€805M fine without Ireland: the lever Italy used on Meta could hit AI next

What's going on

On November 14, 2026, Italy's data protection authority, the Garante per la protezione dei dati personali, fined Meta €805 million. The reason is an inconspicuous feature in the Facebook app for Android: "Suggestions from your gallery while you use Facebook." Since 2023, it has surfaced photos and videos from your phone as potential posts while you scroll. According to the Garante's press release, Meta accessed Italian users' photos, videos and their metadata without obtaining specific consent and without adequately informing them.

The record sum made headlines everywhere. The more interesting question, though, is why Rome got to decide at all. Meta's EU headquarters is in Dublin, and under the GDPR the Irish authority normally takes the lead. This article explains the lever the Garante used, which current AI features the same lever could hit, and what the decision explicitly does not say.

What the Garante found

The proceedings began in July 2025 after a complaint from the Bolzano consumer protection center (Centro Tutela Consumatori Utenti). The authority also ran its own technical analysis of the app. According to the press release, it found three things:

• Facebook requested gallery access through a single permission that covered the entire app and several features.
• The accompanying notice only talked about "enabling additional features." There was no way to tell that this included the gallery suggestions.
• The feature was switched on by default, on around 20 million smartphones in Italy, according to a report by Open.

In setting the fine, the Garante considered the number of people affected, the duration of the violation and a previous decision against Meta from 2019. According to Pasquale Pillitteri's specialist blog, that was a €1 million fine in the Cambridge Analytica case. Meta's limited cooperation during the investigation counted as an aggravating factor. The authority gave Meta only slight credit for the fixes it made after the complaint, saying they came late and only reach users who update the app.

The orders at a glance:

The lever: Art. 122 instead of the GDPR

The Garante doesn't rely on the GDPR but on Art. 122 of the Italian Privacy Code. That's how Italy transposes Art. 5(3) of the ePrivacy Directive. The rule is known as the "cookie clause," but it applies to any storing or reading of information on a device. The Garante puts it like this: a smartphone is part of a person's private sphere. Any access to its contents therefore requires free and informed consent, regardless of whether data is transmitted or any harm occurs.

The crucial point is jurisdiction. The GDPR has the one-stop shop: a company deals with only one lead authority in the EU, the one where it has its main establishment. For Meta, Google, Apple and Microsoft, that's usually Ireland. In its 2021 ruling C-645/19 (Facebook Belgium), the Court of Justice of the EU confirmed that this principle is the rule for cross-border data processing and that exceptions are narrow. The ePrivacy Directive, however, has no such mechanism. Each national authority is responsible for device access in its own country. That's exactly the argument the Garante used to reject Meta's objection that the Irish authority was in charge.

The approach isn't new. France's CNIL has used it several times: in December 2020 with €100 million against Google and €35 million against Amazon, at the end of 2021 with €150 million against Google and €60 million against Facebook, and in September 2025 with €325 million against Google. Each time, the basis was Art. 82 of the French Data Protection Act, France's version of Art. 5(3). Google pointed to Ireland back then too. France's Council of State (Conseil d'État) nonetheless confirmed the CNIL's jurisdiction in early 2022. In 2021, the privacy group noyb deliberately filed its complaint against the Android advertising ID with the CNIL under ePrivacy law. According to Fortune, the aim was to let the French authority decide on its own, without having to involve the other EU regulators.

Italy gets expensive because Art. 166(2) of the Privacy Code puts violations of Art. 122 in the highest GDPR penalty tier: up to €20 million or 4 percent of global annual revenue. Run the numbers: according to the Garante, €805 million is 0.47 percent of revenue. That implies a revenue base of around €171 billion and a theoretical ceiling of roughly €6.8 billion. So the Garante used just over an eighth of the possible range.

In Germany, Art. 5(3) is implemented as § 25 TDDDG (formerly TTDSG). There's no one-stop shop here either. But the penalties are much smaller: § 28(1) No. 13 TDDDG sets a maximum of €300,000 for unauthorized storing or reading. Our take: a case like Italy's would be legally possible in Germany, but a fine in the hundreds of millions would not.

Where the decision is vulnerable

According to Reuters, Meta could not initially be reached for comment and has not said whether it will appeal. Pillitteri considers jurisdiction the most likely point of dispute before the civil court.

Our take: a second weak spot is the phrase "regardless of transmission." In its Guidelines 2/2023 on the technical scope of Art. 5(3), the European Data Protection Board (EDPB) stated that purely local use of stored information isn't "access" as long as the information doesn't leave the device. If the information, or data derived from it, is sent on, for example to a server, Art. 5(3) does apply, even if the data was generated locally. The Garante therefore reads the rule more broadly than the EDPB. That may not be decisive for the gallery case, but the press release doesn't say what data Facebook actually sent to Meta.

What the decision doesn't say

Many headlines link the case to AI. Formally, the decision doesn't support that. The Garante explicitly states that the proceedings did not examine whether gallery content was used to train AI models. Meta denies it. According to startupfortune.com, that's precisely the decision's strength: the authority doesn't need to prove any AI use if the access without consent was already unlawful.

Also explicitly left open is a new 2026 feature that processes gallery content in the cloud. The Garante reserves the right to examine it in a separate proceeding.

Which AI features the same lever could hit

That refers to the feature Meta announced for the EU and UK on April 16, 2026. It analyzes your camera roll, picks out "special moments" and suggests collages, edits and videos. According to TechCrunch, at its US launch the app continuously uploaded images from the device to Meta's cloud to do this. Meta stresses that the feature is opt-in and that the content won't be used for ads or AI improvements unless you post it or edit it with Meta AI. But according to TechCrunch, if you opt in you accept Meta's AI terms of service. They allow Meta to summarize image content, modify images and generate new content based on them.

Our comparison shows where the ePrivacy lever is likely to apply. The legal column is our assessment, not a regulatory decision:

On Gemini: a Google email announced that starting July 7, 2025, Gemini would work with Phone, Messages and WhatsApp "whether your Gemini Apps Activity is on or off." Malwarebytes and others criticized this as access without fresh consent. How deeply Gemini is embedded in Android is also clear from a July 16, 2026 European Commission decision under the Digital Markets Act. It requires Google to give competitors access to the same system functions, including reading the screen and taking actions across multiple apps. On Samsung's Memory, there are only reports from SamMobile and Engadget based on screenshots. Engadget expects the One UI 9.5 beta soon and the stable release with the Galaxy S27 lineup in early 2027.

What you can switch off yourself

• Facebook: Under Settings & privacy → Settings → "Camera roll sharing suggestions" (the name varies by app version), you'll find two toggles: suggestions while browsing and cloud processing. Turn both off. According to reports, Meta deletes uploaded, unshared photos within 30 days after you switch it off.
• Android itself: In system settings under Apps → Facebook → Permissions → Photos and videos, revoke access or limit it to selected photos. This is the safest switch, because it works independently of Meta's menus.
• Gemini: In the Gemini app, tap your profile picture → Apps and disconnect the connected apps. According to Malwarebytes, disconnected apps are blocked regardless of the activity setting. You can also turn off Gemini Apps Activity.
• Google Photos: You can disable the Gemini features in the Photos app settings. According to heise, the toggle is well hidden.
• Recall: The feature is opt-in. If you turned it on, you can stop it from saving snapshots in the Windows privacy settings.

The bigger picture

The decision matters mainly because of the legal route. It shows that authorities outside Ireland can go after Big Tech as soon as an app accesses content on a device, and in Italy with GDPR-scale fines. AI assistants in particular depend on this kind of access: they read your gallery, screen, messages and screenshots. That creates a new risk for providers. Instead of one lead authority, many individual regulators across the EU could become responsible, with different interpretations and, as the comparison between Italy and Germany shows, very different penalty ranges.

Plenty remains open. Meta can go to court, and jurisdiction is the obvious point of attack. The "even without transmission" interpretation is stricter than the EDPB's. And no one has examined whether gallery content ended up in Meta's AI. Our take: the 60-day order is likely to have more impact than the fine itself. Experience shows that when a feature has to be actively switched on, far fewer people use it. The thing to watch is whether the Garante goes after the cloud analysis of camera rolls on the same grounds, and whether other EU authorities follow suit.