Italy's data protection authority has fined Meta for reading a phone's photo gallery without asking. Meta says nothing yet, and the ruling leaves the AI-training question open.
€805 million, about $887 million, is the fine Italy's data protection authority, the Garante, has handed Meta after finding that the Facebook app on Android phones reached into users' photos, videos and metadata without asking for specific consent, CNBC and Investing.com reported on Saturday, November 14. Meta has 60 days to switch the feature off by default and get separate consent before it touches anyone's gallery again.
The feature at the centre of the case is called "Get suggestions from your gallery while browsing Facebook." Introduced in 2023, it scans the pictures on your phone and offers to turn them into posts. Convenient, until you ask how the app knows which pictures to suggest. The authority says the Facebook Android app took in photos, videos and metadata from Italian users "without obtaining specific consent and without informing them correctly," according to reports of the ruling.
Meta was "not immediately available for comment," per the Investing.com report, and the company has not said whether it will appeal.
Is this about AI training? #
Not formally, and that matters. According to Investing.com, the investigation began in 2025 and did not examine whether the photos were used to train AI models. Meta has previously denied using content accessed this way for that purpose. So the €805 million punishes the access itself: reading a person's camera roll without a separate, informed yes.
Meta glasses lawsuit says intimate footage trained AI via Kenyan contractors A newly amended class action accuses Meta of routing intimate footage from its Ray-Ban smart glasses to Kenya-based contractors at Sama, who allegedly viewed and labeled the recordings to train Meta's AI. The August 31 filing expands the case to cover bystanders who never bought the glasses at all, arriving weeks after Meta's $18 billion... - Meta Ray-Ban glasses privacy lawsuit Kenya contractors - intimate footage labeled training AI without consent
That's a narrower finding than the viral framing suggests, and frankly a more useful one. Regulators don't need to prove your model ate someone's holiday pictures. If you collected them without proper consent, you're already on the hook.
The authority also reserved the right to investigate separately a newer 2026 feature involving cloud-based processing of gallery photos, Investing.com reported. That one sits much closer to AI. If a second case follows, it would test whether sending a user's pictures to a company's servers to power suggestions needs its own consent on top of the first.
How does it compare with Meta's other fines? #
It's big, though not the biggest. The record for Meta is the €1.2 billion fine from Ireland's Data Protection Commission in May 2023 over transfers of European users' data to the US. Italy's number sits below that, and well above what Italian regulators have previously hit Meta with. In 2024, for example, the country's antitrust authority AGCM fined Meta €3.5 million over how it told users their data would be used for advertising.
Worth saying plainly: for a company of Meta's size, the fine itself is survivable. The 60-day order is the harder part. Turning a feature off by default and making users opt in typically cuts uptake sharply, and every opt-in screen is a place where users say no. If other European regulators follow Italy's reasoning, the same switch gets flipped across the bloc.
What it means if you build on user photos #
If you run a startup that reads a camera roll, a gallery or a cloud album to power a suggestion, a filter or a model, the lesson from Rome is practical. A permission prompt from Android or iOS isn't the same as consent under European data rules, and the Italian authority is treating the two as separate steps. Ask for the specific use, say what happens to the files, and keep a record. The timing is awkward for Meta, whose AI spending is already under investor scrutiny. The ruling doesn't touch its models, but it signals that the cost of feeding personal data into AI products can show up as a regulatory bill long before any model ships. The next date to watch is the end of the 60-day window, when Meta either has the consent flow in place or it doesn't.
Also read: SpaceXAI cuts about 60 Grok Imagine staff to push coding tools and agents • Workday outage locks employees at 11,500 firms out of pay and benefits • SpaceX Starship Flight 15 reaches orbit but loses its booster before the ship catch
Meta's Muse AI agent can now phone US businesses for you, if you pay Meta's Muse agent, which has passed 10 million users, now dials US restaurants, clinics and customer-service lines for subscribers on its $20 and $100 monthly plans. A September Reuters report on human callers behind some Muse calls leaves disclosure unresolved. - Meta Muse AI calls US businesses - Meta Muse outbound calling paid subscribers
This article is posted in Technology News, check it out for more related stories.
Join the discussion #
Open in the community → Almost there. Sign in and your reply posts straight away.