ABE MAGAZINE | TECHNOLOGY & PRIVACY
November 14, 2026
By ABE Editorial Desk
A photograph stored on a smartphone may seem private, particularly when its owner has never shared it online. Yet a landmark decision in Italy has raised an uncomfortable question: How much access do technology companies actually have to the personal information stored on our devices?
Italy’s data protection authority has fined Meta €805 million, approximately $887 million, after finding that Facebook accessed Android users’ photographs, videos and associated information without obtaining sufficiently specific consent. The investigation involved a feature designed to suggest personal photos for sharing. Regulators concluded that the way Facebook requested permission failed to give users adequate control over their private content.
The case extends beyond one application. It challenges the assumption that granting a smartphone permission automatically means understanding everything a company can do with it.
The Facebook Feature Behind the Fine
The investigation focused on a Facebook feature that suggested photographs and videos from users’ phone galleries while they browsed the application. Introduced in 2023, the feature was intended to make sharing personal content easier by identifying material users might want to publish.
However, Italy’s privacy authority found significant problems with the permission process. Facebook requested access through a broad authorisation covering multiple functions, rather than obtaining separate consent for the gallery suggestion feature.
The regulator also found that users received a general explanation about enabling additional functions. That explanation did not clearly communicate the extent of access associated with the feature.
More importantly, the gallery suggestion function was enabled by default. According to the authority, granting broad permission could allow the application to read the device’s entire photographic archive on an ongoing basis.
The decision illustrates a fundamental distinction between allowing an application to perform a task and knowingly agreeing to how personal information will be used.
Why Italy Imposed Such a Large Penalty
The €805 million penalty reflects the scale and duration of the violations identified by Italian regulators. The authority estimated that approximately 20 million Android users in Italy were affected by the practice.
The investigation began in July 2025 following a complaint from a consumer protection organisation in Bolzano. Technical examinations subsequently examined how Facebook requested permissions and accessed information stored on smartphones.
Regulators considered several factors when determining the penalty. These included the number of affected users, the continuing nature of the conduct and an earlier regulatory measure involving the company in 2019.
The authority also criticised Meta’s level of cooperation during the investigation. Although the company introduced changes after receiving the complaint, regulators considered those measures too late and insufficiently comprehensive.
The fine represents approximately 0.47% of Meta’s worldwide revenue, according to the Italian authority. Its significance lies not only in the amount, but also in the regulator’s willingness to challenge how a major technology platform handles device permissions.
The Difference Between Permission and Consent
The case highlights a problem familiar to millions of smartphone users. Applications frequently request access to photographs, cameras, microphones and location information, often through permission screens that appear during ordinary use.
Many people approve these requests to continue using a service. However, permission does not necessarily mean that users understand every function associated with the access they have granted.
Italy’s authority relied on Article 122 of the country’s Privacy Code, which implements European electronic privacy protections. These rules require freely given and informed consent before certain information stored on personal devices can be accessed.
The regulator emphasised that smartphones belong to an individual’s private sphere. The protection applies regardless of whether information is transmitted elsewhere or whether measurable harm has occurred.
This interpretation challenges the idea that a broad operating-system permission is sufficient for every subsequent use of personal content.
For technology companies, it creates pressure to explain specific data practices clearly rather than relying on general authorisation screens.
Meta Faces New Requirements
Italy’s decision includes measures intended to change how the Facebook feature operates.
Meta has been ordered to disable gallery suggestions by default within 60 days. Users who want the feature must receive a separate request explaining its purpose, the information it accesses and how they can deactivate it.
The requirements also apply to people who previously granted broad gallery access. Earlier permission cannot automatically substitute for the specific consent demanded by the regulator.
Meta must inform the authority about its initial compliance measures within 30 days and provide further details within 90 days.
The decision therefore goes beyond imposing a financial penalty. It seeks to change how the company presents the feature and obtains permission from users.
At the time of Reuters’ initial report, Meta had not provided an immediate response to its request for comment. The company’s subsequent legal or regulatory response remains to be established.
What the Investigation Did Not Establish
The case also requires an important distinction between access to personal photographs and the use of those photographs for artificial intelligence.
Italy’s investigation did not determine whether material accessed through the gallery suggestion feature was used to train AI models. Meta has denied that practice.
The regulator separately identified a newer feature, introduced in 2026, that allows content from users’ galleries to be processed through cloud infrastructure.
However, the authority reserved the right to investigate that function independently. It did not treat the newer feature as part of the findings underlying this penalty.
These distinctions matter because privacy concerns should be examined through verified evidence rather than assumptions about how technology companies might use personal information.
The established finding concerns inadequate consent for accessing gallery content. Broader allegations about AI training require separate evidence.
A Warning for the Global Technology Industry
Although the ruling concerns Italian Android users, its implications extend across international technology markets.
Major digital platforms operate across jurisdictions with different privacy laws and enforcement systems. A regulatory decision in one country can encourage scrutiny of similar practices elsewhere.
Companies that depend on personal information to deliver recommendations and automated features may face growing pressure to demonstrate transparency.
The commercial challenge is significant. Personalisation can improve user experiences, but it also requires access to information that individuals may consider private.
Technology companies must therefore balance convenience with meaningful consumer choice.
For users, the case offers a reminder that application permissions deserve attention. A feature designed to make sharing easier can involve access far beyond the photograph someone eventually chooses to publish.
THE ABE TAKE
Italy’s decision against Meta exposes a weakness in the relationship between digital convenience and personal privacy. Technology companies increasingly design services that anticipate what users want. However, the ability to offer personalised features should not replace the obligation to obtain meaningful consent.
The central issue is not whether Facebook should be allowed to suggest photographs for sharing. It is whether users clearly understand what they are authorising and retain genuine control over that decision.
A smartphone contains far more than photographs. It holds personal relationships, family memories, financial records and information about everyday life. Access to that environment should never depend on vague explanations or permissions that combine unrelated functions.
The ruling also sends a message to the wider technology industry. Companies cannot treat user consent as a technical formality while designing products around increasingly extensive access to personal information.
Innovation and privacy do not have to compete. But responsible innovation requires transparency, proportionate access and the freedom to refuse unnecessary data collection.
Italy’s €805 million fine may become an important reference point in the continuing debate over digital rights. Its lasting significance will depend on whether companies change how they obtain consent, not simply how much they pay when regulators intervene.
ABE MAGAZINE
Understand More. Think Bigger.
