Meta has been fined €805 million by Italy's data protection authority for letting the Facebook app read photos, videos and metadata on the phones of around 20 million Android users in Italy, without specific consent and without clearly explaining what people had switched on.
The Meta fine, announced November 14 by the Garante per la protezione dei dati personali, is about 0.47 percent of group revenue. Italy did not uncover a hidden exploit. It found a single app-wide permission, a generic "enable other features" notice, and a gallery-suggestion tool left on by default.
The 2023 feature, "Get suggestions from your gallery while browsing Facebook," offers phone images as posts. It is not the 2026 cloud feature that uploads camera-roll media for AI edits, which the Garante has reserved for a separate investigation. Meta denies using gallery content to train AI, and this decision does not cover that question.
The inquiry followed a July 2025 complaint from the Centro Tutela Consumatori Utenti di Bolzano. The Garante found gallery access was requested through one authorization, valid for the entire app and for several functions with different purposes, after a notice that did not mention gallery suggestions. If fully granted, the app could read the entire photo archive on an ongoing basis, and neither the user nor the Authority could verify what was actually used.
The Garante said the smartphone is part of a person's private sphere.
"Any access to the information it contains therefore requires free and informed consent, regardless of whether the data is transmitted or any harm occurs."
The Garante, official press release, November 14, 2026
The cited rule is Article 122 of the Italian Privacy Code, implementing the ePrivacy Directive, not the GDPR. Meta said Ireland's Data Protection Commission should have the case. Italy refused, because ePrivacy has no one-stop-shop. If your CX stack touches the phone through an app, an SDK, cookies, or push notifications, a national regulator can act alone. Dublin is not your only problem.
Meta has 60 days to seek a separate, specific consent, explain the feature and how to turn it off, and keep it off by default, even for people who already gave the bundled permission. After that, it cannot run without valid consent. Plans are due in 30 days, measures in 90 days.
Meta will appeal. A spokesperson told the BBC:
"We strongly disagree with the [regulator's] assessment of the facts, its application of the law and the disproportionate level of the fine."
A Meta spokesperson, speaking to the BBC
It also called this "a straightforward feature which helps people post photos and videos to Facebook," and said people must give device permission and can change it in settings.
The Authority weighted the number of people affected, the ongoing breach, a 2019 precedent, and limited cooperation. Fixes after the complaint were judged late and limited to users who update.
Gunde Bauhofer, director of the Bolzano center that filed the complaint, told RAI Südtirol the ruling confirmed the group's suspicion.
"We are of course very glad about this decision. That means we had the right suspicion that this kind of processing of the images is not lawful."
Gunde Bauhofer, speaking to RAI Südtirol, November 15, 2026 (translated from German)
On WallStreetBets and in r/europe, some treated penalties like this as a cost of doing business, or a subscription fee for operating in Europe. Others said the bill is harder to shrug off amid heavy data-center spending. In an Italian thread, commenters said grabbing data is the company's business, yet people stay on WhatsApp and Instagram anyway.
This is not Meta's first expensive privacy fight. Other penalties include the Irish DPC's €1.2 billion (May 2023, EU-US transfers), €390 million (January 2023, ads on a "contract" legal basis), €405 million (September 2022, Instagram children's data), €265 million (November 2022, data-scraping vulnerabilities), €91 million (September 2024, plaintext passwords), and €251 million (December 2024, a 2018 Facebook breach); the European Commission's €797.72 million (November 2024, Marketplace antitrust) and €200 million (April 2025, DMA "consent or pay"); the FTC's $5 billion civil penalty (2019); and New Mexico's $25 billion civil penalty (October 2026, Unfair Practices Act, on appeal).
The only paid sum on this list is the FTC's $5 billion penalty. A 2020 quarterly filing says Meta paid it in April 2020, once the consent order took effect. The Irish DPC says its fines cannot be collected pending court confirmation or an appeal. Of more than €4.4 billion levied, only about €20 million has been collected, The Irish Times reported in September. Meta's 2025 annual report says the €1.2 billion fine is stayed by the Irish High Court, and it appealed both Commission penalties. It accrued a reserve for the New Mexico judgment and intends to appeal. There is no public evidence the other amounts have been paid.
What CX Leaders Should Do With This
If you run a brand app, a WhatsApp or Messenger channel, or CX AI built on customer data, audit consent flows for bundling and default-on toggles. A single "enable other features" or "allow access to continue" step is the pattern Italy just priced. Ask for separate consent for each purpose, including AI training, agent assist, copilots, and personalization. Do not grandfather earlier yeses. Leave the feature off until they agree again.
Know which regulator can reach you. GDPR may run through a lead authority. ePrivacy, device access, SDKs, and cookies may not. Before you switch on CX AI, ask the vendor what it reads, stores, and trains on, and how long it keeps it. Collect less than the tool will take. Keep logs that show what was actually used. Limited cooperation, and a fix that only reaches people who update, will cost you.
The EU AI Act already requires that people know when they are talking to a chatbot, from August 2, 2026. High-risk Annex III duties were delayed by the 2026 Omnibus to December 2, 2027. As CX Today has reported, the EU AI Act is already a CX problem. Transparency is live. Separate consent. Default off. Ship the fix to everyone.
