Italy Fines Meta €805 Million Over Photo Gallery Access

Italy's data protection authority has fined Meta €805 million for reading the photo galleries of roughly 20 million Android users without valid consent. The penalty, announced on 14 November 2026, equals about 0.47 percent of the company's global 2024 revenue, according to the regulator.

The Garante accused the US group of failing to properly inform Android app users and of never obtaining effective consent for a feature that has existed since 2023. That feature scans photos and videos in a phone's gallery and surfaces them as suggestions for posts.

How did the feature work?

The mechanism rested on a single catch-all permission. Users could grant one general approval that covered multiple functions at once — and with that, the app could read an entire smartphone photo archive, metadata included. In most cases, that access persisted permanently.

From a consent-design standpoint, this is the classic anti-pattern: bundling a narrow, sensitive data access into a broad, vaguely worded toggle. The user approves once, understands little, and the access never lapses.

Where did the investigation start?

It began in July 2025, after a consumer protection centre in Bolzano filed a tip. The Garante's investigation then traced the feature's behaviour across Italy's Android user base, arriving at the 20-million-user figure.

What does the ruling change?

Meta contested the Italian regulator's jurisdiction, arguing the case belonged to Ireland, where the company holds its European headquarters. The Garante rejected that objection outright.

The fine comes with concrete obligations. Meta must now:

• obtain users' explicit consent before accessing their photo galleries;
• ship the feature switched off by default;
• apply that default even to users who previously granted general access permission.

The 60-day deadline gives Meta two months to rebuild the consent flow — moving from a bundled, one-tap grant to a specific, informed and revocable opt-in for gallery access alone.

For interface teams elsewhere, the ruling signals where European regulators are heading: default-on data access to personal media libraries, justified by a generic permission, is now squarely on enforcement radar — and priced at nearly half a percent of annual revenue.