Italy Fines Meta €805 Million Over Android Gallery Access, Not AI Training

Italy's data protection authority, the Garante, has fined Meta Platforms Ireland €805 million (about $887 million) for accessing photos, videos and metadata on Italian Android users' smartphones without specific consent. The decision, announced November 14, 2026, targets a Facebook feature that suggests gallery content while users browse the app. The procedure did not examine whether the content was used to train artificial intelligence, which Meta denies.

The feature and the violation

The feature, "Get suggestions from your gallery while browsing Facebook," has been available on Android since 2023. It surfaces photos and videos from a user's phone gallery as potential posts while they scroll Facebook. The Garante found that Facebook requested gallery access through a single permission covering the entire app and multiple functions, preceded by a generic notice to "enable other features" that did not disclose gallery suggestions were included. The feature was also enabled by default.

The Garante said: "If fully granted, such authorisation allows the app to read the entire photo archive on the device, on an ongoing basis, without the user or the Authority being able to verify what information is actually being used" [1].

The investigation began in July 2025 after a complaint from the Bolzano consumer group Centro Tutela Consumatori Utenti and drew on the authority's own technical analysis [1].

Legal basis: ePrivacy, not GDPR

The Garante applied Article 122 of Italy's privacy code, which transposes the EU ePrivacy Directive. That rule requires free, informed consent for any access to information on a device, regardless of whether data is transmitted or harm results [1]. The authority rejected Meta's argument that Ireland's Data Protection Commission — Meta's lead regulator under GDPR — should handle the case, because the ePrivacy framework has no "one-stop shop" mechanism [1].

This jurisdictional point matters. It means national regulators can act directly on device-access complaints without deferring to a company's EU headquarters regulator.

What the fine covers — and what it doesn't

The Garante cited roughly 20 million Android users in Italy, the continuing nature of the violation for users who have not updated the app or already granted permission, a 2019 decision against Meta, and what it called "poor cooperation" during the investigation. Changes Meta made after the complaint were counted as mitigating but described as "late and limited to users who update" [1].

The fine equals about 0.47% of Meta's global revenue [1].

Crucially, the Garante stated: "The procedure did not concern the potential use of content to train artificial intelligence, which Meta denies" [1]. The authority reserved the right to separately assess a newer feature, launched in 2026, that allows cloud processing of gallery content [1][2].

Remedies and deadlines

Within 60 days, Meta must:

• Request consent through a separate, specific prompt explaining what the feature does, that it involves gallery access, and how to disable it
• Keep the feature off by default, even for users who already granted the previous bundled permission
• If the deadline passes without compliance, the feature cannot be activated for users without valid consent [1]

Meta must also report initiated steps within 30 days and adopted measures within 90 days [1].

Context: a device-access case, not an AI case

The sources describe a consent failure around on-device gallery access, not an AI training case. The feature suggests content for posting; the violation is reading the gallery without a specific, informed opt-in. The Garante explicitly did not rule on AI training use, and Meta denies such use.

The decision signals that national ePrivacy enforcement can bypass the GDPR one-stop shop, and that bundled permissions with vague notices will not satisfy consent requirements for device storage access. Whether other EU regulators follow this approach remains to be seen.