Italy Fines Meta 805 Million Euros Over Facebook's Android Photo Access

Italy's data protection authority has fined Meta Platforms Ireland Limited 805 million euros, about $887 million, over how the Facebook app gets access to users' photos on Android devices. The fine equals 0.47 percent of Meta's global revenue, according to Engadget, which reported the decision on 15 November 2026.

The authority found that Meta had not specifically disclosed its access to user photos, videos and related metadata (the descriptive data attached to each file, such as capture time and location) for Facebook users on Android. That access powers the "Camera roll sharing suggestions" feature, which recommends photos or videos from a phone's photo library for posting to Facebook.

According to the authority, access to the photo gallery was granted through one permission request covering the entire Facebook app, even though the app spans multiple functions. The regulator said this approach allowed broad, ongoing access without specific consent and without properly informing users.

The order goes beyond the fine. Meta has 60 days to obtain separate, specific consent for the suggestion feature, explaining what it is for and how to disable it. The authority also ordered Meta to switch the feature off by default, including for users who had already accepted the general permission request. Users must be made clear that they are authorizing media gallery access for post suggestions. The investigation began in July 2025 after a complaint from the Bolzano Consumer Protection Centre. Meta is reportedly planning to appeal the fine.

The core of the case is the bundling. A single grant covering several features gives the user no practical way to judge, at the moment of consent, which feature is reading the library and why. The regulator's position, as reported, is that consent must be scoped to its purpose. For engineering teams, that means per-purpose consent flows, separate toggles for discrete functions, and a clear record of what each permission actually authorized. A bundled grant works like a hotel key card that opens every room when you only asked for the gym.

The broader context here is that default-on behavior is where most of the friction sits. A suggestion feature that scans recent photos is only as acceptable as the user's understanding that the scan is happening. Once a feature is opt-in and clearly labelled, the same functionality becomes a choice rather than a background process. The compliance cost falls mainly on the product side, where defaults, onboarding copy and permission prompts are set, rather than on the security or infrastructure teams.

In my view, the more instructive part of the decision is the size of the penalty relative to the revenue base. At 0.47 percent, the fine is modest against the headline figure. The number will draw attention, but the operational requirement, a 60-day window to re-collect consent and reverse a default, is what will shape how other platforms design gallery access. Whether the appeal changes either element is not yet known.

There is a more hopeful reading of the same design. A user who wants help assembling a post from a holiday's worth of pictures can ask for that help, grant access for that purpose, and revoke it later. That is a workable model for the industry, and the Italian order points toward it.