On 14 November 2026 Italy's data protection authority, the Garante, fined Meta Platforms Ireland Limited €805 million over the Facebook app for Android. According to the Garante's press release, the app accessed photos, videos and metadata on the phones of around 20 million Android users in Italy without specific consent. It sits among the largest fines an Italian authority has imposed on a technology company, the BBC reported.
The strongest case for the Garante
The argument for the decision is stronger than Meta's critics tend to admit. The feature at issue, gallery suggestions, has been available since 2023. While a user scrolls Facebook, it offers photos and videos from the phone as ideas for posts. The Garante found that the app requested gallery access through one app-wide permission, after a generic prompt to "enable other features". Users could not tell that approving it also switched on gallery suggestions. The press release adds that the feature was set to be active by default.
A phone's gallery is among the most intimate stores of personal data most people own. If consent is to mean anything, a person should be able to say yes to a feature and no to a bundled one. The Garante also cited aggravating factors beyond the consent design. These were the number of people affected, the fact that the conduct is "still ongoing for those who haven't updated the app", a previous 2019 ruling against the company, and limited cooperation during the investigation. Meta's post-complaint changes were judged late and limited to users who update the app. A regulator that sees repeated conduct, limited cooperation and a half-fix is entitled to escalate.
What the order requires
The remedy is narrower than the headline fine suggests, and it is reasonable. Within 60 days Meta must ask for consent through a separate, specific request. That request has to explain what the feature is for, that it involves gallery access, and how to turn it off. The feature must stay off by default, including for users who previously granted the system-level permission. If Meta misses the deadline, the feature cannot be activated for anyone without valid consent. Meta must also report its planned initiatives within 30 days and the measures adopted within 90 days.
This is a product-design requirement that any app developer can meet. Separate, plainly worded opt-in prompts for a discrete feature are a modest cost for a company of Meta's size. They also leave the feature available to the users who actually want it.
Where proportionality strains
Three features of the ruling deserve scrutiny from anyone who favours proportionate, evidence-based regulation.
First, the legal test requires no harm. The Garante applied Article 122 of Italy's privacy code, which implements the EU ePrivacy Directive. It reasons that the rule protects the smartphone as part of a person's private sphere, so any access to what the phone holds requires free and informed consent "regardless of data transmission or the existence of harm". TNW's report states that the rule applies even if no data leaves the phone. That is a defensible privacy principle. It is a poor basis for a fine of this scale without evidence of misuse. The Garante's own release says the proceeding did not examine whether the content is used to train AI, which Meta denies. The record, as published, shows a consent-design failure, not a demonstrated injury. A penalty should scale with demonstrated risk, and an ePrivacy violation with no proven downstream harm sits at the lower end of that scale.
Second, the fine's logic is opaque. The Garante says the amount is about 0.47% of the group's global revenue. The release gives no account of how that percentage was derived from the factors it lists. Predictability is a pro-innovation value. Developers cannot design to a penalty they cannot model.
Third, there is no one-stop shop. Meta's EU base is in Ireland, and under the GDPR the Irish regulator usually leads. Meta argued the case belonged there. The Garante rejected that objection because, in its words, the ePrivacy rules "do not provide for the 'one-stop shop' mechanism". The legal reasoning is sound, but the consequence is real. Any national authority can act on an app's device-access prompts, and each may reach a different view on what a valid prompt looks like. A product shipped across 27 markets could face 27 interpretations, each with its own fine.
The pending cloud-processing question
The Garante has reserved the right to assess separately a feature launched in 2026 that allows cloud processing of gallery content. That is the part of the story with the greater potential consequence for users, because it concerns content leaving the device. If the regulator pursues it, the case for strict scrutiny will be much stronger, and it will rest on actual data flows and not only on a prompt's wording.
Why it matters beyond Meta
The BBC noted that the fine came a month after a US judge in New Mexico ordered Meta to pay $25bn over statements about its handling of user data. Regulatory pressure on the company is clearly rising on both sides of the Atlantic. Smaller developers should read the Italian case less as a story about one company's penalty and more as a design lesson. Device permissions that unlock several features at once, behind vague wording, are now a documented enforcement risk in at least one EU member state.
The EU's Guidelines 2/2023 on Article 5(3) of the ePrivacy Directive, published by the European Data Protection Board, are the natural place to harmonise how access to device-stored information is assessed. Aligning national enforcement with them would give developers one standard to build against.
Bottom line
The Garante is right that bundled, vaguely worded permission requests are not informed consent, and its remedy is proportionate. The fine is harder to defend as a calibrated penalty, because it rests on no demonstrated harm and no published method for the amount. The more useful reform is institutional. Whether ePrivacy enforcement should have a lead-authority mechanism is a question for EU lawmakers, and this case makes it harder to avoid.