ROME — Italy’s data protection authority has imposed an €805 million, roughly $887 million, fine on Meta Platforms after concluding that Facebook improperly accessed photographs, videos and associated metadata stored on the smartphones of millions of Italian Android users without obtaining sufficiently specific consent or clearly explaining what information the app would be able to see. The sweeping enforcement action, announced Saturday, November 14, targets a Facebook feature that draws on material stored in a user’s private phone gallery to suggest photographs and videos that might be shared on the social network, and it has become one of the most consequential European privacy penalties imposed on Meta in recent years.

The Italian Data Protection Authority, known as the Garante, said the affected function is called “Get suggestions from gallery when browsing Facebook” and has been available since 2023. When enabled, the feature analyzes material stored in a user’s device gallery and surfaces photographs or videos inside Facebook as possible posts, effectively extending the app’s access beyond content a user has deliberately uploaded to the social network. According to the regulator, the problem was not simply that Facebook could access gallery content, but that Meta relied on a broad permission covering multiple app functions instead of requesting distinct, clearly explained consent for the gallery-suggestion feature itself.

The authority said the permission process was preceded by generic wording about enabling additional features, which did not make sufficiently clear that users were also authorizing Facebook to access their personal photo and video libraries for this specific purpose. The regulator also found that the gallery-suggestion function was configured as active by default, meaning users who had already granted Facebook wider device permissions could have the feature operating without separately choosing to turn it on. In the authority’s view, that structure prevented users from making a free and informed decision about whether material that had never been uploaded to Facebook should be available to the app for content suggestions.

The decision applies to Meta Platforms Ireland Limited, the entity responsible for Facebook services across much of Europe, and affects an estimated 20 million Android users in Italy. The regulator said the scale of the affected population was a major factor in setting the size of the penalty, alongside the length of the infringement, Meta’s previous privacy history and what the authority described as insufficient cooperation during the investigation. The €805 million fine amounts to approximately 0.47 percent of Meta’s global revenue, according to the Garante.

The enforcement action is not limited to a financial penalty. Meta has been ordered to change how the feature operates within 60 days. The company must keep the gallery-suggestion function disabled by default, obtain separate and specific consent before activating it and explain clearly that the feature involves access to photographs, videos and metadata stored on a user’s device. The regulator also directed Meta to explain how users can deactivate the function and said that if the company fails to make the required changes within the deadline, the feature cannot be activated for users who have not provided valid consent.

Meta must also inform the Italian regulator within 30 days about the steps it has started taking and provide a further report within 90 days detailing the measures adopted to comply with the ruling. Those obligations give the decision a practical significance beyond the size of the fine because they force Facebook to redesign part of its consent architecture for Italian users rather than simply treating the case as a historical violation.

The investigation began in July 2025 following a complaint from the Consumer Protection Centre in Bolzano, which raised concerns that Facebook could access photographs and videos users had not chosen to publish. The Italian authority then carried out its own technical examination of the app. That analysis led regulators to focus on the difference between a general operating-system permission allowing an app to access a phone’s gallery and a legally valid consent specifically authorizing a particular use of that information.

That distinction lies at the heart of the ruling. Smartphone users routinely give apps access to cameras, microphones, contacts, location data or media libraries, but regulators increasingly insist that broad technical permission does not automatically satisfy privacy-law requirements for every possible use of the underlying information. A person may grant Facebook access to a device gallery because they want to upload a photograph, for example, without necessarily intending to authorize the app to continuously inspect their stored media and use it to generate posting suggestions.

The Garante said Article 122 of Italy’s Privacy Code, which implements the European Union’s ePrivacy rules, protects information stored on smartphones as part of a person’s private sphere. Under that framework, access to information stored on a device requires free and informed consent regardless of whether the information is ultimately transmitted elsewhere or whether the user can demonstrate specific financial or personal harm from the access itself.

The authority rejected Meta’s argument that the Irish Data Protection Commission should have primary jurisdiction over the case because Meta’s European headquarters are in Ireland. Italy said the ePrivacy rules at issue do not operate under the same one-stop-shop mechanism used for some cases under the European Union’s General Data Protection Regulation, meaning the Italian regulator considered itself competent to investigate and impose sanctions directly.

That jurisdictional point is important because Meta and other major technology companies have frequently argued that cross-border European privacy disputes should be handled principally through the regulator in the country where their main EU establishment is located. National authorities, however, retain separate powers under some telecommunications and ePrivacy rules, allowing countries such as Italy to bring cases independently in certain circumstances.

The regulator also stressed that the decision did not determine whether photographs and videos accessed through the gallery feature were used to train Meta’s artificial intelligence systems. Meta has denied using the content covered by this investigation for AI training, and the Garante said the matter before it did not examine that question. The authority nevertheless reserved the right to conduct a separate investigation into a newer feature introduced in 2026 that allows material from users’ galleries to be processed through Meta’s cloud systems.

That newer AI-related functionality has already attracted privacy attention because it can offer users creative suggestions such as collages, edited photographs, themed collections or other AI-generated content based on media stored on their phones. In prompts associated with the function, Facebook has told users that cloud processing may involve analyzing selected media, including image content and facial features, to generate personalized ideas. Meta says users must actively agree to its AI terms for that newer feature, but Italy’s regulator has made clear that it may separately examine whether the consent and processing arrangements comply with European law.

The distinction between the older gallery-suggestion feature and the newer cloud-based AI processing is therefore crucial. Saturday’s €805 million fine concerns the earlier system that has been available since 2023 and the way Facebook obtained access to local photos, videos and metadata on Android devices. The regulator has not yet issued a ruling that Meta unlawfully used those photographs to train AI models, and reporting the case that way would go beyond what Italian authorities have established.

The ruling nevertheless arrives at a sensitive moment for Meta as technology companies rapidly expand AI systems that require access to large quantities of personal information. Consumers are increasingly being asked to allow apps to analyze photographs, conversations, documents, voice recordings and other private data in exchange for personalized services. Regulators across Europe are responding by demanding clearer distinctions between data that users consciously upload and information that remains stored privately on their devices.

For many users, a smartphone gallery is among the most sensitive forms of digital storage. It may contain family photographs, screenshots, identification documents, medical information, intimate images, travel records or material never intended for public distribution. Metadata attached to photographs and videos can also reveal dates, device information and sometimes location or other contextual details. The Italian regulator’s decision effectively treats access to that private archive as materially different from access to content a user has intentionally posted to Facebook.

The issue is especially significant because the Garante said that once full gallery permission is granted, the Facebook app can potentially read the entire photographic archive on the device, often on an ongoing basis. The authority said neither users nor the regulator had sufficient visibility into exactly which information was being used by the suggestion system, reinforcing its conclusion that a broad permission was not enough.

Meta made changes to the feature after the complaint was filed, according to the regulator, but those changes were considered too late and too limited to eliminate the violation. The authority did treat the modifications as a mitigating factor when calculating the penalty, but it said they applied only to users who had updated the app and did not fully resolve the consent problem for people who had already granted access.

The regulator also cited what it described as poor cooperation by Meta during the investigation as an aggravating factor, along with a previous 2019 enforcement decision involving the company. Meta had not issued a detailed public response to Saturday’s ruling at the time of publication, and Reuters reported that the company was not immediately available for comment. It therefore remains unclear whether Meta will challenge the fine in court, although large technology companies routinely appeal major European regulatory penalties.

The size of the sanction reflects the increasingly aggressive stance European regulators have taken toward privacy and digital-platform practices. Meta has faced numerous investigations and fines across the European Union involving advertising, data transfers, targeted marketing, consent and competition. The latest Italian action adds another front to that regulatory pressure and focuses specifically on the boundary between operating-system permissions and privacy-law consent.

That boundary could have implications well beyond Facebook. Many mobile applications rely on one-time operating-system permissions to access photographs, contacts or other device resources for multiple functions. If regulators increasingly require separate consent for each materially different use, technology companies may have to redesign permission systems so users can make more granular choices rather than granting broad access to an entire application.

The decision also highlights a broader shift in European privacy enforcement away from simply asking whether companies technically obtained permission and toward examining whether users genuinely understood what they were agreeing to. Consent under European law is expected to be specific, informed and freely given. A permission screen that is vague, bundled with unrelated functions or switched on by default can therefore be challenged even where a user technically clicked “allow.”

Default settings have become particularly important in regulatory analysis because most users do not manually inspect every privacy control inside an app. When a feature is activated automatically, regulators often view that design choice as giving the company an advantage over the user’s ability to make a meaningful decision. Italy’s order requiring Meta to keep the feature off by default reflects that concern directly.

From Meta’s perspective, features that recommend photographs from a device gallery can make Facebook more convenient by reminding users of content they may wish to share. Such systems can help increase engagement by reducing the effort required to create posts, particularly as social platforms compete with newer video and messaging services for user attention. The regulatory dispute arises not from the basic existence of the feature but from how access to the private gallery was authorized and explained.

That distinction means the Italian order does not ban Facebook from offering gallery-based sharing suggestions. Instead, it requires Meta to obtain consent in a more explicit way and ensure that users consciously choose whether the function should be active. The company can continue offering the feature if it satisfies those requirements.

The economic scale of the penalty is still notable. At €805 million, the sanction is among the largest privacy-related fines ever imposed by an Italian authority and represents a serious enforcement action even for a company as large as Meta. The regulator calculated the amount partly by reference to Meta’s worldwide revenue, a practice designed to ensure that sanctions against multinational technology companies remain significant rather than becoming a routine cost of doing business.

For investors, however, the immediate financial impact is likely to be weighed against Meta’s enormous annual revenue and cash generation. The more consequential issue could be whether similar regulators elsewhere in Europe examine the same feature and reach comparable conclusions. If the consent mechanism was deployed across multiple countries, Meta could face additional investigations or be forced to make broader product changes beyond Italy.

The ruling could also intensify debate over whether platform companies should have any ongoing access to unpublished material stored on users’ phones unless that access is clearly necessary for a function the user has deliberately chosen. Privacy advocates have long argued that social networks should minimize data collection rather than treat device permissions as open-ended authorization.

Italy’s decision reinforces the concept of data minimization by emphasizing that users should know not only what an application can technically access but why it is accessing the information and what it intends to do with it. For photographs and videos that may contain highly personal information, regulators are increasingly demanding a higher level of transparency.

The case also illustrates how artificial intelligence is making older privacy questions more urgent. A gallery permission that once simply allowed users to select an image for upload can now potentially support automated analysis, facial recognition, content categorization, creative generation and personalized recommendations. As the number of potential uses expands, the legal argument that one broad consent covers everything becomes increasingly difficult to sustain.

Meta’s newer cloud-processing feature will therefore be closely watched. Italy’s Garante has specifically said it reserves the right to conduct separate checks into that system, and any future investigation could focus on what content is uploaded, how long it is retained, whether it is used for model development and whether facial or other sensitive information is processed.

The company has publicly denied that the gallery content examined in the current proceeding was used to train its AI models. Until regulators establish otherwise, that denial should be treated separately from the proven findings about consent and transparency. The distinction matters because allegations about AI training carry different legal and reputational consequences from unauthorized device access.

For Italian Facebook users, the most immediate consequence will be a change in how the gallery-suggestion feature appears. Meta must switch it off by default and ask for explicit consent before it can operate. Users who previously granted broader access should also see the feature disabled unless valid specific consent is obtained under the regulator’s order.

The ruling provides a useful practical reminder for users elsewhere as well. Smartphone permissions should be reviewed periodically, particularly for applications with access to photos, microphones, location or contacts. Granting full photo-library access can allow an app to view substantially more information than users may realize, even where the immediate purpose appears as simple as uploading one image.

The case is likely to become an important reference point in future debates over app permissions, privacy and AI. It demonstrates that regulators are increasingly unwilling to accept a difference between what an app is technically allowed to access under a phone’s operating system and what a company is legally entitled to use under privacy law.

For Meta, the €805 million penalty now creates both a financial and product-design challenge. The company must decide whether to contest the ruling, while simultaneously changing the feature within the regulator’s deadlines unless enforcement is suspended through an appeal. It must also prepare for possible scrutiny of the newer cloud-based gallery functions that increasingly integrate Facebook with Meta AI.

The wider implication is that the boundary between private device storage and social media platforms is becoming a major regulatory battleground. Users increasingly expect applications to offer sophisticated personalization, but regulators are insisting that convenience cannot replace consent. The more deeply technology companies reach into the private contents of phones, the more clearly they will be expected to explain what they are doing and give users a genuine opportunity to say no.

Italy’s ruling sends that message in unusually expensive terms. By imposing a fine approaching $900 million and ordering Facebook to redesign its gallery-access consent process, the Garante has made clear that unpublished photographs and videos stored on a smartphone remain part of a user’s private digital sphere even when an app has broad technical permission to view them. As Meta pushes further into AI-driven personalization, the decision could become an important test of how much control European regulators expect consumers to retain over data that never leaves their phone by deliberate choice.