On 14 November 2026, the Italian data protection regulator fined Meta Platforms €805 million (approximately $887 million) for unlawfully accessing photographs, videos and metadata belonging to Android smartphone users. An investigation found that the Facebook app had accessed users’ private photo galleries without their explicit informed consent. The regulator estimates that the breach may have affected around 20 million users in Italy. The company has 60 days to modify the operation of the feature in question. This was reported by the Italian Data Protection Authority, Garante Privacy, and Reuters.
- The Italian regulator has fined Meta €805 million, or approximately $887 million, for breaching data protection rules.
- Facebook for Android accessed photos, videos and metadata without obtaining specific, proper consent from users.
- The breach may have affected around 20 million Android users in Italy.
- Meta must disable the relevant feature by default within 60 days and introduce a separate consent request.
How Facebook gained access to users’ photos
The fault is related to the function Facebook, which allows you to select photos and videos from your smartphone’s gallery to post on social media. It has been added to the app for Android in 2023.
As the regulator found, Facebook requested blanket permission to access photos and videos without adequately explaining that this would also be used to generate recommendations whilst users were browsing their news feed.
Furthermore, this feature was enabled by default. If a user granted the app full access to their gallery, Facebook was technically able to view all photos, videos and associated metadata stored on the device.
The regulator emphasised that smartphone owners were unable to properly verify exactly which materials the app was using. At the same time, the identified breaches do not mean that all of each user’s photographs were copied to Meta’s servers.
Why did Italy fine Meta €805 million?
The investigation began in July 2025 following a complaint from the Consumer Protection Centre in Bolzano. The Italian regulator carried out a technical audit of the Facebook app and found breaches of national data protection legislation and the European ePrivacy Directive.
According to the agency’s findings, access to information on a personal device requires separate, voluntary and informed consent. A general authorisation to use the gallery for several different functions is not sufficient.
In determining the fine, the regulator took several factors into account: the potential reach of around 20 million Android users in Italy, the duration of the infringement, and a lack of cooperation Meta during the audit and the preliminary decision regarding the company, adopted in 2019.
The changes that Meta implemented after the investigation began were also taken into account. However, the regulator deemed them to be too little, too late, particularly as they mainly affected users who had updated the app.
The fine of €805 million represents approximately 0.47 per cent of the Meta Group’s global turnover.
What Meta needs to change within 60 days
The decision by the Italian regulator provides not only for financial penalties, but also for the mandatory rectification of the mechanism governing access to users’ personal data.
Within 60 days, Meta must disable the recommendation feature in the default gallery, particularly for those users who have already granted general permission to access their photos.
In order to continue using this feature, Facebook must seek consent separately, clearly explaining the purpose of the feature, the scope of access to information and how to disable it.
The company is also required to notify the regulator of the measures it has initiated within 30 days, and of the changes actually implemented within 90 days.
If, at the end of the 60-day period, the user has not given their proper consent, the feature must not be activated for them.
Did Meta use personal photos to train its AI?
A separate issue concerns the possible use of photographs and video recordings for training models artificial intelligence.
The Italian regulator clarified that the current investigation did not cover this aspect. Meta denies using such material to train AI.
At the same time, the agency has reserved the right to carry out a separate audit of another feature launched in 2026. This feature enables the contents of a smartphone’s gallery to be processed using cloud technology.
At the time of publication by Reuters, Meta had not commented on the new fine.
As of 14 November 2026, the Italian regulator’s decision has already been announced, but the deadline set for Meta to amend its settings has not yet expired. Further scrutiny of cloud-based photo processing remains a separate issue and is not covered by the current decision on the fine.
