Announced on November 14, 2026, the sanction targets a Facebook feature that had been active since 2023.
The regulatory body, known as the Garante, found that the Facebook application for Android granted itself access to photos, videos, and associated metadata through a broad, single authorization.
The Garante determined that this mechanism violated regulations derived from the European ePrivacy directive, specifically Article 122 of the Italian code. Officials said that the feature was enabled by default, and users were often unable to verify precisely which files were being accessed or used by the platform.
The agency clarified that a system-level Android permission does not constitute valid consent under ePrivacy standards, which require clear information and specific agreement for each unique use of personal data.
During the proceedings, Meta Platforms Ireland Limited contested the jurisdiction of the Italian regulator, arguing that the case should be handled by the Irish authorities given the company’s European headquarters. The Garante rejected this position, maintaining its authority to enforce national rules derived from European law. The decision also said that the fine reflects a previous regulatory precedent involving the company dating back to 2019.
This penalty represents approximately 0.47% of the group’s global annual turnover. For comparison, the authority cited previous significant actions in the digital sector, including a 2021 case against Amazon that reached 752 million euros after legal appeals.
Meta has been ordered to modify its application within 60 days to align with Italian data privacy standards. The feature must remain disabled by default for all users, including those who previously granted general permissions. Meta must report its initial progress to the Garante within 30 days, followed by a full report on implemented measures within 90 days.
The regulator justified the scale of the 805 million euro fine by citing the high number of people affected (approximately 20 million Android users in Italy) and the low cooperation of Meta during the investigation. Additionally, the authority said that the violations were still ongoing for those who have not updated the application and for those who have already given their authorization to the system.
While Meta argued that users can manage permissions through their device settings, the Garante maintained that the initial request process was insufficient. The investigation did not address potential use of the data for artificial intelligence training, though the Garante indicated it may examine a new cloud-based photo processing feature launched by Meta in 2026 separately.