Meta Faces Massive Penalty Over Unauthorised Mobile Photo Access

2026-11-14 digital

Milan, Saturday 14 November 2026
Italy has fined Meta €805 million after discovering Facebook accessed personal photos and metadata from 20 million Android users without explicit consent via an automatic gallery suggestion feature.

The substantial financial penalty handed down on Saturday, 14 November 2026, stems from an inquiry launched in July 2025 by the Italian data protection authority, the Garante per la protezione dei dati personali, following a formal complaint filed by the consumer advocacy group Centro Tutela Consumatori Utenti di Bolzano [2][4][7]. The regulatory scrutiny focused on Facebook’s ‘Get suggestions from gallery when browsing Facebook’ feature, which was introduced to the Android platform in 2023 [1][3][7]. By pairing device permissions with generic operational notices, such as prompts stating ‘enable other functions’, the application obtained blanket authorisation across diverse features without presenting users with a distinct, granular opt-in choice for automated photo harvesting [4][7]. Under Article 122 of the Italian Privacy Code, which transposes the European Union’s ePrivacy Directive into national law, terminal equipment such as mobile devices constitutes a protected private sphere, requiring explicit, fully informed consent before any stored files or metadata are retrieved [4][7].

Financial Scale and Jurisdictional Ramifications for Tech Platforms

The €805 million sanction corresponds to approximately $887 million based on prevailing exchange rates of 1.102 dollars per euro, representing around 0.47% of Meta’s global turnover, or roughly 0.4% against its 2025 full-year revenue of $201 billion, which generated $60.5 billion in net profit [1][2]. In defending its enforcement sovereignty, the Italian Garante formally dismissed Meta’s procedural argument that the matter fell exclusively under Ireland’s Data Protection Commission via the GDPR one-stop-shop mechanism, noting that the ePrivacy Directive operates outside that unified cross-border window [5][7]. Regulators highlighted that roughly 20 million Italian Android users were impacted by the default configuration, with the sanction severity compounded by Meta’s identified lack of cooperation and historical compliance citations dating back to 2019 [1][2][3]. The company announced that it intends to appeal the decision, having described the monetary penalty as disproportionate [2].

Operational Orders and Broader Compliance Mandates for Scale-ups

Beyond the fiscal penalty, the Garante has ordered Meta to dismantle the default activation within 60 days, requiring that the gallery suggestion mechanism be disabled across existing and newly installed user accounts unless unambiguous consent is obtained separately [2][3][4]. While the investigation established that local device media had not been repurposed to train generative artificial intelligence models—an allegation Meta explicitly denied—the Italian watchdog reserved explicit rights to examine a related feature introduced in 2026 that processes personal device media within cloud architectures [2][3]. For fast-scaling European software-as-a-service (SaaS) providers, fintech operators, and consumer mobile application developers across regions like the Benelux, the ruling confirms an aggressive regulatory trend against combined permission models, setting an imperative that cloud infrastructure, data pipelines, and mobile UX designs maintain auditable, compartmentalised consent mechanisms at every layer of user interaction [1][2][7].

Sources & Ecosystem Partners

Regulatory compliance Data privacy