What's Happening?
On November 14, 2026, the Italian Data Protection Authority (Garante Privacy) imposed an €805 million (approximately $887 million) fine on Meta Platforms Ireland Limited. The fine stems from findings that the Facebook app for Android accessed users' private
photo galleries, videos, and metadata without explicit, informed consent. The investigation, initiated in July 2025 following a complaint, revealed that a feature titled “Get suggestions from gallery when browsing Facebook,” introduced in 2023, requested blanket permission for gallery access. This single permission covered multiple app functions, which the regulator deemed insufficient under national data protection legislation and the European ePrivacy Directive. The authority estimates that around 20 million Android users in Italy may have been affected by this breach. Meta has been given 60 days to modify the feature, disable it by default, and implement a separate consent request for its use.
Why It's Important?
This substantial fine underscores the increasing global scrutiny on tech companies regarding user data privacy and consent. For U.S. tech giants like Meta, such penalties from European regulators highlight the significant financial and reputational risks associated with non-compliance with stringent data protection laws like the ePrivacy Directive. The ruling reinforces the principle that general authorization for data access is insufficient; specific, voluntary, and informed consent is required for each distinct use of personal data. This could prompt Meta and other U.S. companies operating internationally to re-evaluate their consent mechanisms and data handling practices across all their platforms, potentially leading to more transparent and granular user permissions globally. The lack of cooperation from Meta during the audit was also cited as a factor in the penalty, signaling that regulatory bodies expect full cooperation during investigations.
What's Next?
Meta Platforms Ireland Limited has 60 days from the November 14, 2026, ruling to disable the problematic feature by default and implement a system for obtaining separate, explicit consent for its use. The company is also required to notify the Italian regulator of its initiated measures within 30 days and the implemented changes within 90 days. If users do not provide proper consent after the 60-day period, the feature must not be activated for them. The Italian regulator has also reserved the right to conduct a separate audit on another feature launched in 2026, which processes smartphone gallery content using cloud technology, indicating ongoing scrutiny of Meta's data practices. Meta has not yet commented on the new fine.
Beyond the Headlines
The Italian regulator's decision extends beyond a mere financial penalty, delving into the fundamental principles of digital privacy and user autonomy. The ruling emphasizes that a smartphone's gallery is considered part of a person's private sphere, requiring robust protection. This case could set a precedent for how 'consent' is defined and enforced in the digital age, particularly concerning bundled permissions where users unknowingly grant broad access. While the current investigation did not cover the use of photos and videos for training artificial intelligence models, the regulator's reservation to audit cloud-based photo processing features suggests a growing concern about the broader implications of data usage, including for AI development. This could lead to future regulations specifically addressing the ethical and legal boundaries of AI training data derived from user content.
