Italy’s data protection authority, the Garante, said on 14 November that it has fined Meta Platforms Ireland €805 million. It says that through the Facebook app for Android, Meta accessed photos, videos and their metadata stored on Italian users’ phones without specific consent and without informing them properly.
At the European Central Bank’s 13 November rate, the fine is about $890 million: about 0.44% of Meta’s 2025 revenue and about 5.4 days of its 2025 net income, by our arithmetic. The Garante puts it at about 0.47% of the group’s worldwide turnover.
Business Pill · Distribution advantage
An evergreen Business Engineer explainer on distribution advantage. It teaches the general idea only and does not discuss Meta or this decision.
The key insight: As we read the decision, the Garante fined Meta for how it asked for access, not for what it did with the photos: the findings are a single app-wide permission, a generic notice and a default-on setting, while any AI training on the content was outside the case.
The decision covers a Facebook feature that, according to the Garante, has been available since 2023 and suggests photos and videos from the phone’s gallery as ideas to post while the user browses. The authority says its investigation began in July 2025 after a complaint from the Centro Tutela Consumatori Utenti of Bolzano and used its own technical analysis.
The Garante lists three findings. Gallery access is requested through a single permission that covers the whole app and several features. That permission is preceded by a generic notice about enabling other features, which the authority says does not let users understand they are also authorising gallery suggestions. And the feature was switched on by default.
The authority says such a permission, if granted in full, lets the app read the device’s entire photo archive, usually permanently, without the user or the authority being able to check which information is actually used.
Italy’s EUR 805 million fine as a share of Meta’s worldwide turnover (Garante), 2025 revenue and 2025 net income (Meta 10-K, ECB rate of 13 November 2026; our arithmetic).
The AI Question the Decision Leaves Open
The Garante says the proceeding did not cover any use of the content to train artificial intelligence, which Meta denies. It says it reserves the right to assess separately a new feature launched in 2026 that allows gallery content to be processed in the cloud.
The decision sits beside two other Meta data threads we have tracked. In October, The Verge reported that Meta had removed language from its new commercial terms that legal experts said could let it use scraped web content to train its AI, as our earlier piece covered. And Meta’s Muse personal agent was not listed in any EU App Store storefront we queried on 12 November, as we reported. Neither is part of the Garante’s decision.
What Meta Must Change
Within 60 days, according to the Garante, Meta must ask for consent through a separate, specific request for the feature, explain what it is for, that it involves gallery access and how to switch it off, and keep it off by default, including for users who have already granted the permission. If Meta has not complied by then, the authority says, the feature cannot be switched on for users who have not given valid consent.
The Garante says Meta must report the steps it has started within 30 days and the measures adopted within 90 days.
How the Garante Set the Amount
The authority says it weighed the number of people involved, about 20 million Android users in Italy, and the length of the violation, which it says is still ongoing for users who have not updated the app or have already granted the permission. It also cites a previous 2019 decision against the company and what it calls limited cooperation during the investigation. It counted as mitigating the changes Meta made after the complaint, which it calls late and limited to users who update the app.
That works out to about €40 per affected Italian Android user, by our arithmetic. The amount is 805 times the €1 million the Garante fined Facebook in June 2019 over Cambridge Analytica.
The Garante says the rule breached is article 122 of Italy’s privacy code, which transposes the EU ePrivacy directive and protects the smartphone as part of a person’s private sphere. It says it rejected Meta’s argument that the case belonged to the Irish authority, because the ePrivacy rules have no one-stop-shop mechanism.
The Structural Read
As we read the orders, the business change is the consent screen: within 60 days the feature must have its own, specific consent request and stay off by default, even for users who already granted the permission, according to the Garante.
As we read the amount, about $890 million is about 5.4 days of Meta’s 2025 net income by our arithmetic, so the open question for Meta is less the fine than the separate review the Garante reserves for a 2026 feature that processes gallery content in the cloud.
Garante per la protezione dei dati personali, statement of 14 November 2026 (Italian original)
“Il procedimento non ha riguardato l’eventuale uso dei contenuti per addestrare l’intelligenza artificiale, che Meta nega.”
Three Implications
FOR FACEBOOK USERS IN ITALY The Garante says Meta must switch the gallery-suggestions feature off by default, including for users who already granted the permission, and explain how to turn it off.
FOR META The Garante says Meta must report the steps it has started within 30 days and the measures adopted within 90 days.
FOR OTHER APPS The Garante says article 122 of the privacy code requires free and informed consent for any access to information on a smartphone, regardless of whether data are transmitted or harm results.
The framework opens: “Every AI paradigm produces a different kind of moat.”
As we read it, the Garante’s decision puts a consent condition on one data pipeline, the phone gallery; the framework was published in July 2026 and does not discuss this decision.
What Is Not Established
No Meta statement on the decision appeared in the reports we read by 12:45 UTC, and it is not established whether Meta will challenge it. The Garante’s separate review of the 2026 cloud feature has no stated timetable. Meta was not contacted for this piece.
This Week In The AI Supercycle
The Great Convergence of Capital, Power, and Geopolitics
This week’s issue: for two years the AI build-out was priced as a supply story, and last week as a credit story. This week it was priced as a permission story, and the answer arrived as a cost, not a ban.
Italy’s Garante fined Meta €805 million, about $890 million, over Facebook for Android’s access to phone galleries without specific consent, about 5.4 days of Meta’s 2025 net income by our arithmetic. The authority says the case did not cover any AI training on that content, which Meta denies, and that it reserves a separate assessment of a 2026 cloud-processing feature.
A note on sourcing. The fine, the findings and the orders come from the Garante’s statement of 14 November 2026, read in Italian on the Garante’s website and checked against ANSA; English renderings are ours. Meta’s revenue and net income are from its 2025 Form 10-K; the dollar conversion uses the European Central Bank reference rate of 13 November 2026. Shares, days, per-user and multiple figures are our arithmetic. Meta was not contacted for this piece.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
