must be assessed on its own official record; the penalty should not be described as overturned or finally settled without such evidence.
Why it matters: This case shows that a convenient app feature can become a significant regulatory problem when the surrounding permission system does not clearly match its purpose. The next meaningful evidence will be the company’s compliance steps and the authority’s assessment of them—not assumptions about unseen photos or unrelated AI systems.
Frequently asked questions
How much did Italy fine Meta in November 2026?
Italy’s data protection authority imposed an €805 million penalty on Meta Platforms Ireland Limited on Nov. 14, 2026.
Did Facebook access Android users’ entire photo libraries?
The regulator found that the broad permission could allow access to the full gallery. Its public announcement did not establish that every image belonging to every affected user was actually accessed.
What must Meta change in Facebook’s photo suggestions?
The feature must be off by default, and users must receive a separate, clearly explained request for specific consent. The regulator set a 60-day compliance period.
Did Italy find that Meta trained AI on users’ private photos?
No. The regulator expressly excluded potential AI-training use from this investigation and said that issue was not decided.
Does the Italian fine automatically apply to Facebook users in the Philippines?
No. The order concerns conduct involving Italian users and does not itself impose a new Philippine legal requirement or establish compensation for Filipino users.
