Italy Fines Meta €805 Million Over Facebook's Android Gallery Access

Italy's data protection agency has fined Meta Platforms €805 million, roughly $887 million, over the Facebook app's access to photos and videos on Android phones. The ruling landed on November 14, 2026. The agency found Meta accessed that media without consent and without adequately informing users.

The cash is only half the order. Meta must switch the feature off by default and collect users' consent separately within 60 days. That deadline combines a product change, a consent-flow rewrite and a data-handling audit. The investigation began in 2025.

What exactly did the regulator find?

According to Reuters reporting, the case concerns a Facebook feature on Android that suggested content from users' personal galleries for possible posting. The app had to scan the gallery before the user chose anything. That pre-selection step is where the privacy question sits.

The agency's finding, as reported, is that this access happened without consent and without adequate explanation. The reported numbers:

• Fine: €805 million, about $887 million
• Regulator: Italy's data protection agency
• Product: Facebook app on Android
• Data in scope: Photos and videos in users' galleries
• Scale: approximately 0.47% of Meta's global revenue
• Deadline: 60 days to default-off and separate consent
• Probe start: 2025

The 0.47% share is the useful number for scale. Working backward, it implies a revenue base near $189 billion — an arithmetic sanity check, not a figure any outlet printed. A fine near half a percent of revenue is a real cost. It does not threaten Meta's economics.

The compliance order is the bigger lever. A company can absorb a one-time penalty, but rebuilding how a feature requests access — and watching adoption drop once users must opt in — changes product metrics for good.

What does this change for Android developers?

The failure mode lives in code review, not only in court. Android's runtime permission model asks for a category of data, such as images. It does not ask for a purpose. Two features in one app can share a single grant, and regulators increasingly treat that as a gap. Holding a permission is not the same as having consent for every feature that can use it.

The practical rule: layer purpose-level consent on top of the OS grant. Show an in-app screen that names the feature, states what is read and stored, and offers a plain off switch. Log the answer. For most sharing flows, Android's Photo Picker avoids broad gallery access entirely — the user picks specific items, and the app receives only those.

Meta's case sits in the riskiest category: proactive background suggestions that scan the whole library without a user tap. A user-initiated picker carries low exposure because the app sees only chosen items. A startup with a camera-roll feature carries the same obligations as Meta, with far less budget to absorb a penalty.

What the case does not say

The claim is narrower than some headlines suggest. The finding covers photographs and videos, not all Android user data. Contacts, messages and location are not established in the reporting. The investigation also did not cover whether the content was used to train AI models. That boundary matters: the reporting neither confirms nor denies such use.

No named individual issued an on-record quote. The verified reporting contains no confirmed Meta response, no appeal filing and no figure for affected users.

Where this goes next

The precedent travels. Once one national regulator sets a per-feature consent standard, others can cite the reasoning. The probe's 2025 start gives other agencies a template. Likely follow-ons include camera-roll audits across the industry, wider adoption of picker-first design, and a possible follow-up probe into AI training use. European drafts under discussion, including penalty ceilings of 6% tied to design practices, suggest today's 0.47% fine will look restrained.

The takeaway for engineers: treat OS permissions as a floor, ask for consent per purpose, and ship proactive features switched off. The paper trail has to hold up for a long time — this inquiry took from 2025 to November 2026 to conclude.