Rome used ePrivacy rules, not GDPR, to act without waiting for Ireland in a case that started with a complaint in Bolzano.
Italy’s Data Protection Authority, the Garante per la protezione dei dati personali, fined Meta Platforms Ireland Limited 805 million euros, about 887 million US dollars, on Saturday, November 14, 2026, after finding that the Facebook app for Android accessed users’ photo galleries without specific consent.
The Garante said in a statement that the app had “accessed photos, videos and associated metadata stored on Italian users’ smartphones without specific consent and without informing them”.
The case turns on a feature called “Get suggestions from gallery when browsing Facebook”.
It has been available since 2023 and was switched on by default. While a person is browsing Facebook, it offers photos and videos from the phone gallery as post ideas. The Garante estimated that about 20 million Android users in Italy could have been affected.
One permission for the whole app
The Garante said the problem was not the idea of suggestions. It was the way permission was collected.
Access was requested through a single permission for the whole app, covering several features with different needs.
That request was preceded by a generic warning about enabling other features, the authority said, which did not let a user understand that agreement also covered the phone’s photo gallery suggestions.
“If granted in full, this type of permission allows the app to read the device’s entire photo archive, usually permanently, without the user or the authorities being able to verify which information is actually being used,” the Garante said in its statement.
The authority found a breach of Article 122 of the Italian Privacy Code, which implements the European Union ePrivacy Directive.
That law requires free and informed consent before access to information stored on a device.
Why Italy could act alone
Meta argued that Ireland should handle the case, because its main European base is in Dublin. The Garante rejected that objection. It said ePrivacy rules do not provide for the one stop shop mechanism that routes most GDPR cases through a lead regulator in Ireland, so it let Rome decide the case itself.
The Garante set out that rejection in its statement, and it is the reason the fine comes from Rome rather than Dublin.
Meta plans to appeal
Meta rejected the regulator’s conclusions and said the €805 million penalty was disproportionate.
“We strongly disagree with the assessment of the facts and the application of the law by the Garante and consider the amount of the fine disproportionate,” the company said in a statement reported by Italian broadcaster Sky TG24.
Meta described the feature as a straightforward tool designed to help people publish photographs and videos on Facebook. It argued that users must grant permission through their device settings before the feature can operate and can change that permission whenever they choose.
The company also confirmed its intention to appeal the decision.
How the case started and why the fine is this size
The inquiry began in July 2025 after a complaint from the Centro Tutela Consumatori Utenti, the Consumer Protection Centre of Bolzano. Investigators then carried out a technical analysis of the Facebook app.
The Garante said the amount reflects the scale of the case, the fact that the violation was still in progress for people who had not updated the app or who had already granted permission, a previous measure against the company in 2019, and what it called limited cooperation during the investigation.
The regulator said the legislation treats information stored on smartphones as part of an individual’s private sphere. Accessing that information requires freely given and informed consent, even where the company does not establish that the information was transmitted elsewhere or that the user suffered demonstrable harm.
The fine amounts to about 0.47% of Meta’s global turnover, the authority said, and is by far the largest fine the Garante has imposed.
What happens next
Within 60 days, Meta must keep the feature switched off by default, including for people who already granted permission, and ask for consent through a separate and specific request that explains what the feature does, that it needs gallery access, and how to turn it off. If a person gives no new consent, the feature stays off.
The decision did not rule on whether gallery content was used to train artificial intelligence models, a practice Meta denies. The Garante said it reserved the right to assess separately a new feature launched in 2026 that allows gallery content to be processed in the cloud.
Meta did not immediately respond to a request for comment, according to Politico on Saturday.
Meta has the right to appeal the decision or just pay the fine and update the permissions settings in the Facebook app.
