Summary
Meta has been fined €805 million in Italy after regulators found that Facebook for Android accessed photos and videos stored on users’ phones without separate, informed consent.
The November 14, 2026 decision concerns a feature that suggests content from a phone’s gallery while someone browses Facebook. For photographers and filmmakers, the case raises a practical question: how much of a device’s private archive can an app see, including work that was never intended for publication?
How Facebook accessed the photo gallery
The “Get suggestions from gallery when browsing Facebook” feature, available since 2023, draws on images and videos stored on an Android device to recommend possible posts. Italy’s data protection regulator found that Facebook relied on a single, app-wide permission even though different features accessed that gallery for different purposes.
The permission prompt referred generally to enabling additional features, without clearly explaining that gallery suggestions were included. The feature was also enabled by default. With unrestricted permission, an app can potentially read an entire photo library, including associated metadata. That is not evidence that every file was copied to Meta’s servers.
Why the fine reached €805 million
The investigation began in July 2025 after a complaint by a consumer protection organisation in Bolzano. The regulator found a breach of Article 122 of Italy’s privacy code, which implements the EU ePrivacy framework and requires free, specific and informed consent for accessing information stored on a personal device.
In setting the fine, the regulator cited around 20 million affected Android users in Italy, the duration of the violation, a previous 2019 proceeding and insufficient cooperation during the investigation. It acknowledged some changes made by Meta but found them late and limited. The fine represents approximately 0.47% of the group’s worldwide turnover.
What Meta must change and how it responded
Within 60 days of the decision, Meta must disable the feature by default and obtain distinct consent that clearly explains why gallery access is requested and how to turn it off. This also applies to users who had already granted general permission. Meta must report initial steps within 30 days and the measures taken within 90 days.
Meta disagrees with the findings and says it intends to appeal. The company maintains that the tool helps people share content, only works after device-level permission is granted and can be controlled in settings. This is an Italian decision; it does not establish that an identical order has already been implemented across every EU country.
What to check on your Android phone
Open your device settings, find Facebook under Apps and review its “Photos and videos” permission or the corresponding setting on your Android version. Where supported, restrict access to selected photos; otherwise, revoke it when gallery access is unnecessary. Also check Facebook’s own settings for active suggestions from your camera roll.
For working creators, this matters when a phone contains unreleased projects, client portraits, behind-the-scenes footage or location metadata. Keeping work files separate from your everyday gallery and granting apps only the access they need offers better protection for both your material and your clients.
This case is distinct from the separate AI-based camera-roll photo processing feature. The Italian investigation did not examine whether the content was used to train AI models, which Meta denies. The regulator reserved the option to investigate the newer cloud-processing feature separately.
What we think
When you photograph clients, tapping “Allow” once to upload a Story should not automatically mean you want Facebook searching your entire gallery for content ideas. Those are different uses of personal files, and consent should make that distinction obvious.
For many photographers and filmmakers, a phone is now a small working archive. It may contain footage awaiting delivery, people who have not agreed to publication, or entirely private moments. The convenience of automated post suggestions does not justify broad, poorly explained access.
The practical response is not to uninstall every social app. It is to stop treating permissions as a screen we automatically click through. Reviewing them takes a few minutes and helps protect both our work and the trust of the people we photograph.
Frequently asked questions
Did the regulator prove that Meta copied every user photo?
No. It found problematic access to the gallery and a potential ability to read the entire library when broad permission was granted. It did not establish that every image was copied or published.
Was the fine about training artificial intelligence?
No. The investigation concerned access to device information and consent. Meta denies using this content for AI training, while the regulator may separately investigate cloud-based processing.
