Summary:
- Italy’s data protection authority has fined Meta Platforms €805 million ($887 million) after finding the company accessed Android users’ photos and videos without their consent or knowledge.
- Meta got access through a Facebook app feature that suggested content from users’ personal photo galleries that they could post.
- Meta has 60 days to switch the feature off by default and ask users for their consent separately.
- The investigation began in 2025 and did not cover whether the content was used to train AI models, a practice Meta denied.
- The fine equals about 0.47% of Meta’s global revenue, the authority said.
Italy Says Facebook Reached Into Users’ Photo Galleries Without Asking
Italy has handed Meta one of the largest privacy fines of the year. The country’s data protection authority said on Saturday, 14 November 2026, that it had fined Meta Platforms €805 million — about $887 million — after finding that the company accessed Android users’ photographs and videos without obtaining their consent or even informing them.
The case centres on a Facebook app feature that looked into the photo galleries on people’s Android phones and suggested pictures and videos they might want to post. According to the authority, Meta had access to that personal content without the permission European privacy law requires. The fine was announced in a statement from the authority, and reported by Reuters the same day.
It is a striking figure, but it is worth putting it in proportion. The authority said the fine is equivalent to about 0.47% of Meta’s global revenue. Under Europe’s General Data Protection Regulation, regulators can fine companies up to 4% of their worldwide annual turnover for the most serious breaches, so this penalty sits well below the legal maximum — but at nearly $900 million, it is still one of the biggest single privacy fines ever imposed on a tech company in Europe.
Meta was not immediately available for comment when Reuters reported the decision.
How the Facebook Feature Worked
The feature at the heart of the case did something that sounds helpful on the surface. Inside the Facebook app on Android, it would look at the photos and videos stored in a user’s personal gallery and suggest ones they might like to share — a holiday snap, a family photo, a video clip from the weekend — ready to post with a tap.
The problem, according to Italy’s authority, was what happened before any of that. Meta had access to the content in people’s galleries without obtaining their consent and without informing them that it was happening. Under European law, accessing someone’s private photos is not a small administrative detail. Photos and videos are personal data, and a company needs a proper legal basis — usually clear, informed consent — before it can process them.
That is the distinction that matters here. The issue is not that Facebook offered to help people post photos. It is that the app reached into a private space on the phone — the gallery, where people keep pictures they may never intend to share with anyone — and Meta did so without asking first and without telling users it was happening.
The authority’s order goes beyond the fine. Meta has 60 days to disable the feature by default and to seek users’ consent separately before it can be used. In practice, that means the gallery-suggestion feature must be off unless a user has explicitly switched it on after being told what it does. It cannot be buried in a general permission or switched on silently in the background.
An Investigation That Began in 2025
The investigation behind the fine began in 2025, according to the authority. That timeline matters, because it shows this was not a snap decision over a single incident. Regulators spent more than a year examining how the feature worked, what data it touched, and whether users had genuinely agreed to it.
One question the investigation did not cover is whether the photos and videos Meta accessed were used to train artificial intelligence models. The authority said that question was outside the scope of this case, and that Meta denied using the content for AI training. That is an important line to draw clearly: the fine is about access without consent, not about AI training, and the regulator has not accused Meta of the latter in this decision.
But the authority did leave one door open. It said it reserved the right to assess separately a new feature, launched in 2026, that allows content from users’ galleries to be processed in the cloud. That is a signal worth watching. If the cloud-processing feature raises similar questions, it could become the subject of its own investigation — and its own fine.
Why This Fine Is Bigger Than One Feature
Fines of this size are rarely just about the feature named in the decision. They are a message to every company that builds features reaching into the private parts of a phone.
The photo gallery is one of the most sensitive places on a device. It holds pictures of children, medical documents, screenshots of bank details, private messages saved as images, and moments people never meant to share. When an app looks through that gallery, it is not browsing public content. It is handling some of the most personal data a person owns.
European regulators have made this point repeatedly, and the size of this fine underlines it. A feature that feels like a convenience — “here are some photos you might like to post” — still needs a clear, honest permission step first. “Helpful” is not a substitute for consent, and neither is a vague line buried in terms of service.
There is also a wider pattern here. Regulators across Europe have been stepping up enforcement against the biggest tech companies, and Italy’s authority has been among the more active. For Meta, which is already facing scrutiny on several fronts — including over AI, advertising, and how it handles data across its apps — this is another expensive reminder that the way a feature is built matters as much as what it does.
What Android Users Should Check Now
The fine is about Meta’s behaviour, not about anything users did wrong. But it is a good prompt to check what your own phone is sharing, because the Facebook app is not the only one that can reach into a gallery.
First, check the Facebook app’s photo permissions on your Android phone. Open Settings, go to Apps, find Facebook, tap Permissions, and look at Photos and videos. Android lets you choose between allowing access to all photos, selected photos only, or no access at all. If you do not want Facebook looking through your gallery, “selected photos only” or “don’t allow” are the safer choices — the app can still work, it just cannot browse your whole camera roll.
Second, look for any gallery or camera-roll suggestion features inside the Facebook app itself and switch them off if you do not use them. Features like this are often enabled during setup or after an update, and they stay on quietly until someone goes looking for them.
Third, remember that permissions are not one-time decisions. Android shows a reminder when an app has not used a permission for a while, and it can reset permissions automatically. That is worth leaving switched on, because it means an app you stopped using cannot quietly keep its access to your photos.
None of this will change what Meta has already done, and it will not affect the fine. But it does put you back in control of the one thing this case was really about: whether a company gets to look at your private photos before you have said yes.
What Happens Next
Meta has 60 days from the decision to disable the gallery feature by default and to build a proper, separate consent step for anyone who wants to use it. The authority will be watching whether that happens, and a failure to comply could bring further action.
Meta has not yet said whether it will appeal. Companies fined under European privacy law often do challenge the decision, and an appeal could take years to work through the Italian courts. An appeal would not automatically suspend the order to change the feature, though, and Meta will need to act on the 60-day deadline regardless of what it decides about the fine itself.
The other thing to watch is the cloud-processing feature the authority flagged. It said it reserved the right to assess that feature separately, and if it does open a second investigation, the questions will be familiar: what data is involved, were users told, and did they agree? The answers to those questions will decide whether this $887 million fine is the end of the story or the first chapter of a longer one.
For now, the message from Italy is clear. A phone’s photo gallery is private, and no company — however large, and however helpful its feature claims to be — gets to look inside it without asking first.
Related reading: Cybersecurity Tips: 12 Essential Ways to Stay Safe Online in 2026 · Google DeepMind Unveils AlphaGenome 2 · WhatsApp Zaps
FAQs
Q1: Why did Italy fine Meta $887 million?
A: Italy’s data protection authority fined Meta Platforms €805 million ($887 million) after finding the company accessed Android users’ photos and videos without obtaining their consent or informing them. The access came through a Facebook app feature that suggested content from users’ personal galleries that they could post.
Q2: What did the Facebook app feature do?
A: The feature looked at photos and videos in a user’s personal gallery on Android and suggested ones they might want to post on Facebook. The authority found Meta had access to that content without the consent European privacy law requires, and without telling users it was happening.
Q3: What must Meta do now?
A: Meta has 60 days to disable the feature by default and seek users’ consent separately before it can be used. That means the gallery-suggestion feature must be off unless a user explicitly switches it on after being told what it does.
Q4: Was the content used to train AI models?
A: The investigation, which began in 2025, did not cover the possible use of the content to train AI models, and Meta denied using it for that purpose. The authority said it reserved the right to assess separately a new 2026 feature that allows gallery content to be processed in the cloud.
Q5: How big is the fine compared to Meta’s revenue?
A: The authority said the fine is equivalent to about 0.47% of Meta’s global revenue. Under Europe’s GDPR, regulators can fine companies up to 4% of worldwide annual turnover for the most serious breaches, so this penalty is well below the legal maximum but still one of the largest privacy fines in Europe.
Sources: Reuters (14 November 2026); The Jerusalem Post (Reuters), 14 November 2026.
