You open Facebook on your phone, scroll through the feed, and the app suggests a photo from your camera roll as your next post. It is a picture you never uploaded, never shared, never even thought about posting. Facebook found it anyway.
For about 20 million Android users in Italy, that was not a one-off quirk. It was the default behaviour of the app for years.
On Saturday, November 14, 2026, Italy’s data protection authority decided it was illegal. The regulator, known as the Garante, fined Meta €805 million, roughly $887 million, in the largest penalty it has ever imposed on a technology company.
The case is about consent, not hacking. Nobody broke into Meta’s servers, and no one is saying Facebook published anyone’s private photos. The Garante’s finding is narrower, and in some ways more unsettling: the app reached into people’s phones and read what was there without ever properly asking.
What the Italy Meta fine is about
The fine targets a Facebook feature called “Get suggestions from your gallery when browsing Facebook.” It has been available on Android since 2023, and it was switched on by default from the start.
While a user browsed the feed, the feature would look through photos and videos stored on the phone and suggest them as ideas for posts. The Garante said the Facebook app “accessed photos, videos and associated metadata stored on Italian users’ smartphones without specific consent and without informing them.”
Metadata matters here. It is the hidden information attached to a file, such as when and where a photo was taken. So the issue was not only the images themselves, but the quiet trail of details that travels with them.
The penalty was imposed on Meta Platforms Ireland Limited, the Meta entity that operates Facebook in Europe. At about 0.47 percent of Meta’s global turnover, it is big in absolute terms but small next to the company’s scale: Meta reported $201 billion in revenue for 2025.
How Facebook’s gallery suggestions worked
When you install Facebook on Android, the app asks for permission to access your photos. That sounds like a clear yes or no. The Garante’s problem was that the permission did not explain what it was really for.
According to the regulator, Facebook relied on a single, app-wide permission to reach into users’ galleries. Granting that permission did not tell the user that Facebook would also scan the gallery and generate post suggestions from its contents.
The authority called the consent process too generic. It said users could not fully understand the specific permissions they were allowing when they accepted. The suggestion feature itself was enabled by default, so many people never made an active choice about it at all.
That is the heart of the ruling. Under European privacy rules, consent has to be specific and informed. A broad permission to see your photos is not the same as permission to mine them for post ideas, and the Garante found that Meta blurred the two together.
It is the same kind of quiet access that has drawn scrutiny elsewhere. Google recently faced questions after it emerged that human reviewers could read files in Gmail and Drive under a policy change users had not clearly been told about.
The practice was still ongoing for users who had not updated the app, as well as for those who had already granted permission under the old system. That continuing effect was one of the factors that pushed the fine higher.
Why Italy, not Ireland, decided the case
Meta argued that the case should have been handled by Ireland’s Data Protection Commission, its lead privacy regulator in the European Union. The Garante rejected that objection, and the reason matters for every big tech company operating in Europe.
The decision rests on Article 122 of Italy’s Privacy Code, which implements the European Union’s ePrivacy Directive. That directive protects the confidentiality of phones and communications, and it does not use the EU’s “one-stop shop” mechanism that normally routes cross-border cases to a company’s main regulator.
In plain terms, the Garante said it had the power to act because the rule being broken was a national ePrivacy rule, not a general data protection rule. The fine therefore comes from Rome, not Dublin, and it sets a precedent other national regulators could follow.
The investigation began in July 2025, after a complaint from the Consumer Protection Centre of Bolzano. The Garante then carried out its own technical analysis of how the feature behaved on Android devices before reaching its decision.
What Meta says — and what happens next
Meta rejected the findings outright. “We strongly disagree with the assessment of the facts and the application of the law by the Garante and consider the amount of the fine disproportionate,” the company said in a statement reported by Italian broadcaster Sky TG24, according to Reuters.
The company also confirmed that it intends to appeal the decision. Its defence is that users must grant permission on their device before the feature can operate, and that they can change that permission at any time in their settings.
Whether or not the appeal succeeds, the 60-day clock is already running. Within that period, Meta must switch the gallery suggestion feature off by default, even for users who already allowed access.
It must also ask for consent through a separate, specific request that clearly explains what the feature does and how to switch it off. Meta must report to the Garante on its first steps within 30 days, and on the measures it has put in place within 90 days.
Why this fine matters beyond Italy
An €805 million fine is a headline on its own, but the ruling reaches further than one country. It draws a line between two kinds of permission that most phone users treat as the same thing.
Letting an app see your photos so you can upload one is a narrow, practical permission. Letting it scan your entire gallery in the background to suggest content is a different kind of access, and regulators are now saying it needs its own, separate ask.
That distinction could reshape how social apps handle photo access across Europe. If other regulators follow Rome’s lead, the default-on suggestion features that feel helpful today may have to become opt-in everywhere.
The same month, tens of thousands of apps built with Grok Build were found exposed online, a reminder of how easily material meant to stay private can end up in the open when access controls are loose.
The ruling also lands at a moment when Meta is already under pressure on data handling. Last month, a judge in New Mexico ordered the company to pay $25 billion over how it handled Facebook user data, and Meta said it would appeal that decision too.
What the ruling does not decide
One question hangs over the case that the Garante deliberately left open. The investigation did not examine whether photos or gallery information were used to train artificial intelligence models, a practice Meta has denied.
That matters because the most sensitive fear users have is not that Facebook suggested a photo, but that their private pictures helped train a model they never agreed to feed. The ruling does not answer that question, and it does not claim that every photo was copied or used in a particular way.
The finding is about access and consent, not a data breach or a hack — a very different kind of event, as the Fireworks AI breach showed when customer datasets and model weights were exposed.
And the story may not be finished in Italy either. The Garante said it may separately assess a newer feature, launched in 2026, that processes gallery content in the cloud. That could produce a second decision on the same part of the app.
What users in Italy should do now
For Italian Android users, the practical change is coming whether the appeal succeeds or not. Within 60 days, the gallery suggestion feature must be off by default, and Facebook will have to ask again, properly this time.
Until then, anyone who wants to stop the feature can check the app’s permissions in their phone settings. On Android, Facebook’s photo access can be limited or revoked entirely.
The wider lesson travels beyond Italy. Every app that asks for photo access is asking for something specific, and it is worth asking what that something actually is. A permission granted for one purpose should not quietly become a permission for another.
Italy fines Meta €805 million for blurring that line. The appeal will decide whether the fine stands, but the question it raises will not go away: when an app asks to see your photos, what exactly are you agreeing to?
Source: Al Jazeera, reporting on the Garante’s announcement of November 14, 2026.
