On 14 November 2026, the Italian data protection regulator fined Meta Platforms \u20ac805 million (approximately $887 million) for unlawfully accessing photographs, videos and metadata belonging to Android smartphone users. An investigation found that the Facebook app had accessed users\u2019 private photo galleries without their explicit informed consent. The regulator estimates that the breach may have affected around 20 million users in Italy. The company has 60 days to modify the operation of the feature in question. This was reported by the Italian Data Protection Authority, Garante Privacy, and Reuters.<\/p>\n
The fault is related to the function Facebook<\/a>, which allows you to select photos and videos from your smartphone\u2019s gallery to post on social media. It has been added to the app for Android<\/a> in 2023.<\/p>\n As the regulator found, Facebook requested blanket permission to access photos and videos without adequately explaining that this would also be used to generate recommendations whilst users were browsing their news feed.<\/p>\n Furthermore, this feature was enabled by default. If a user granted the app full access to their gallery, Facebook was technically able to view all photos, videos and associated metadata stored on the device.<\/p>\n The regulator emphasised that smartphone owners were unable to properly verify exactly which materials the app was using. At the same time, the identified breaches do not mean that all of each user\u2019s photographs were copied to Meta\u2019s servers.<\/p>\n The investigation began in July 2025 following a complaint from the Consumer Protection Centre in Bolzano. The Italian regulator carried out a technical audit of the Facebook app and found breaches of national data protection legislation and the European ePrivacy Directive.<\/p>\n According to the agency\u2019s findings, access to information on a personal device requires separate, voluntary and informed consent. A general authorisation to use the gallery for several different functions is not sufficient.<\/p>\n In determining the fine, the regulator took several factors into account: the potential reach of around 20 million Android users in Italy, the duration of the infringement, and a lack of cooperation Meta<\/a> during the audit and the preliminary decision regarding the company, adopted in 2019.<\/p>\n The changes that Meta implemented after the investigation began were also taken into account. However, the regulator deemed them to be too little, too late, particularly as they mainly affected users who had updated the app.<\/p>\n The fine of \u20ac805 million represents approximately 0.47 per cent of the Meta Group\u2019s global turnover.<\/p>\n The decision by the Italian regulator provides not only for financial penalties, but also for the mandatory rectification of the mechanism governing access to users\u2019 personal data.<\/p>\n Within 60 days, Meta must disable the recommendation feature in the default gallery, particularly for those users who have already granted general permission to access their photos.<\/p>\n In order to continue using this feature, Facebook must seek consent separately, clearly explaining the purpose of the feature, the scope of access to information and how to disable it.<\/p>\n The company is also required to notify the regulator of the measures it has initiated within 30 days, and of the changes actually implemented within 90 days.<\/p>\n If, at the end of the 60-day period, the user has not given their proper consent, the feature must not be activated for them.<\/p>\nWhy did Italy fine Meta \u20ac805 million?<\/h2>\n<\/div>\n
What Meta needs to change within 60 days<\/h2>\n<\/div>\n