CNBC reported that Italy’s data protection agency fined Meta Platforms 805 million euros ($887 million) over Facebook Android photo access, for allegedly accessing photographs and videos without consent or informing users. The Facebook app suggested content from personal galleries for people to post. Meta has 60 days to turn that feature off by default and ask for separate consent, so checking the Android permission is the step readers can take now.
Updated November 14, 2026
Key Takeaways
- Italy’s privacy authority fined Meta 805 million euros ($887 million).
- The 2023 feature suggested gallery photos and videos while you browsed Facebook.
- A full grant could cover the whole photo library, usually permanently.
- Revoke Facebook photo access in settings, or pick the most limited option.
What did the gallery feature actually read?
Available from 2023, the feature is called “Get suggestions from your gallery whilst browsing Facebook,” Il Sole 24 Ore reported. While someone browsed, Facebook could suggest photos and videos from the phone gallery as ideas for posts. CNBC said Meta had access to Android users’ photos and videos through that feature.
The authority said that, via the Facebook app for Android, the company accessed photographs, videos, and related metadata stored on Italian users’ smartphones without specific consent and without adequately informing them. TechPost.it says those images were offered as prompts, and the choice to share them stayed with the user.
Access was requested through a single authorization, valid for the entire app and for multiple functions. It followed a generic prompt, “Enable other features,” which did not let the user understand that gallery suggestions were included. The feature was preset as active.
If granted in full, that authorization lets the app access the device’s entire photo library, usually on a permanent basis. Neither the user nor the authority could verify what information was actually being used. Article 122 of the Privacy Code, which transposes the European ePrivacy Directive, requires free and informed consent for this access even if no data was transferred and no harm is shown.
The authority said the rule protects the smartphone as part of an individual’s private sphere. It also rejected Meta’s plea that the Irish authority had jurisdiction, because the ePrivacy rules do not provide a one-stop shop.
How do you audit Facebook Android photo access?
TechPost.it says the path and menu names change with the Android version and the phone maker. In its Italian walkthrough, the usual check is:
- Open your phone’s settings and select “App” or “Applicazioni.”
- Choose Facebook, then open “Autorizzazioni” or “Permessi.”
- Check the app’s access to photos and videos.
- To deny access, revoke the permission or choose the most limited option available on your device.
Revoking the permission limits gallery access according to the options Android provides. On a phone that is not in Italian, follow the same path in your language: apps, Facebook, then permissions, and revoke photo and video access or pick the most limited choice. That system switch is not the same as a specific yes to suggestions, which Meta must collect separately.
What is Meta required to change?
CNBC reports Meta has 60 days to disable the feature by default and seek users’ consent separately. TechPost.it says the request must be separate and specific, explain the purpose, state that the function accesses the gallery, and say how to turn it off.
The feature must stay off by default even for people who already allowed general access. Without valid consent after the deadline, it cannot be activated for those users. Meta must tell the authority about initiatives started within 30 days and measures adopted within 90 days.
The fine equals about 0.47% of the group’s global revenue, the authority said. TechPost.it says about 20 million Android users in Italy were counted in that calculation. Changes introduced after the report were treated as late and limited to people who update the app.
The inquiry opened in July 2025 after a report from the Bolzano Consumer and User Protection Centre and drew on a technical analysis. It did not cover using this content to train artificial intelligence models, a practice Meta denied. The authority said it reserved the right to assess separately a new feature, launched in 2026, that allows gallery content to be processed in the cloud.
| What the feature could read | What the reports confirmed | What Italy ordered |
|---|---|---|
| Photos, videos, and related metadata | Sharing a suggestion stayed optional | Feature off by default |
| Entire photo library if fully granted, usually permanently | Revoke or limit the Android permission | Separate, specific consent |
| One app-wide grant after “Enable other features” | User and authority could not verify what was used | Explain purpose, access, and how to turn it off |
The Android permission is a switch you can change today. The separate consent request is an order on Meta, not a Facebook menu the sources document.
Does this finding cover iPhone?
No. The decision covers gallery access through Facebook for Android. The sources do not describe this suggestion feature on iOS or list an iPhone settings path, so do not copy these labels onto an iPhone. A different iOS privacy issue is covered in why Facebook worried about a new iOS privacy feature.
Frequently asked questions
What could the gallery feature read?
Photographs, videos, and related metadata. A full permission could cover the entire photo library, usually on a permanent basis.
How do I limit Facebook Android photo access?
Open settings, then “App” or “Applicazioni,” Facebook, and “Autorizzazioni” or “Permessi.” Revoke photo and video access or choose the most limited option. Labels vary by Android version and phone maker.
Does this cover iPhone photos?
No. The reports cover gallery access through Facebook for Android, not this feature on iOS, and they do not list an iPhone settings path.
Must suggestions be off by default?
Meta has 60 days to disable the feature by default and seek separate consent, including for people who already allowed general access. Without valid consent after the deadline, it cannot be activated.
