Italy fines Meta €805m over Facebook photo gallery access

On 14 November 2026, Italy's Data Protection Authority fined Meta €805m (£670m, or $887m, according to the BBC) for accessing the photos and videos of Android users without their specific consent. According to the BBC, the regulator says Meta did not properly inform about 20 million smartphone users that Facebook could reach their photo galleries, and the BBC describes the penalty as one of the largest an Italian authority has ever imposed on a tech giant.

The case is about consent, a legal term that simply means a person's clear, informed agreement before a company uses something that belongs to them. Here the thing in question is the content of a phone gallery. The sources we read do not say that these photos were used to train artificial intelligence, and we come back to that point below.

What exactly did the Facebook feature do?

According to the BBC, the charge relates to a feature that suggests photos and videos from a user's phone gallery as ideas for posts. The Portuguese outlet ECO adds that the feature has been available since 2023 under the name 'Get gallery suggestions while you browse Facebook', and that it used photos, videos and metadata (the technical information attached to a file, such as its date) stored on the phones.

The core of the dispute is how the permission was requested. According to ECO, the app asked for a single generic permission to access the gallery, worded 'enable other functions', valid for the whole platform and switched on by default, without telling users that it also authorised post suggestions. The BBC reports the same mechanism as a single app-wide authorisation and says the notice shown beforehand did not make clear that Facebook could generate suggestions from gallery photos. The Dutch site Bright adds that users were not clearly shown that the app thereby had access to their entire photo archive.

In the regulator's view, as reported by ECO, this gave Facebook permanent access to the whole photo archive of the phone, while neither users nor the regulator could check which information was really used. ECO reports that the authority considers this a breach of the Italian Privacy Code, and that any access to data stored on a device requires free and informed consent, whether or not the data are transmitted and whether or not they cause any harm.

How was the fine set, and what must Meta do?

According to the BBC and ECO, the regulator weighed several factors in setting the amount:

• the high number of people affected, about 20 million smartphone users according to the BBC;
• the duration of the infringement, and the fact that, according to the BBC, it is still ongoing for those who have not updated the app and for those who have already given their consent to the system;
• a previous procedure against the company in 2019, according to ECO;
• Meta's lack of co-operation during the investigation, cited by both the BBC and ECO.

ECO says the only mitigating circumstance was the changes Meta introduced after the complaint, which the authority judged late and limited to users who update the app. ECO also calculates that €805m represents about 0.47% of the group's worldwide turnover.

Beyond the money, Meta has 60 days to disable the feature by default, according to both the BBC and ECO. ECO specifies that this applies even to users who already granted gallery permission: Meta must request specific consent for this tool and explain how it can be switched off. The investigation itself began in July 2025 after a complaint from a consumer-protection association in Bolzano, in northern Italy, according to ECO and Bright.

What does Meta say?

A Meta spokesperson told the BBC that the company plans to appeal. According to the BBC, Meta says it strongly disagrees with the regulator's assessment of the facts, its application of the law and the disproportionate level of the fine. It describes a straightforward feature that helps people post photos and videos to Facebook, which can only operate once people grant permission on their device, and whose permission they can change at any time in their settings. The appeal means the final outcome is not settled.

Is this an artificial intelligence case?

Not on the evidence we have read. None of the three articles says the photos were used to train an AI model or fed to a generative assistant. They describe a suggestion function, and the BBC, ECO and Bright all frame the case as a privacy and consent violation. Presenting it as an AI-training scandal would go beyond the sources.

The link with AI is therefore indirect, and it is our reading, not a finding of the regulator. The principle reported by ECO is general: access to data stored on a device requires specific, free and informed consent. Any assistant or generative feature that wants to read a phone gallery, whether to suggest posts, sort pictures or edit them, depends on the same kind of permission. A single catch-all authorisation, switched on by default, is exactly what the Italian authority criticised here.

The BBC also recalls that, last month, Meta was hit with its largest fine ever for its business practices: a US judge in New Mexico ordered it to pay $25bn after finding that it had spent years lying to the public about how it handled Facebook user data. That is a separate case, but it shows the pressure on the company over user data.

What does it change for a UK business?

The decision was taken under the Italian Privacy Code, so it does not bind a company in the United Kingdom. It nonetheless shows what a European regulator is prepared to examine and sanction. A British company that builds a mobile app, or adds an AI function to one, can use this case as a checklist:

• Ask for photo-gallery access separately from other permissions, and say plainly which feature uses it.
• Do not leave such a permission on by default, and do not rely on one app-wide authorisation to cover several features.
• Be able to show, for each feature, which data are read and what for, because the Italian authority objected that nobody could verify it.
• Give users a simple way to withdraw the permission and keep records of the consent obtained.

Caution is needed on the sources: our account rests on press reports from the BBC, ECO and Bright, not on the text of the Italian decision itself, which we have not read, and Meta has announced an appeal.