Italy Fines Meta €805 Million Over How Facebook Reaches Into Your Photos

Italy's data protection authority, a government watchdog that polices how companies handle personal information, has fined Meta Platforms Ireland Limited 805 million euros, about $887 million. The fine concerns how the Facebook app gets access to users' photos on Android phones. The fine equals 0.47 percent of Meta's global revenue, according to Engadget, which reported the decision on 15 November 2026.

The authority found that Meta had not clearly told users that the Facebook app could see their photos, videos and related metadata. Metadata is the hidden information attached to a picture, such as when it was taken. The access supports a feature called "Camera roll sharing suggestions," which picks photos or videos from your phone's photo library and offers them as options for a Facebook post.

According to the Italian authority, Facebook asked for access to the photo gallery through one permission request. That single request covered the whole app, even though the app does many different things. The regulator said this gave Facebook broad, ongoing access without asking for specific consent and without properly explaining what it was for.

The order goes further than the fine. Meta has 60 days to ask users for separate consent for the suggestion feature. The request must explain what the feature does and how to turn it off. The authority also ordered Meta to switch the feature off by default. That change applies even to people who had already accepted the general permission. Users must be told clearly that they are allowing their photo gallery to be used for post suggestions.

The investigation began in July 2025, after a complaint from the Bolzano Consumer Protection Centre. Meta is reportedly planning to appeal.

The core problem is bundling. One permission that covers several features gives people no practical way to know, at the moment they agree, which feature is looking at their photos and why. Think of it like handing a hotel valet your entire key ring when you only needed the car parked. The regulator's position, as reported, is that consent must be tied to a specific purpose. For engineers, that means separate consent steps for each purpose, separate switches for each function, and a clear record of what each permission allowed.

The broader context here is that default settings cause most of the friction. A feature that scans your recent photos feels acceptable when you understand that it is happening. Once the feature is off unless you turn it on, and it is clearly labelled, the same tool becomes a choice rather than something running in the background. The cost of this change falls mainly on the product teams who decide default settings, onboarding screens and permission prompts, rather than on the security or infrastructure teams.

In my view, the penalty is more instructive when compared with the company's revenue. At 0.47 percent of global revenue, it is small next to the headline number. The 60-day deadline to ask again and reverse the default is likely to matter more, because it will shape how other apps design their access to photo libraries. It is not yet known whether the appeal will change either part of the decision.

Done well, this kind of consent design lets a photo app be genuinely useful. Imagine someone who wants help putting together a post from a week of holiday photos. They can ask for that help, allow access for that one purpose, and turn the access off later. That is a workable model for the industry, and the Italian order points in that direction.