Meta Fine of €805M Says Facebook Read Android Photos
About 20 million Italian Android users were affected, and Meta now has 60 days to switch Facebook camera roll suggestions off by default and ask for consent.
Hakkı ALKANPublished 5 min read
Italy has issued an 805 million euro Meta fine, about $887 million, saying Facebook's Android app read photos, videos and their metadata on users' phones without specific consent. The Garante, Italy's data protection authority, announced the penalty on Saturday, Nov. 14, 2026, and gave Meta 60 days to switch the feature off by default.
The feature at the center of the case suggests pictures from your phone's gallery as ideas for new posts. About 20 million Android users in Italy were involved, the regulator said. If you use Facebook on Android, this decision changes how the app must ask before it touches your photo library.
What did Facebook do with the camera roll?
The Garante's decision covers "Get suggestions from your gallery while browsing Facebook," a Facebook camera roll feature available since 2023. While you scroll, it surfaces photos and videos from your device and nudges you to share them.
According to the regulator, Facebook asked for gallery access with one permission that covered the whole app and several unrelated features. That request came after a vague notice to "enable other features," so users could not tell they were also turning on gallery suggestions. The feature was switched on by default.
Metadata is the hidden information attached to a file, such as when and where a photo was taken. If the permission was granted in full, the Garante said, the app could read the device's entire photo archive, usually permanently, "without the user or the authorities being able to verify which information is actually being used," as quoted by Politico Europe.
Why did Italy, not Ireland, issue the Meta fine?
Meta argued that Ireland's Data Protection Commission, its lead EU privacy regulator, should handle the case. The Garante rejected that objection. It ruled under Article 122 of Italy's privacy code, which implements the EU ePrivacy directive, the rule that protects the confidentiality of phones and communications.
Unlike the GDPR, ePrivacy has no "one-stop-shop," the system that lets a single lead regulator handle a company across the bloc. That detail matters well beyond Italy: any national watchdog can act on device access cases without waiting for Dublin.
The regulator also stressed that the phone itself is part of a person's private sphere. Any access to what is stored on it needs free and informed consent, whether or not data leaves the device and whether or not harm occurs.
What must Meta change, and by when?
The order, published in the Garante's official statement, sets three deadlines. If Meta misses the 60-day mark, the feature cannot be turned on for anyone who has not given valid consent.
| Deadline | What Meta must do |
|---|---|
| 30 days | Tell the Garante what steps it has started |
| 60 days | Ask for separate, specific consent; explain the feature and how to disable it; keep it off by default, even for users who already allowed access |
| 90 days | Report the measures it has adopted |
Why is the Meta fine so large?
The Garante pointed to the number of people affected and to a violation it says is still ongoing for anyone who has not updated the app or already granted the permission. It also cited a previous 2019 decision against the company and Meta's poor cooperation during the probe, which began in July 2025 after a complaint from a consumer group in Bolzano.
Changes Meta made after the complaint counted in its favor, but the regulator called them late and limited to users who update the app. The Meta fine equals about 0.47% of the group's worldwide turnover. Politico Europe called it by far the largest fine the Italian authority has ever issued.
Meta did not immediately respond to requests for comment from Politico, the BBC or Reuters, and it can appeal.
Is this about AI training?
Not yet. The investigation did not examine whether gallery content was used to train AI models, which Meta denies. The Garante said it will separately assess a newer feature, launched in 2026, that processes gallery content in the cloud.
That echoes the opt-in "cloud processing" prompt Facebook tested in 2025, which uploads camera roll photos to Meta's servers for AI suggestions.
The ruling also lands as Meta pushes deeper into assistants, including its Muse models for Meta AI.
What should Android users do now?
You do not need to wait for Meta's 60-day deadline. Menu names vary by phone and app version, but the steps are similar:
- Open Android Settings, go to Apps, then Facebook, then Permissions.
- Tap Photos and videos and choose limited access or Don't allow.
- In Facebook, open Settings & privacy, then Settings, and look for camera roll sharing suggestions.
- Turn off any cloud processing option you do not want.
- Update the Facebook app, since the Garante says Meta's fixes reach only updated versions.
Our take: The Meta fine matters less for the money than for the precedent. By refusing to send the case to Ireland, Italy has shown that ePrivacy lets any EU regulator police how apps reach into your phone. Expect other watchdogs to look hard at "one permission for everything" prompts, and Meta may well contest that reading on appeal. For users, the simple test is this: would you hand a stranger your whole photo album to get post suggestions? If not, limit the permission.
For more on Meta's recent policy shifts, see how the company paused its new commercial terms earlier this month.