Italy’s data protection authority has fined Meta €805 million, about A$1.31 billion, over a Facebook feature for Android phones that suggests photos and videos from your phone’s gallery as ideas for posts. The regulator, known as the Garante, says Facebook got access to users’ photos, videos and their metadata without asking for specific consent and without explaining properly what was happening. Meta says it will appeal.
The decision was announced in Rome on Saturday 14 November, which was Saturday night in Australia. It only covers Italian users, and it doesn’t settle whether Meta did anything wrong anywhere else. But it is a clear statement about how apps should ask for access to the photos on your phone. Here’s what the regulator found, what Meta has to change, what it means for Australians, and how to check what Facebook can see on your own phone.
What Italy’s privacy regulator found
According to the Garante’s announcement, the case concerns a Facebook for Android setting called “Get tips from your gallery while browsing Facebook”. It has been available since 2023. While you scroll, it shows you photos and videos from your phone’s gallery as suggestions to post. The investigation began in July 2025 after a complaint from a consumer protection centre in Bolzano, and the regulator ran its own technical analysis of the app.
The Garante says it found three problems:
- Facebook asked for gallery access with a single permission that covered the whole app and several features with different purposes.
- Before that permission, the app showed a vague notice (“enable other features”) that didn’t tell users they were also switching on gallery suggestions.
- The suggestions feature was switched on by default.
The regulator also explained why it saw this as serious. In the words of its English-language statement: “If fully granted, this kind of authorization allows the app to read the entire photo archive on the device, usually permanently, without the user or the Authority being able to verify what information is actually being used.”
The Garante says about 20 million Android users in Italy were affected. It set the fine at about 0.47 per cent of Meta’s global revenue, taking into account the number of people involved, the fact that the problem is still ongoing for people who haven’t updated the app or have already granted permission, a previous 2019 decision against the company, and what it called limited cooperation during the investigation. It gave Meta some credit for changes it made after the complaint, but called them late and limited to people who update the app.
Al Jazeera reports it is by far the largest fine the Italian regulator has ever imposed, and DW calls it the largest Italian regulators have imposed on a big tech company. Our conversion to Australian dollars uses the Reserve Bank of Australia’s euro exchange rate for 13 November.
What Meta has to change, and what it says
The Garante has given Meta 60 days to:
- ask for consent to gallery suggestions separately and specifically, and explain clearly what the feature is for, that it involves access to the gallery, and how to turn it off
- keep the feature switched off by default, including for people who have already granted the permission
- report to the regulator within 30 days on what it has started doing, and within 90 days on the measures it has taken
If Meta doesn’t comply in time, the regulator says the feature can’t be switched on for any Italian user who hasn’t given valid consent.
Meta rejects the findings. A spokesperson told the BBC: “We strongly disagree with the [regulator’s] assessment of the facts, its application of the law, and the disproportionate level of the fine.” The spokesperson added: “This is a straightforward feature which helps people post photos and videos to Facebook. People must give permission on their device before it can operate, and they can change this permission at any time via their settings.” CNBC, citing Reuters, also reports that Meta will appeal.
Why Italy made the call, not Ireland
Meta’s European headquarters is in Ireland, and under Europe’s main privacy law, the GDPR, the Irish regulator usually takes the lead on cases about Meta. The Garante says Meta argued the case belonged in Ireland, but it rejected that argument.
The reason is the law it used. The Garante relied on article 122 of Italy’s privacy code, which puts the EU’s ePrivacy Directive into Italian law. That rule treats your phone as part of your private life: any access to information stored on it needs free and informed consent, whether or not the data is sent anywhere and whether or not anyone is harmed. The ePrivacy rules don’t include the GDPR’s “one-stop shop” system, so national regulators can act on their own.
What this decision doesn’t cover
Two things are worth being clear about. First, the Garante says its investigation didn’t look at whether gallery content was used to train AI. Meta denies doing that. Second, the regulator says it will separately assess a newer feature launched in 2026 that lets Facebook process gallery content in the cloud.
That newer feature appears to be what Meta calls camera roll suggestions. Meta launched it in the US and Canada in October 2025, then in the EU and UK in April 2026, and in August 2026 added more countries, including several in Latin America. Meta says it is opt-in, analyses media in your camera roll to suggest edits, collages and videos, keeps those suggestions private to you, and doesn’t use camera roll photos for ad targeting or to improve its AI unless you choose to share them or use them with Meta AI. Those are Meta’s claims, and the Italian regulator hasn’t ruled on them yet.
Does this affect Australians?
Not directly. The fine and the 60-day orders apply to Meta’s handling of Italian users under Italian and EU law. Meta’s announcements for the newer cloud-based camera roll feature don’t name Australia among the countries where it has rolled out, and we couldn’t confirm whether the older gallery suggestions setting is switched on for Australian Android users, so treat its availability here as unconfirmed.
The principle still matters here. The Office of the Australian Information Commissioner says that under Australian privacy law, consent must be informed, voluntary, current and specific, and that organisations “shouldn’t ask for a broader consent than is necessary”. A single app-wide permission covering several features is the kind of thing that test is meant to catch. Australian regulators have also been raising penalties for big platforms, as we covered when Australia doubled its social media fines to A$109.2 million, and Meta products are already at the centre of debates about cameras and privacy here, such as AI smart glasses.
How to check what Facebook can see on your phone
You don’t need to wait for a regulator to check this yourself. On Android, Google’s help page explains how to review an app’s permissions:
- Open the Settings app.
- Tap Apps, then tap Facebook (tap See all apps if you can’t find it).
- Tap Permissions, then Photos and videos.
- Choose Don’t allow if you don’t want Facebook to read your gallery. You can still grant access later if you want to upload something.
Menus can vary between Android versions and phone brands. Inside the Facebook app itself, Meta says camera roll suggestions can be managed or turned off in Facebook’s camera roll settings. In the version Tom’s Guide documented in 2025, these were under Menu, then Settings & privacy, Settings and Camera roll sharing suggestions, with separate switches for suggestions while browsing and for cloud processing. If you don’t see that section, the feature may not be available on your account.
It’s also worth applying the same check to other apps. A photo permission you granted years ago to upload one picture may still be in place.
Our read
Our read: the size of the fine will get the headlines, but the more useful part of this decision is the reasoning. The Garante is saying that tapping “allow” on a vague, app-wide prompt isn’t the same as agreeing to a specific feature that reads your photo library, and that this applies whether or not any harm results. Meta disputes that and will appeal, so this isn’t the final word. Even so, the case points to a simple habit that’s worth keeping wherever you live: give apps access only to the photos they need, and switch off suggestion and cloud-processing features you didn’t knowingly turn on.
Featured image: the Facebook app on an Android smartphone, January 2019 (illustrative; not from the Italian case). Photo: Tony Webster, via Wikimedia Commons, CC BY 2.0; resized and converted to PNG.
.jpg){kind=link}