Italy fines Meta 805 million euros for unauthorized access to Android user gallery data

The Italian Data Protection Authority announced on Saturday, November 14, 2026, that it has fined Meta Platforms Ireland Limited 805 million euros for violating privacy regulations. The regulator determined that the Facebook app for Android accessed photos, videos, and metadata from approximately 20 million users without obtaining specific consent. This fine, which is roughly equivalent to US$887 million, represents approximately 0.47% of the global turnover of the Meta group.

Details of the privacy violation

The investigation into these practices began in July 2025 following a complaint submitted by the Bolzano Consumer and User Protection Center. According to officials, the violation involved a feature titled "Get gallery suggestions while browsing Facebook," which has been available since 2023. The regulator found that the app used a single generic permission, labeled as "enable other functions," to grant access to an entire user gallery.

Meta has been ordered to disable this feature by default and must implement a specific, separate consent request for users. The company is required to report on the measures it has initiated within 30 days and provide updates on applied measures within 90 days. While the investigation addressed the unauthorized access to gallery content, it did not include the use of images to train artificial intelligence models, a claim that Meta denied.

Regulatory context and future investigations

The ruling was issued under Article 122 of the Italian Privacy Code, which incorporates EU ePrivacy regulations. During the proceedings, the Italian authority rejected an argument from Meta suggesting that the Irish authority should decide the case. The regulator stated that the "one-stop-shop" mechanism does not apply to this specific regulation. The sanction also takes into account a previous enforcement action taken against the company in 2019.

The Italian Data Protection Authority has reserved the right to conduct further investigations into a new feature launched in 2026 regarding the cloud processing of gallery content. This action follows a history of significant regulatory scrutiny for the company, including a previous case in New Mexico where Meta was ordered to pay $25 billion for misleading residents about data use over a 10-year period. Additionally, the tech sector has seen other major fines, such as a 2021 antitrust fine against Amazon that was later reduced to 752 million euros.