Italy's data protection authority, the Garante, has fined Meta Platforms Ireland €805 million over a Facebook feature on Android that gets access to the photo gallery on your phone to suggest posts. The decision, dated 14 November 2026 in Rome, is about a setting the regulator says was switched on by default behind a vague prompt.
Quick facts
- The feature: "Get tips from your gallery while browsing Facebook", in the Facebook app for Android, available since 2023.
- The problem: one app-wide permission, granted after a generic prompt to "enable other features", opened the whole gallery, and the feature was on by default.
- Who was affected: about 20 million Android users in Italy, by the regulator's estimate.
- The fine: €805 million, which the Garante puts at about 0.47% of Meta's worldwide turnover.
- The deadline: 60 days for Meta to ask for separate, specific consent and keep the feature off by default.
What the Garante found
The investigation began in July 2025 after a complaint from the consumer centre in Bolzano. The regulator ruled under Italy's rules on accessing information stored on a user's device, and rejected Meta's argument that the case belonged to its lead regulator in Ireland. It also cited a 2019 decision against the company and poor cooperation during the probe.
The new consent request must also go to people who already said yes. Meta has to report back within 30 days and again within 90 days. The Garante did not rule on whether the photos were used to train AI, which Meta denies, and says a cloud-processing feature added in 2026 will be examined separately.
Where Malaysia stands
The order covers Italy only, and the decision does not say how the feature is set up in other countries. In Malaysia, the Personal Data Protection Act 2010 is the relevant law. In the 2026 reprint of the Act, section 5(2) sets the penalty for a data controller that breaches the data protection principles at a fine of up to RM1 million, up to three years in jail, or both. That is the maximum for that one offence, not a cap on every penalty in the Act, and the decision gives no view on how Malaysian law would treat the same feature.
The two amounts are not equivalent penalties: Italy's is an actual fine set partly against worldwide turnover, while Malaysia's is the maximum on conviction for one offence, a fixed figure in ringgit. The Personal Data Protection Commissioner is also asking for views on a framework for AI and personal data, published as Public Consultation Paper No. 1/2026. We have covered how Malaysian rules compare before, from Europe's push against infinite scroll to Meta's smart glasses and our filming laws.
Check your own phone
Whatever Facebook offers in Malaysia, the phone's own permission controls whether the app has broad access to your gallery. Google's Android help gives the route: open Settings, tap Apps, tap Facebook, tap Permissions, then choose the photos permission (often labelled "Photos and videos") and set it to "Don't allow". That stops broad gallery access at the phone level, not the Facebook feature itself. In Italy, Meta must comply with the order within 60 days.
