Italy Fines Meta €805 Million: How Facebook Accessed Users’ Private Photos Without Proper Consent

OPEN CHRONICLE | GLOBAL NEWS DESK | TECHNOLOGY & DIGITAL RIGHTS

Italy’s privacy regulator has imposed a major penalty on Meta after finding that a Facebook feature accessed photographs, videos and metadata stored on Android smartphones without sufficiently informing users or obtaining specific consent. The decision, potentially affecting around 20 million people in Italy, raises fundamental questions about digital privacy, mobile app permissions and the limits of Big Tech’s access to personal information.

By Open Chronicle News Desk

November 14, 2026 | Special Report | Technology, Privacy & Digital Regulation

1. A Major Privacy Ruling Against One of the World’s Biggest Technology Companies

Italy has delivered a significant regulatory blow to Meta, the parent company of Facebook, Instagram and WhatsApp, imposing a €805 million penalty over the way Facebook accessed personal photographs and videos stored on Android smartphones.

The decision was announced on November 14 by the Italian Data Protection Authority, known as the Garante per la protezione dei dati personali.

According to the regulator, Meta failed to obtain sufficiently specific and informed consent before accessing photographs, videos and associated metadata through a Facebook feature designed to suggest content that users might want to publish.

The case concerns the boundary between information people deliberately share on social media and material they choose to keep privately on their devices.

That boundary is central to the modern digital economy.

Smartphones contain far more than public social media content. Their photo galleries may include family photographs, medical documents, identity records, private correspondence, workplace information and images never intended for publication.

The Italian ruling challenges the assumption that granting an application general access to a phone’s media library necessarily constitutes meaningful consent for every use of that access.

For Meta, the financial consequences are substantial.

For users, the implications are potentially more important.

The decision raises a fundamental question about the relationship between digital platforms and the private information stored on personal devices.

2. How Facebook’s Photo Gallery Feature Worked

At the center of the investigation is a Facebook feature introduced in 2023.

Known as Get suggestions from gallery when browsing Facebook, the function was designed to recommend photographs and videos from a user’s smartphone gallery as potential social media posts.

The feature appeared within the Facebook application for Android devices.

Its purpose was to make sharing content easier by identifying photographs and videos that users might want to publish.

In principle, such a function can be useful.

A person browsing Facebook might receive a suggestion to share a recent holiday photograph, a family celebration or another image stored on their phone.

However, the regulator found serious problems with the way access was authorized.

Rather than obtaining separate consent specifically for gallery suggestions, Facebook relied on a broader application permission covering several different functions.

The authorization process was accompanied by a generic explanation that did not clearly communicate the full purpose of the access.

The feature was also enabled by default.

According to the Italian authority, this combination prevented users from making a sufficiently informed decision about whether they wanted Facebook to access their personal media for that particular purpose.

The problem was therefore not simply that Facebook offered suggestions.

It was that users were not given the level of control and explanation required by the applicable privacy rules.

3. Why General Permission Was Not Enough

The investigation highlights an important distinction in digital privacy law.

A smartphone operating system may ask whether an application is allowed to access photographs or videos.

But permission at the operating system level does not automatically establish that a person has consented to every possible use of that information.

The Italian regulator concluded that Meta’s authorization process failed to distinguish adequately between different purposes.

Users were effectively being asked to grant broad access without receiving sufficiently clear information about the specific gallery suggestion function.

This matters because personal media libraries can contain information that is considerably more sensitive than the content people normally choose to publish.

A photograph may reveal where someone lives.

A video may contain images of children or family members.

Metadata can reveal information about when and where a file was created, depending on the device and its settings.

Even when a platform does not publicly share such material, the ability to access it raises privacy questions.

The regulator emphasized that the legal requirement for informed consent applies to access itself.

It does not depend on proving that the information was subsequently published, transmitted to a remote server or used to cause measurable harm.

That interpretation is particularly significant for the wider technology industry.

It suggests that companies cannot rely solely on broad technical permissions when a feature requires access to information stored in a user’s private digital environment.

4. Around 20 Million Android Users Potentially Affected

The Italian authority estimated that approximately 20 million Android users in Italy were potentially affected by the feature.

The figure was one of the factors considered when determining the penalty.

However, it is important to distinguish the population potentially exposed to the practice from the number of individual users whose photographs were actually accessed.

The regulator did not establish in its public announcement that every person within the estimated group had the same experience.

Nor did it publish a verified count of photographs or videos accessed.

The scale of the potential exposure nevertheless explains why the case attracted significant regulatory attention.

Facebook remains a major digital platform.

When a feature is incorporated into an application used by millions of people, problems with its consent mechanisms can have consequences far beyond isolated individual complaints.

A design decision made at platform level may affect an enormous number of devices.

The Italian ruling therefore illustrates how seemingly small choices in application design can become major questions of consumer protection and digital rights.

5. The Investigation Began With a Consumer Complaint

The case originated in July 2025, following a complaint from a consumer protection organization in Bolzano, northern Italy.

The organization raised concerns about Facebook’s access to personal media stored on Android smartphones.

Italian regulators subsequently conducted a technical investigation into the operation of the gallery suggestions feature.

The inquiry examined how permissions were requested, how users were informed and whether the feature could be considered genuinely optional.

The findings led the authority to conclude that Meta had breached the relevant provisions of Italian privacy law.

The investigation also considered the changes Meta introduced after the complaint.

According to the regulator, those adjustments were insufficient.

Some improvements applied only to users who updated the application, while the underlying consent concerns remained unresolved for other users.

The authority also cited what it characterized as limited cooperation from Meta during the investigation.

These findings contributed to the final penalty.

The case demonstrates the potential influence of consumer organizations in challenging practices adopted by major technology companies.

It also illustrates the importance of technical investigations that examine how applications actually behave, rather than relying exclusively on their published privacy policies.

6. Why Italy Imposed an €805 Million Fine

The penalty is one of the most substantial privacy sanctions imposed by an Italian authority.

The regulator said the amount reflected several factors.

These included the scale of the potentially affected population, the duration of the infringement and the nature of the information involved.

The authority also considered a previous regulatory action against Meta in 2019 and its assessment of the company’s cooperation during the investigation.

According to the official announcement, the fine represents approximately 0.47% of Meta’s worldwide turnover.

The calculation illustrates the financial significance of modern privacy enforcement.

For major digital platforms, penalties linked to global revenue can reach hundreds of millions of euros.

Yet the broader purpose of such enforcement is not simply to impose financial costs.

Regulators also seek to change corporate behavior.

In this case, the Italian authority ordered Meta to redesign how the gallery suggestions function obtains consent.

The decision therefore combines a substantial financial penalty with operational requirements intended to give users greater control.

Meta may challenge the decision through the available legal procedures.

As of the reporting reviewed for this article, the company had not issued a detailed public response to the penalty.

7. Meta Has 60 Days to Change the Feature

The regulator imposed a series of requirements affecting how Facebook’s gallery suggestions function operates.

Within 60 days, Meta must ensure that the feature is disabled by default.

Users must receive a separate and specific request for consent before the function can access their gallery for that purpose.

The explanation must clearly identify what the feature does, why it requires access and how it can be disabled.

The requirement also applies to users who previously granted broader application permissions.

This is an important distinction.

An earlier decision to allow Facebook access to photographs cannot automatically be treated as continuing authorization for a separate feature if the original consent was not sufficiently specific.

Meta must also inform the Italian regulator about its response.

The authority requires an initial communication within 30 days and a further report on implemented measures within 90 days.

If the necessary changes are not made, the gallery suggestions feature cannot be activated for users who have not provided valid consent.

These requirements could influence how similar functions are designed across other applications.

They reinforce a principle that privacy controls should be understandable, specific and genuinely optional.

8. The European Privacy Law Behind the Decision

The case is particularly interesting because it involves the relationship between European Union privacy rules and national regulatory authority.

The Italian regulator relied on Article 122 of Italy’s Privacy Code, which implements provisions of the European ePrivacy framework.

The authority emphasized that smartphones form part of an individual’s private sphere.

Access to information stored on such devices therefore requires appropriate consent.

Meta challenged the Italian authority’s jurisdiction, arguing that responsibility should fall to the Irish regulator.

Meta Platforms Ireland Limited is the European entity involved in the case.

However, the Italian authority rejected that objection.

It concluded that the relevant ePrivacy provisions do not operate under the same centralized supervisory arrangements associated with certain aspects of the General Data Protection Regulation.

The distinction matters because it can allow national authorities to enforce particular privacy requirements even when a major technology company maintains its European headquarters in another member state.

For the European Union, the case highlights the complexity of regulating digital platforms through overlapping legal frameworks.

For technology companies, it reinforces the need to understand not only the GDPR but also national laws implementing European communications privacy rules.

9. Was Facebook Using Private Photos to Train Artificial Intelligence?

One of the most sensitive questions surrounding the case concerns artificial intelligence.

Could photographs accessed through the gallery suggestions feature have been used to train Meta’s AI systems?

The Italian investigation did not establish that such use occurred.

The regulator explicitly stated that its proceedings did not examine whether the photographs and videos were used to train artificial intelligence models.

Meta has denied using the material for that purpose.

It would therefore be inaccurate to present the €805 million penalty as evidence that Meta trained AI models on users’ private photographs.

The regulatory findings concern consent and access to personal media.

They do not establish a separate AI training violation.

However, the authority identified another issue that may require future examination.

In 2026, Meta introduced a feature allowing certain gallery content to be processed through cloud infrastructure.

The Italian regulator said it reserved the right to investigate that function separately.

The distinction between local device access and cloud processing is important.

When photographs remain on a smartphone, users may have different expectations about privacy than when information is transferred to remote infrastructure.

Any assessment of cloud processing would require specific evidence about the feature’s design, user authorization, data handling and safeguards.

For now, the AI question remains separate from the confirmed findings in this case.

10. What the Ruling Means for Ordinary Facebook Users

The immediate regulatory decision concerns Facebook’s Android application in Italy.

However, the underlying privacy questions are relevant to smartphone users everywhere.

Many applications request access to photographs, videos, contacts, microphones or location information.

Sometimes that access is essential for the service.

At other times, it supports optional functions that users may not realize are enabled.

The Italian case demonstrates why users should understand the difference between granting an application technical permission and agreeing to a particular use of personal information.

A useful precaution is to review the permissions granted to frequently used applications.

On Android devices, users can generally inspect application permissions through the system settings, although the available controls depend on the Android version and device manufacturer.

Where supported, users may be able to grant access only to selected photographs rather than an entire media library.

Users should also review optional features within applications, particularly those involving automatic suggestions, cloud processing or personalized recommendations.

These steps do not replace a company’s legal responsibilities.

The burden of obtaining valid consent remains with the organization requesting access.

But greater awareness can help individuals make more informed choices about their personal information.

11. A Warning to the Global Technology Industry

The significance of the Italian decision extends beyond Meta.

Modern digital services increasingly depend on access to personal information stored on mobile devices.

Applications use photographs, location data, behavioral signals and other information to offer personalized experiences.

Artificial intelligence is accelerating this trend.

Features that automatically organize, recommend, edit or summarize personal content may require increasingly sophisticated access to information.

This creates an important regulatory challenge.

How can technology companies deliver convenient services without making consent so broad or confusing that users lose meaningful control?

The Italian ruling suggests that regulators will examine not only whether a permission exists but also whether it was obtained for a clearly explained purpose.

Default settings are particularly important.

A function that is enabled automatically may expose users to data processing they would not have actively chosen.

By requiring Meta to disable the gallery suggestions feature by default, the regulator is placing greater emphasis on affirmative user choice.

The wider message is that privacy should be incorporated into product design rather than treated as a secondary legal requirement.

12. What Happens Next?

Several developments will determine the broader consequences of the decision.

Meta’s response will be the first major indicator.

The company may appeal the penalty, comply with the operational requirements or pursue both approaches.

The Italian authority will also monitor whether the gallery suggestions feature is redesigned in accordance with its instructions.

A second question concerns the possible investigation of the cloud processing function introduced in 2026.

That inquiry, if pursued, would involve distinct technical and legal issues.

A third question is whether regulators elsewhere in Europe examine similar features or consent mechanisms.

The Italian decision does not automatically establish violations in other countries.

Different authorities would need to assess the applicable law and the relevant facts.

Nevertheless, the case may influence regulatory expectations about how major platforms request access to information stored on smartphones.

Finally, the ruling could affect the design of future AI-enabled mobile applications.

As more services integrate personal media into automated features, the distinction between user convenience and meaningful privacy control will become increasingly important.

Conclusion | The Smartphone Is Not an Open Data Library

Italy’s €805 million penalty against Meta represents more than another financial sanction against a major technology company.

It addresses a fundamental question about ownership, access and control in the digital age.

A person may choose to use Facebook without intending to make their entire photo gallery available for optional platform features.

The existence of a general application permission does not necessarily mean that the person has understood or accepted every use of that access.

The Italian regulator has made that distinction central to its decision.

The case also demonstrates the importance of separating established findings from speculation.

The authority found failures involving consent for access to photographs and videos.

It did not establish that the material was used to train artificial intelligence systems.

As digital platforms become more deeply integrated into personal devices, the principles at stake will only become more important.

The central lesson is straightforward: the information stored on a smartphone remains private unless the user has been given a genuine, informed choice about how it will be accessed.