Italy’s data protection authority has fined Meta €805m because a default-on Facebook feature on Android read users’ photo galleries without proper consent. The decision rests on device-access rules rather than GDPR, and UK organisations should take note because the ICO enforces an equivalent regime that now carries far larger fines.
What happened
On Saturday 14 November 2026 the Garante per la protezione dei dati personali, Italy’s data protection authority, announced an €805m (about £670m) penalty against Meta Platforms Ireland Limited. Al Jazeera reports that it is the biggest fine the Garante has ever issued.
The case concerns a Facebook for Android feature called “Get suggestions from gallery when browsing Facebook”, introduced in 2023. It offers pictures and videos from the camera roll as ideas for new posts. The Garante found that Facebook had reached into photos, videos and their associated metadata on Italian users’ handsets without collecting specific consent and without telling people clearly what was happening.
According to open.online, the investigation began in July 2025 after a complaint from the Bolzano consumer group Centro Tutela Consumatori Utenti. Around 20 million Android users in Italy are potentially in scope.
Meta has 60 days to make the feature opt-in and to request a separate, specific consent for it, including from people who had already granted access. A Meta spokesperson told the BBC the company will appeal, arguing that the regulator misread both the facts and the law and that the penalty is “disproportionate”.
The detail
The legal basis matters more than the headline figure. The Garante did not rely on the GDPR. It applied article 122 of the Italian Privacy Code, the national implementation of the EU ePrivacy Directive. That rule treats a smartphone as part of the user’s private sphere: storing information on the device, or reading information already held there, needs free and informed consent unless a narrow exemption applies. The authority stressed that the obligation bites whether or not any data leaves the handset and whether or not anyone is harmed.
Three design choices sank Meta’s position. Gallery access was requested through one app-wide permission that covered several features with different purposes. The screen before that permission used a generic message about enabling other functions, which gave users no hint that gallery suggestions were included. And the feature itself was switched on by default.
Meta also challenged Italy’s jurisdiction, arguing that the Irish Data Protection Commission should lead. The Garante rejected that, pointing out that the ePrivacy framework has no “one-stop-shop” mechanism of the kind the GDPR offers. That matters for any multinational relying on a single lead authority.
The size of the fine reflected the number of people affected, the long duration of the breach (still continuing for users who have not updated the app or who had already opted in), a previous 2019 penalty against the company and what the regulator called Meta’s “lack of cooperation”. The penalty amounts to roughly 0.47% of the group’s worldwide turnover. The Garante said it did not examine whether gallery content was used to train AI models, which Meta denies, but has reserved the right to look separately at a newer cloud-processing gallery feature launched in 2026.
Why it matters for UK organisations
The UK left the EU, but it kept the same rule. The UK’s version of the ePrivacy provisions sits in the Privacy and Electronic Communications Regulations (PECR), best known for its cookie and direct marketing requirements, and the ICO enforces it. Many teams treat PECR as a cookie banner issue. The Italian decision is a reminder that the same principle covers mobile apps reading data stored on a handset, and that bundling permissions or switching features on by default will not amount to valid consent.
The financial exposure in the UK has also changed. For years PECR penalties were capped at £500,000, which made the regime easy to deprioritise. The Data (Use and Access) Act 2025 brought PECR enforcement into line with the UK GDPR, and the ICO confirmed in February 2026 that it can now issue PECR fines of up to £17.5m or 4% of global turnover. Law firm DLA Piper says the regulator has signalled renewed enforcement attention on cookie compliance.
The Act did relax consent for some low-risk technologies, such as purely statistical measurement, provided users are given an opt out. Nothing in that relaxation would cover an app quietly reading a personal photo library. For UK firms trading in the EU, the regulator in each member state where they operate may bring ePrivacy enforcement, not just a lead authority.
Expert view
In my experience, this kind of issue rarely shows up in a formal compliance review because it lives in the gap between product, mobile engineering and privacy teams. When we test mobile apps, broad storage and media permissions are among the most common findings, and the justification is almost always convenience: one prompt is simpler than three. In security terms it is like giving a service account domain admin to save time: nobody tracks what uses the access, and the blast radius is huge if the app or an SDK is compromised.
What stands out is that the Garante treated device access itself as the harm. It did not need to prove misuse or exfiltration. That should change how organisations frame risk assessments. The question is not only “do we protect the data we collect?” but “why can our code read this at all?”. Least privilege is a security principle, and regulators are now enforcing it as a privacy obligation.
This is not only a big-tech problem. Plenty of UK retailers, banks and councils ship agency-built apps full of third-party libraries requesting permissions nobody consciously approved.
What to do now
- Inventory app permissions. List every permission your Android and iOS apps request, which feature uses each one and whether any third-party SDK relies on it. Remove anything without a clear owner.
- Unbundle consent. Where a feature reads photos, contacts, location or files, ask for that access at the point of use, explain the purpose plainly and keep optional features off by default.
- Review PECR alongside UK GDPR. Ask your DPO to reassess device-access and cookie practices against the higher penalty ceiling, and record the reasoning for any exemption you rely on.
- Test, do not assume. Include permission and SDK behaviour in mobile app penetration tests and in pre-release checks, not just server-side controls.
- Apply least privilege on devices you manage. For corporate phones, the Cyber Essentials secure configuration and user access control requirements support restricting which apps are installed and what they can reach. Use mobile device management to enforce it.
- Map your EU exposure. If you serve EU users, do not assume a single lead authority will handle ePrivacy questions.
Bottom line
Meta will fight this in court, but the reasoning is clear and travels well: reading data on a user’s device needs specific, informed, opt-in consent, and convenience is not an excuse. With PECR fines in the UK now matching UK GDPR levels, app permissions belong on the risk register.
Sources
- BBC News: Italy fines Meta €805m over accessing users’ photos
- ABC News (AP): Meta fined $887M in Italy over Android gallery photos, videos on Facebook
- Al Jazeera: Italy fines Meta $880m over photo privacy
- Open: Garante privacy fines Meta 805 million over Facebook gallery access on Android
- ICO: Statement on the commencement of the Data (Use and Access) Act (DUAA)
- Womble Bond Dickinson: Understanding the Data (Use and Access) Act
- DLA Piper Privacy Matters: Commencement of the data protection provisions in the Data (Use and Access) Act
