The short version
Italy’s privacy regulator says one bundled Android permission does not count as consent to scan a user’s photo gallery. Meta must switch the Facebook feature off by default and ask for separate consent within 60 days. If your app reads device storage for a secondary feature, check its consent flow against the same test. Our GDPR compliance consulting team can help with that review.
What did the Garante decide?
The Garante found that the Facebook app for Android accessed photos, videos and related metadata on Italian users’ phones without specific consent and without telling them. The authority, Italy’s Garante per la protezione dei dati personali, announced the penalty on November 14, 2026.
The feature, described by the Associated Press as “Get suggestions from gallery when browsing Facebook,” offers pictures from the phone’s gallery as ideas for new posts. It has run since 2023 and was switched on by default.
So what went wrong? Mostly the way access was requested. Facebook asked for gallery access through a single generic authorization that covered several app functions, after a vague prompt. According to the regulator, users could not tell that they were also enabling gallery suggestions.
Why is the fine so large?
The Garante pointed to three aggravating factors:
- Scale. Up to 20 million Android users in Italy may have been affected.
- Cooperation. The authority cited Meta’s poor cooperation during the probe, which began in 2025.
- History. It referred back to a 2019 sanction against the company.
It did credit Meta for some corrective changes, which it called belated and limited. Reuters reported that Meta plans to appeal and calls the fine disproportionate. A spokesperson said users must grant permission on their device before the feature works and can change it at any time.
What must Meta change, and by when?
| Deadline | Order |
|---|---|
| 30 days | Report to the Garante on the steps it has started |
| 60 days | Ask for separate, specific consent that explains the feature and why it needs the gallery |
| 60 days | Turn the feature off by default for all users |
| 90 days | Report the compliance measures it has adopted |
The investigation did not look at whether gallery content was used to train AI models. The Garante said it will separately assess a newer 2026 feature that processes gallery content in the cloud.
What it means for US & EU software teams
An OS permission is not consent
Meta’s defence was that Android itself asks the user first. The regulator rejected that. Under the ePrivacy rules, reading data stored on a phone needs free and informed consent for that purpose. A system dialog that covers many features does not meet the test, even when the data never leaves the device.
Secondary features need their own opt-in
Core uploads, such as attaching a photo to a post, are what the user asked for. Proactive scanning to suggest content is a separate purpose. Teams doing Android development should split these flows into three steps:
- An in-app explanation of the feature and why it needs the gallery.
- A separate toggle that is off by default.
- The system permission prompt.
Prefer the system photo picker
Android’s photo picker and iOS limited library access let a user hand over single items without exposing the whole gallery. Google Play already limits broad photo and video permissions to apps whose core function needs them. It's often the cheapest fix, too, because one change cuts store-review risk and privacy risk at once.
Cloud and AI processing raise the bar
If your app sends gallery content to a server for tagging, search or AI suggestions, treat it as a new purpose. That means fresh consent, a data protection impact assessment under GDPR and a clear answer on whether the content trains models.
How should teams respond?
- Inventory storage access. List every place your mobile apps read photos, files, contacts or location, and which feature uses each one.
- Map purpose to consent. Each non-core purpose gets its own explanation and opt-in, recorded with a timestamp.
- Default to off. Any proactive feature that scans device content ships disabled.
- Switch to pickers. Replace broad media permissions with the system picker wherever the feature allows it.
- Review server-side use. Document whether device content is uploaded, how long it is kept and whether it feeds AI training.
Frequently asked questions
Why did Italy fine Meta €805 million?
Italy’s data protection authority found that the Facebook app for Android accessed photos, videos and metadata in users’ phone galleries for a post-suggestion feature without specific consent. The feature was on by default since 2023 and relied on one generic permission covering several functions. The decision was announced on November 14, 2026.
Which law did Meta break, GDPR or ePrivacy?
The Garante based the decision on Article 122 of Italy’s Privacy Code, which implements the EU ePrivacy Directive. That rule treats a smartphone as part of the user’s private sphere, so reading data stored on it needs free and informed consent. GDPR still governs any later processing of personal data.
Does an Android runtime permission count as consent?
Not by itself, according to this ruling. The system prompt shows that the user allowed access, but not that they understood each purpose. Features beyond the core action the user requested need their own explanation and opt-in.
Will Meta appeal the fine?
Yes. Reuters reported that Meta plans to appeal and considers the fine disproportionate. A Meta spokesperson said users must grant permission on their device before the feature works and can change that permission at any time.
Sources
Garante per la protezione dei dati personali — Facebook: il Garante Privacy sanziona Meta per 805 milioni di euro (primary source, November 14, 2026)
Reuters via CNBC — Italy fines Meta $887 million over Android users’ data access (November 14, 2026)
Associated Press via ABC News — Meta fined $887M in Italy over Android gallery photos, videos on Facebook (November 14, 2026)
Bloomberg — Italy Fines Meta €805 Million Over Access to Users’ Photos (November 14, 2026)