English
Share
Italy's data protection authority has fined Meta €805 million ($887 million) for accessing Android users' photos and videos without explicit consent, the largest privacy penalty the regulator has ever issued. The decision, announced on 14 November 2026, targets the parent company of Facebook, WhatsApp and Instagram over a Facebook app feature that silently read users' camera rolls without clear permission or notification.
What happened: the Facebook camera roll feature
The Garante per la protezione dei dati personali found that the Facebook app for Android used a 'camera roll suggestions' feature that was switched on by default. When users browsed Facebook, the app pulled photos and videos from the device gallery to suggest content they might post. Users were not clearly told that this granted Meta access to their entire photo archive—including metadata—sometimes permanently.
The Italian regulator said the feature relied on a single, blanket permission covering several app functions with different purposes. The smartphone is part of a person's private sphere, and its content can be accessed only with free and informed consent.
Why Meta was fined €805 million
The penalty is one of several recent actions against Big Tech under European privacy regulations, and it reflects how seriously EU member states now treat consent violations. The investigation began in July 2025 after a report from the consumer protection centre in Bolzano, in northern Italy. The Garante also said Meta did not cooperate fully during the probe.
Meta argued that Ireland, where its European headquarters is located, should handle the case. However, the authority rejected that objection because the case concerns the ePrivacy directive, which—unlike the GDPR one-stop-shop mechanism—does not provide for a lead supervisory authority.
How the fine was calculated
- Affected users: roughly 20 million Android users in Italy
- Fine amount: €805 million, about $887 million
- Share of turnover: approximately 0.47% of Meta's 2024 global revenue
- Deadline: Meta has 60 days to obtain explicit consent and disable the feature by default
Context: ePrivacy and Italy's privacy crackdown
Italy has been one of the more aggressive EU regulators on digital privacy. The Garante temporarily restricted ChatGPT in 2023 over data concerns and has repeatedly sanctioned Meta. In this case, the authority relied on Italy's implementation of the EU ePrivacy directive, which protects the confidentiality of communications and the content stored on users' devices.
Legal analysts note that the fine, while record-setting for the Italian authority, remains well below the maximum available under the General Data Protection Regulation. The regulator emphasized that Meta withheld information during the investigation, a factor that contributed to the severity of the penalty.
What Meta must do now
The regulator ordered Meta to disable the camera roll suggestion feature by default—including for users who have not updated the app—and to obtain separate, specific consent before accessing gallery content. Users must also be able to clearly understand and switch off the feature.
Meta may appeal the decision, and the company has not yet issued a detailed public response. The ruling could shape how other European authorities treat Android app permissions and blanket data-access requests from platforms that combine multiple functions under a single permission.
FAQ
Why did Italy fine Meta €805 million?
Meta's Facebook app for Android accessed users' photo and video galleries through a feature enabled by default, without obtaining specific consent or clearly informing users.
Which Meta feature triggered the fine?
The 'camera roll suggestions' feature, which recommends photos and videos from the device gallery for users to post on Facebook.
How many users were affected?
About 20 million Android users in Italy were affected by the feature.
What does Meta have to do within 60 days?
Meta must switch off the feature by default, obtain explicit consent, and make it clear how users can disable gallery access.
Follow Discussion