Italy’s Garante imposes record €805m fine on Meta for unauthorized photo access

Key points

• Garante states Meta’s Facebook app accessed photos, videos, and metadata on Italian Android smartphones without specific user consent or notification.
• The violation concerns the 'Get suggestions from gallery when browsing Facebook' feature, which was enabled by default and used generic consent prompts that did not clearly explain permissions.
• The €805 million fine represents approximately 0.47% of Meta’s global turnover and is the largest penalty ever imposed by the Italian regulator.
• Garante cited Meta’s 'lack of cooperation' and a previous 2019 violation as factors contributing to the severity of the penalty.
• Meta must fix the consent notification process and disable the default setting for the gallery suggestion feature.
• The proceedings did not address the use of content for AI training, a topic Meta denies, and the company has not yet publicly responded to the fine.

Background

Meta faces increasing regulatory scrutiny across jurisdictions. In October 2026, a New Mexico judge ordered a $25 billion fine for privacy deception, and Brazil’s courts doubled fines related to election content. These recent actions highlight a global trend of stricter enforcement against Meta’s data practices, though the Italian case specifically targets device-level photo access rather than cross-border data transfers or election integrity.

How outlets are covering it

BBC and Al Jazeera report the fine as a definitive action by Garante, citing the regulator’s statement that the feature violated Italian law implementing the EU ePrivacy directive. Al Jazeera notes the fine is roughly 0.47% of Meta’s global turnover. However, TokenPost challenges the existence of the fine, stating that no matching notice appeared in Garante’s public records through November 13, 2026. TokenPost argues that while Meta has faced other European penalties, such as the €1.2 billion fine from Ireland’s DPC in 2023 and a €200 million fine from the European Commission in 2025, the Italian claim lacks verifiable primary documentation in the records reviewed. This discrepancy highlights a conflict between major news outlets reporting the fine and independent verification of the regulator’s public announcements.

Why it matters

This case underscores the growing power of national regulators to impose massive penalties for granular privacy violations, even if the financial impact is a small fraction of global revenue. The dispute over the fine’s existence also raises questions about the transparency and verification of regulatory actions in the digital age, potentially affecting how future enforcement actions are perceived and challenged by tech companies.

What to watch

Meta has the right to appeal the decision. If the fine stands, it will set a precedent for default-enabled features that access device data without explicit, granular consent. Regulators may scrutinize similar features in other apps, while Meta may face further legal challenges if the fine is upheld or if the lack of public records is investigated further.