Meta Fined €805M for Reading Photo Galleries Without Consent: How to Revoke Access Now

Key Takeaways

• Italy’s privacy regulator fined Meta €805 million (about $890 million) on November 14 for the Facebook Android app reading photos, videos, and metadata from roughly 20 million Italian users’ phone galleries without specific consent. It is the biggest photo-privacy ruling of the year.
• The culprit is the “get suggestions from your gallery” feature, switched on by default since 2023 and covered by a single vague app-wide permission instead of a clear, separate consent.
• Meta has 60 days to turn the feature off by default (including for users who already granted access) and to ask for separate, specific opt-in consent that explains exactly what gallery access involves.
• You don’t have to wait for Meta: this guide shows how to check and revoke Facebook’s gallery access on Android and iPhone in under a minute.
• The Garante has reserved a separate investigation into Meta’s 2026 feature that processes gallery content in the cloud. AI training on gallery photos was not examined in this case, and Meta denies doing it.

Italy’s data protection authority just handed Meta the biggest photo-privacy fine of the year. On November 14, the Garante fined the company €805 million (about $890 million, and roughly 0.47% of Meta’s worldwide turnover) because the Facebook app on Android read photos, videos, and related metadata from about 20 million Italian users’ phone galleries without specific consent.

For photographers, this ruling matters twice over: it targets exactly the kind of quiet, default-on gallery access that creative professionals should never tolerate on a phone full of client work, and it comes with a practical to-do. Here is what the regulator found, what Meta must change, and how to revoke Facebook’s access to your own camera roll today.

What the Garante Found

The case centers on Facebook’s “get suggestions from your gallery when browsing” feature, available since 2023 and preset to active. While a user scrolls Facebook, the app scans the phone’s gallery and surfaces photos and videos as posting ideas. To do that, per the Garante’s technical analysis, it accessed images, videos, and their metadata continuously.

The regulator’s core objection is consent mechanics. Gallery access was bundled into a single permission covering the whole app, preceded by a vague prompt about “enabling other features.” Under Article 122 of Italy’s Privacy Code, which implements the EU ePrivacy rules on accessing information stored on a user’s device, that is not specific consent. The proceeding started in July 2025 after a complaint by a consumer-protection center in Bolzano.

The fine’s size reflects aggravating factors the Garante lists openly: the number of people affected, the violation’s ongoing duration, a prior measure against the company from 2019, and what it calls limited cooperation during the investigation. Meta’s changes after the complaint were considered late and limited to users who update the app. Meta, for its part, argued the Irish regulator should have jurisdiction, an argument the Garante rejected by grounding the case in ePrivacy rules rather than the GDPR’s one-stop-shop mechanism.

What Meta Must Change in 60 Days

The order is unusually concrete. Within 60 days, Meta must keep the gallery-suggestions feature off by default, including for users who already granted access, and may only re-enable it through a separate, specific consent request that explains what the feature does, what gallery access it involves, and how to switch it off. Meta has to report its planned measures to the Garante within 30 days and the adopted ones within 90.

DownloadSave

How to Check and Revoke Facebook’s Gallery Access Today

The order formally covers Android users in Italy, but nothing stops anyone from closing the same door now. Two layers are worth checking: the system permission and Facebook’s own setting.

On Android: open Settings, then Apps, then Facebook, then Permissions, and tap Photos and videos. Choose “Don’t allow,” or on newer Android versions “Always ask.” If you want Facebook to see only specific images when you post, use the system photo picker so the app receives just the files you select rather than blanket gallery access.

On iPhone: open Settings, then Privacy & Security, then Photos, and set Facebook to “Limited Access” or “None.” Limited Access is the sweet spot for most people: you can still share chosen shots, and the app never sees the rest of the library.

Inside Facebook: in the app, go to Settings, search for “camera roll” or “gallery,” and disable the sharing-suggestions option if it is on. Checking both layers matters because an in-app toggle can reappear with updates, while a revoked system permission holds.

Photographers with client galleries, unreleased shoots, or embargoed work on their phones should treat this as standard hygiene for every social app, not just Facebook: no blanket gallery permissions, ever. The same logic applied when Meta walked back its Instagram AI photo-grab in July after creator backlash.

Why This Ruling Reaches Beyond Italy

Three reasons this is bigger than one country’s fine. First, the legal route: by using ePrivacy device-access rules instead of the GDPR, the Garante sidestepped the mechanism that normally funnels Meta cases to Ireland. Other EU regulators can read that as a template for acting locally against default-on data features.

Second, the target: the decision attacks the design pattern itself, a buried, preset toggle wrapped in one broad permission. That pattern is everywhere in social and photo apps, and a precedent that calls it invalid consent puts every similar feature on notice across the EU.

Third, the sequel: the Garante explicitly reserved a separate proceeding on the feature Meta launched in 2026 that processes gallery content in the cloud. This first case did not examine whether gallery photos feed AI training, and Meta denies that they do, but the cloud-processing probe will land much closer to that question. Photo privacy in Europe is having a consequential season: Germany’s top court just ruled on AI training with photographers’ images, and the EU’s content-authenticity push has its own growing pains.

Pin Now

Frequently Asked Questions

Were my photos used to train Meta’s AI?

This ruling did not examine AI training, and Meta denies using gallery content for it. The question is likely to resurface in the Garante’s reserved investigation into Meta’s 2026 cloud-processing feature for gallery content.

Does the ruling affect users outside Italy?

The fine and the 60-day order formally apply to the Italian situation, with about 20 million affected Android users. But Meta rarely builds country-specific consent flows for long, and the ePrivacy legal route is available to regulators in other EU states. Changes tend to ripple outward.

How do I stop Facebook from reading my gallery?

Revoke the system permission (Android: Settings, Apps, Facebook, Permissions, Photos and videos; iPhone: Settings, Privacy & Security, Photos, set Facebook to Limited or None) and disable the camera-roll sharing suggestions inside Facebook’s own settings. The step-by-step section above covers both layers.

What happens if Meta doesn’t comply within 60 days?

Per the decision, the feature cannot be activated for users without valid consent after the deadline. Meta must report planned measures within 30 days and implemented ones within 90; non-compliance would expose it to further enforcement.

The Bottom Line

€805 million is a loud price tag for a quiet toggle. The ruling says the quiet part plainly: a photo library is among the most sensitive data on a phone, and access to it cannot ride along on a vague, bundled permission. Take the sixty seconds to check your own settings, and watch the cloud-processing probe, because that is where the next chapter of this story gets written.

Related Posts

More on photo privacy and your rights:

Meta Killed Its Instagram AI Photo-Grab After 3 Days: A Rare Win for Photographers The July prequel: Meta’s last default-on photo feature, and the backlash that killed it.

Can AI Legally Train on Your Photos? Germany’s Top Court Answers The other landmark European photo ruling of the season, decided in Karlsruhe.

A German Court Ruled the Subject of Your Photo Isn’t Yours, and the AI Copy Belongs to No One Where European courts are drawing the lines on photos, subjects, and AI.

The Camera-Proof the EU Is About to Mandate Just Got Forged With a Lottery Ticket The authenticity-tech side of the same fight over who controls your images.