The Italian national regulator for the protection of personal data — Garante per la protezione dei dati personali (GPDP) — has issued a ruling imposing a fine of 805 million euros on the Meta corporation. The authority announced this decision on Saturday, November 14, 2026. According to the supervisory body, the Facebook app for Android devices had been gaining unrestricted access to photos, videos, and associated metadata in the smartphone galleries of Italian users for several years without requesting separate and informed consent. The fine amounts to approximately 0.47% of Meta’s global turnover and, according to the GPDP, reflects the scale of the violation: the regulator estimates that approximately 20 million Android users in Italy were affected.
How the controversial feature worked
The core of the investigation was a feature titled “Get suggestions from your gallery while viewing Facebook,” available to Android smartphone owners since 2023. The mechanism analyzed the contents of the device's photo and video gallery and, based on this, suggested specific photos and clips for the user to publish on the social network. According to the GPDP, to implement this feature, the app requested a single permission that automatically applied to several related mechanisms without explaining to the user that access was effectively being granted to the entire device photo archive. Furthermore, the feature was enabled by default, and the permission granted allowed Facebook to access not only the files the user intended to publish but also the rest of the gallery's contents.
Violation of transparency and traceability principles
The regulator emphasized that Meta violated provisions of the European General Data Protection Regulation (GDPR) in several ways. Firstly, users did not receive a clear and understandable explanation that a single permission opened access to all photos and videos on the device, rather than just those they intended to upload. Secondly, smartphone owners had no way to verify or track which specific files the Facebook app accessed during any given period. Thus, the principle of transparency in the processing of personal data, enshrined in European law, was breached.
Regulator requirements and deadlines
Under the GPDP ruling, Meta is required to change the functionality of the Facebook app on Android within 60 days. Specifically, the company must implement a separate consent request that clearly and in plain language explains the purpose of the feature, the scope of access provided, and how to disable it. The “Get suggestions from your gallery” feature must remain inactive by default for all users, including those who had previously granted the app permission to access their photo and video gallery. In addition to the 60-day deadline to change functionality, the GPDP set additional deadlines: 30 days to notify the regulator that work on implementing the orders has begun, and 90 days to provide a report on the measures taken.
Investigation timeline and aggravating circumstances
The investigation was initiated in July 2025 following a complaint from the Consumer Protection Center in Bolzano. Based on the findings, the GPDP established that the company failed to ensure the acquisition of separate, informed consent for the processing of each type of personal data. The regulator cited “limited cooperation from the company with the investigation” as an aggravating circumstance. It was the combination of factors — the scale of the audience of 20 million people, the duration of the controversial feature since 2023, and the insufficient degree of interaction with the supervisory body — that led to the setting of the fine at 805 million euros.
Context: European regulation of digital platforms
The decision of the Italian regulator fits into a general trend of tightening control over personal data processing practices by large technology companies within the European Union. The 805 million euro fine is one of the largest in the history of GDPR enforcement and demonstrates the readiness of national supervisory bodies to hold corporations accountable when their apps obtain excessive access to users' personal data by default. For Meta, which has already faced sanctions from European regulators, this decision could set a precedent for similar audits in other EU jurisdictions where the “gallery suggestions” feature was also available to Android users.
