Italy Fines Meta €805M Over Facebook Photo Access [2026]

On November 14, 2026, Italy's data protection authority, the Garante, fined Meta €805 million (roughly $887 million) over a Facebook feature on Android phones. According to Al Jazeera's report, the regulator found that the Facebook app "accessed photos, videos and associated metadata stored on Italian users' smartphones" without specific consent or adequate notice. The feature, which suggests items from your gallery while you scroll, was on by default. It is the largest fine the Garante has ever issued.

This is a Meta photo privacy fine with a very practical meaning: your phone gallery is full of people who never agreed to anything. Friends, children, strangers in the background, whiteboards, documents. This guide explains what the Garante decided, how the feature worked, what deadlines Meta faces, what it does and does not change for you, and how to blur faces in photos and video before they leave your device.

What exactly did the Garante decide?

The Garante decided that Facebook's Android app broke Italian law implementing the EU ePrivacy Directive by reading users' gallery content without specific consent. The fine is about 0.47% of Meta's worldwide turnover, and the authority said roughly 20 million Android users in Italy could have been affected, per Al Jazeera.

According to PPC Land's detailed breakdown, the legal basis is Article 122 of the Italian Privacy Code, which transposes the ePrivacy Directive and governs storing and reading information on a user's device. The Garante reads it broadly: accessing device data needs consent "regardless of data transmission or the existence of harm." That is a significant point. It means the question is not whether Meta misused a photo, but whether it was allowed to look at the gallery at all.

The timeline reported is short. A consumer group, the Centro Tutela Consumatori Utenti of Bolzano, filed the complaint in July 2025, the Garante ran its own technical analysis, and the decision came about 16 months later. The sources differ slightly on the dollar figure ($880 million in one headline, $887 million in others), because of exchange rates, but the euro amount is consistent. ABC News also carried the story.

Which factors raised and lowered the penalty?

Aggravating factors were the number of people affected, the duration of the practice (the feature has been available on Android since 2023, per PPC Land), a prior Garante measure against the company dating to 2019, and what the Italian text calls "scarsa collaborazione", limited cooperation. The mitigating factor was that Meta changed the permission flow after the complaint. The Garante judged those changes late and limited to people who update the app. In its view the violation continues for users who have not updated or who already granted the system permission.

How did the Facebook gallery suggestion feature work?

The feature, described as "Get suggestions from gallery when browsing Facebook," suggests photos and videos from your phone as things to post while you browse. It was on by default, and it relied on a single, app-wide gallery permission.

Here is the mechanism that mattered to the regulator:

• Facebook asked for gallery access through the normal Android permission prompt.
• A generic notice asked users to "enable other features," which did not make clear that gallery suggestions were included.
• Once the permission was granted in full, the app could read the entire photo archive, usually permanently.
• Neither users nor the authority could verify exactly what was used, according to PPC Land, which also notes that the source does not list which metadata fields were read.

That last point is why consent mattered so much. A gallery is not a folder of things you intend to publish. It holds screenshots of banking pages, photos of children, pictures of other people's faces, and location metadata in every file. When an app can read all of it, "I tapped Allow once" is a thin form of agreement. The Garante's position is that consent has to be specific: tied to the actual feature, explained in plain words, and separate from a bundle of other options.

Why does this matter for people in your photos?

It matters because the privacy interest in a photo belongs to everyone visible in it, not only the person who took it. Your gallery contains your friends' faces, your children's faces, and the faces of strangers who happened to walk through the frame. None of them clicked Allow.

This connects to a pattern we have covered before. The Garante already ruled in April 2026 that posting a child's photo needs both parents' consent. Under European rules, an image of an identifiable person is personal data, and our GDPR guide to blurring faces and license plates in video explains why. The Meta decision attacks the problem from a different side: not what you post, but what an app may read before you decide to post anything.

It also sits beside the biometric angle. When photo libraries are scanned, the next question is what is done with the faces in them. Our post on the Amazon Photos BIPA class action over face recognition shows how that dispute plays out in the United States. In Europe, the fight is at the consent layer, before analysis even begins.

Does Meta have to switch the feature off?

Meta has to obtain separate, specific consent and keep the feature off by default, but the deadlines are counted from the decision and Meta can appeal. At the time of reporting, neither Al Jazeera nor PPC Land carried a Meta response.

According to PPC Land, the Garante set these orders (the periods are PPC Land's calculation from a November 14, 2026 start, and the source says it is not stated when they formally begin):

1. 30 days (about December 14, 2026): Meta must report the initiatives it has started.
2. 60 days (about January 13, 2027): Meta must request separate, specific consent for the feature, explaining what it does, that it accesses the gallery, and how to disable it. The feature must stay off by default, including for users who already granted the system permission. The Italian text is more explicit than the English one that earlier system-level permission does not count.
3. After 60 days: if Meta does not comply, the feature cannot be activated for users without valid consent.
4. 90 days (about February 12, 2027): Meta must report the measures it adopted.

Why did the Garante reject the Irish regulator route?

Meta asked the Garante to defer to Ireland's Data Protection Commission under the GDPR's one-stop shop mechanism, which normally lets a company deal with a single lead regulator. The Garante refused. Its reasoning, per PPC Land, was that the ePrivacy rules "do not provide for the 'one-stop shop' mechanism." That is a legal route that other national regulators can reuse: complaints about reading data on a device can be handled locally, not funnelled to Dublin.

Scale helps put the number in context. PPC Land's own calculation puts the fine at roughly €40 per affected user, and it remains below the €1.2 billion the Irish DPC imposed on Meta in May 2023. Those comparisons are PPC Land's arithmetic, not statements from the Garante.

Was this about AI training?

No. The proceedings did not examine whether gallery content was used to train AI, and Meta denies doing so, according to Al Jazeera and PPC Land. The Garante reportedly reserved the right to evaluate a separate 2026 cloud-processing feature for gallery content on its own. The source does not name that feature, and it does not confirm whether it is the same as Meta's opt-in camera roll suggestions rolled out earlier.

That distinction matters if you are tempted to read more into the headline. The fine is about access without specific consent. It does not find that photos were used for any particular purpose. It would be wrong to say the Garante found Meta trained models on private galleries, and we do not claim that.

If AI and your photos are your concern, our guide on how to protect your photos from Meta's Muse deepfake tools covers a different, opt-out side of the same question.

What people in the privacy community ask about this fine

The questions the news has prompted fall into three groups.

Is "I tapped Allow" valid consent?

Not under the Garante's reading. Consent has to be specific. A single app-wide permission that bundles gallery suggestions with "other features" is the pattern the authority called too generic. The practical lesson for any app, and for any creator thinking about the apps they use: the permission dialog is not the same as informed consent.

Does it matter that the feature was on by default?

Yes. PPC Land reports the suggestions function was on by default, and Al Jazeera reports the Garante's required changes include making the notice clearer and stopping the feature being on by default. Under European privacy thinking, a default that benefits the company is hard to defend as a free choice.

Could this happen with other apps?

Potentially. The legal theory, that reading device data needs specific consent even without proof of harm, is not specific to Meta. Any app that scans your gallery for suggestions, memories, or cloud features could face the same analysis in Italy. We are not predicting enforcement. We are pointing out that the reasoning is general.

What does this change for anyone who films or photographs people?

It changes nothing about your own legal duties, but it shows how seriously regulators treat the images on your phone. If you record other people, you are already in a space governed by privacy rules: our guide to unauthorized filming and face blurring walks through when consent matters, and the EDPB's statement on smart glasses shows regulators applying GDPR to wearables that capture bystanders.

The Meta decision adds a quieter lesson. Even if you never post a photo, the tools you use to store and share them can read them. For creators, journalists, parents and anyone handling footage of other people, that suggests three habits:

• Know which apps have full gallery access on your phone.
• Keep sensitive material, such as footage of children, clients, patients or witnesses, in a place that is not part of your general photo library.
• Blur or anonymize faces before the file goes into any app that might read or upload it.

How can BGBlur help you protect faces in your photos?

BGBlur lets you blur faces in a photo or video in your browser before you share it anywhere, which protects the people in the shot if the file is later uploaded, reshared or viewed by an app. Our complete guide to blurring faces in video has the full walkthrough, and the iPhone face blur guide covers phone workflows.

The short version:

1. Upload your photo or video to BGBlur in the browser.
2. Let the AI detect every face. Motion tracking follows people as they move.
3. Choose a blur strength, or use face anonymization where a blur is not enough.
4. Preview the result and export it in MP4, MOV or WebM for video.

There are honest limits. BGBlur does not stop Facebook or any other app from reading your gallery. That is controlled by your phone's permission settings. Blurring only protects what is in the exported file, and it does nothing about the original, which stays in your gallery unless you delete it. Free accounts have limits (200MB, 10 minutes, 3 videos per month, 720p export), while Pro removes the watermark and allows 1080p. Processed files are deleted within 24 hours. Blur strength also matters: weak pixelation can sometimes be reversed, so use a strong blur for anything sensitive.

What should you do today?

You can reduce your exposure in a few minutes, whether or not you live in Italy.

1. Check Facebook's photo permission. On Android, open Settings, then Apps, then Facebook, then Permissions, and review Photos and videos. Set it to None or to selected items only if you do not need gallery suggestions. Menu names vary by phone and app version.
2. Turn off gallery suggestions inside the app. Look in Facebook's settings for options about suggestions from your camera roll or gallery and disable them. The label may differ from the English wording reported in the news.
3. Audit other apps. List which apps hold full photo access. Remove it from anything that does not need it.
4. Separate sensitive footage. Keep children's, clients' or confidential recordings out of your general gallery where possible.
5. Blur before you share. Run any footage that shows other people through a face blur step before posting, especially children, as our guide to what sharenting is and how to protect a child's privacy explains.
6. Strip location metadata from photos you intend to publish.
7. Watch for Meta's response. The company can appeal, and the app flow in Italy is due to change within weeks if it complies.

What happens next?

Three things are worth watching. First, whether Meta appeals, since it can, and whether it contests the Garante's view that the one-stop shop does not apply. Second, whether the changes announced in Italy turn up in other countries. Third, whether the Garante opens a separate look at the cloud-processing feature it reserved judgment on.

For readers outside Italy, the decision is a signal rather than a rule. The ePrivacy Directive is implemented in every EU member state, so other regulators could use the same reasoning, but that is an open question, not a prediction.

Conclusion

Italy's €805 million fine turns a familiar habit, tapping Allow on a photo permission, into a legal question about what an app may read from your phone. The Garante's answer is that reading photos, videos and metadata needs specific consent, that a default-on suggestion feature does not meet it, and that Ireland's one-stop shop does not shield a company from a national regulator on this point. Meta can appeal, and the deadlines it faces run to early 2027.

For you, the lesson is practical. Your gallery holds other people's faces, and you are often the only person in a position to protect them. Check your permissions, keep sensitive footage separate, and blur faces before files leave your control. When you are ready to share a photo or clip that shows other people, try BGBlur's face blur in your browser and protect the people in your frame first.