The roughly $887 million headline figure is €805 million, imposed by Italy's data protection authority, the Garante. Most coverage calls it a privacy or GDPR fine. The law behind it is different from the GDPR, and that affects both how the amount was set and how hard it will be to collect.

If it isn't a GDPR fine, why does it carry GDPR-sized penalties?

Italian law borrows the GDPR's penalty scale. The Garante found that Meta broke Article 122 of the Italian Privacy Code, which implements the EU's ePrivacy Directive. That rule treats your smartphone as part of your private sphere. Any access to its contents needs free and informed consent, whether or not data leaves the phone and whether or not anyone is harmed. The AP described it as a breach of a European privacy directive written into Italian law.

The penalty link comes from Article 166(2) of the same Code. It puts Article 122 violations in the higher GDPR penalty tier, Article 83(5).

What's the maximum fine?

The GDPR has two caps. The lower tier is €10 million or 2% of worldwide annual turnover. The higher tier, for more serious violations, is €20 million or 4%, whichever is higher. For a company Meta's size, the 4% figure is far larger than €20 million.

The Garante said the fine equals about 0.47% of the group's worldwide turnover. It did not say which year's turnover it used, at least in the statement we read. Our own arithmetic: 0.47% is just under an eighth of the 4% ceiling. Working backward, €805 million at 0.47% implies turnover of about €171 billion, which would put the cap near €6.9 billion. No source gives those last two figures, so treat them as estimates.

How did Italy arrive at €805 million?

The Garante weighed factors that pushed the fine up against a few that pulled it down. Its statement lists these:

  • Scale: about 20 million Android users in Italy were affected.
  • Duration: the violation is still ongoing for users who haven't updated the app or who already granted permission.
  • History: a 2019 decision against the company.
  • Cooperation: the regulator called Meta's cooperation poor. The AP reported that this "lack of cooperation" affected the penalty.
  • Mitigation: Meta's changes after the complaint counted in its favor. The Garante called them late, though, and said they only reach users who update the app.

The conduct itself: the "Get suggestions from gallery while browsing Facebook" feature has been available since 2023. Gallery access came through one app-wide permission behind a generic "enable other features" prompt, and the feature was on by default. The investigation began in July 2025 after a complaint from a consumer protection centre in Bolzano.

How are GDPR fines normally calculated?

EU regulators follow a five-step method set by the European Data Protection Board (EDPB). It adopted the final version in May 2023. The method works like this:

  1. The regulator rates how serious the violation is. A low-seriousness case starts at 0–10% of the legal maximum, a medium one at 10–20%, and a high one at 20–100%.
  2. It adjusts that starting amount for company size, using turnover bands that run from under €2 million to over €500 million.
  3. It moves the figure up or down for aggravating or mitigating factors under Article 83(2), such as past violations and cooperation.

The EDPB warns that this is not an automatic arithmetic calculation.

It's unclear whether this method formally applies here. It was written for GDPR fines, and this is a national ePrivacy fine. The Garante's statement lists its factors but doesn't say which seriousness band or starting amount it used. On our arithmetic, roughly 12% of the maximum would fall in the "medium" range. Adjustments in later steps can move the final number a long way from the starting point, though, so the end figure doesn't reveal the band.

Does Meta have to pay now?

Not necessarily. Italian law gives Meta two routes:

  • Settle for half. Under Article 166(8), a company can close the case within the appeal deadline by complying with the Garante's orders and paying half the fine. Here that would be about €402.5 million. Garante decisions usually describe this as paying half within 30 days.
  • Appeal in court. Meta has chosen this route. A spokesperson said the company "strongly disagree[s]" with the assessment and the size of the fine, and that it would appeal.

We haven't confirmed whether Meta has filed yet, or whether it will ask an Italian judge to suspend payment while the case runs.

If the money is eventually paid, Italian law sends half of each year's fine proceeds to a Garante fund for awareness campaigns, inspections and GDPR implementation work.

Could a court throw the fine out?

Possibly. Jurisdiction is the main risk. Meta argued that Ireland's regulator, not Italy's, should handle the case. The Garante rejected that because the ePrivacy rules have no "one-stop shop". Under the GDPR, the one-stop shop sends cross-border cases to the regulator in the country where a company has its EU base.

There's a recent precedent. In March 2026, the Rome Tribunal annulled the Garante's €15 million fine against OpenAI. It ruled that once OpenAI set up an Irish establishment, the GDPR one-stop shop required the case to go to the lead authority. That case was a GDPR case, and this one rests on ePrivacy. How courts handle the overlap between the two laws is unsettled, so nobody can say yet whether the OpenAI ruling helps Meta.

Do big EU privacy fines actually get paid?

Often not for years. Ireland gives the clearest numbers. Of €3.26 billion in fines from its Data Protection Commission between 2020 and October 2024, only €19.9 million had been paid. Of the €1.55 billion levied in 2023, which included Meta's €1.2 billion fine, just €815,000 had been collected.

The reason is procedural. Irish fines only become payable once a court confirms them, and the regulator can only ask for confirmation if the company hasn't appealed. The regulator said none of the money had been written off. These are Irish rules, though, and Italy's process differs.

Meta's €1.2 billion fine over EU-US data transfers is still being fought. Meta appealed it, including at the EU General Court. In February 2026, MLex reported that the appeal had been "unlocked" after a ruling by the EU's top court. Across the EU, a mid-2026 analysis found that about 40% of €7.1 billion in GDPR fines had been annulled or were under legal challenge. We saw only summaries of those last two reports.

What does Meta have to change, whatever happens to the fine?

The orders to change the app don't depend on whether the money is paid. Within 60 days, Meta must ask for separate, specific consent for the gallery feature and keep it off by default, including for users who already said yes. It must report the steps it has started within 30 days and the measures it has adopted within 90.

The case did not look at whether gallery content was used to train AI, which Meta denies. The Garante will separately review a new 2026 feature that processes gallery content in the cloud.