Checking image rights for business websites systematically
From file provenance to attribution: a traceable review process for business websites operating in Germany.
An attractive photograph is easy to add to a website. The legal questions often sit elsewhere: a client supplied the file, a previous agency used it already or an image library described it as free. None of those facts automatically establishes that the new company may use it for the proposed publication.
This guide provides general orientation for business websites in Germany, including the relevant European data-protection context. Sources were checked on 9 November 2026. Unclear agreements and actual disputes require individual legal assessment. The focus is a traceable approval process connecting legal review with controlled technical publication.
1. Separate the different layers of rights
An image can involve several rights. The photographic contribution, an identifiable person and a protected artwork within the scene are different subjects of assessment. Permission from a photographer does not necessarily resolve questions concerning the person or an artwork in the background.
For a business website, begin with three columns: rights in the image, rights relating to its subject and contractual conditions of use. Data protection and other requirements may also apply. This division is an editorial working aid rather than an exhaustive list covering every possible scene.
| Layer | Typical question | Possible evidence |
|---|---|---|
| Image rights | May the company publish this photograph? | A licence or documented rights agreement |
| People | Is publication of this identifiable person covered? | Suitable consent or another assessed basis |
| Subject matter | Does the scene include other protected works? | Separate permission or an assessed statutory basis |
| Conditions | Does the permission cover the planned use? | The retained applicable terms |
The practical implication is clear responsibility. A person implementing the file cannot infer sufficient rights merely from receiving it. The responsible organisation should provide an understandable approval and its foundation.
2. Ordinary photographs can be protected too
German copyright law includes photographic works, while section 72 UrhG also protects photographs under a related right. It is therefore unreliable to assume that an ordinary product image or quickly taken photograph is freely usable because it appears to involve little artistic creativity.
The absence of a copyright notice does not settle the issue either. The relevant question is which rights exist and which uses have been authorised. A watermark, particular resolution or discovery through a search engine does not provide a complete answer.
Downloading an image from a public profile does not itself grant general permission to use it on a business website. Accessibility and authority to use are different matters. An internal image collection should preserve that distinction rather than treating every obtainable file as an approved asset.
If the protection or rights position is unclear, do not base publication on an unsupported assumption. Selecting an alternative with clear documentation may be more practical than reconstructing a poorly documented historical chain after release.
3. Identify the specific scope of use
Section 31 UrhG addresses granting rights of use and possible restrictions. Establish whether the intended use falls within the permission granted. “The picture was purchased” is too vague to answer that question.
Publication on a publicly accessible business website is a specific use. A social-media post, paid advertisement or printed brochure may involve additional uses. Check the relevant agreement rather than automatically extending permission for one channel to every other channel.
Review temporal, territorial and content restrictions. Is the permission granted to a particular company? Does it cover a named client or only the agency obtaining the licence? May another service provider receive the file to maintain the same website?
Seek written clarification when wording is unclear. Contractual purpose can matter to interpretation, but precise drafting helps avoid later disagreement. Record the actual intended uses when commissioning the image rather than after those uses have already expanded.
4. Make the chain of origin traceable
A file may pass through several organisations: photographer, image agency, client and digital agency. The rights granted through that chain need to support the proposed use. An email attachment initially documents delivery, not the complete extent of permission.
Request the appropriate licence or rights agreement and an unambiguous connection to the file. Evidence should identify the contracting party and the relevant image. An invoice without a clear link to the asset may be too imprecise for later investigation.
Earlier publication demonstrates that an image was used, not necessarily that the use was authorised. A relaunch is a useful opportunity to organise rights records. It is not a reason to republish unclear files solely because they appeared on the previous site.
Client confirmations should also be specific. Instead of “the images are cleared”, record which assets are approved for which use and on what basis. Contractual assurances between client and provider can matter without automatically creating missing rights against third parties.
5. Assess identifiable people separately
Images of people involve the rights of those depicted as well as rights in the photograph. Sections 22 and 23 KunstUrhG contain the consent principle and specified exceptions concerning dissemination and public display. Their application depends on the circumstances.
A person shown on a business site often appears in a promotional or representative context. Taking the photograph at an event does not automatically resolve whether that later use is permitted. A group photograph is not inherently exempt from assessment.
The photography FAQ from Baden-Württemberg's data-protection authority explains additional data-protection considerations. A publicly accessible company site should not rely simply on the fact that the original photograph was taken privately. Capture, storage and publication need assessment in their actual context.
Document the purpose and scope of any required consent and the relevant channels. Employment relationships, children and sensitive circumstances may introduce additional questions. A general template should not be applied to all of them without review.
Separate operational convenience from the legal basis. Having a photograph ready in a media folder may make production easier, but does not settle whether its publication remains appropriate or authorised. The approval record should capture the relevant assessment rather than leave it to the developer to guess.
6. Consider editing and changes in meaning
Web publishing commonly involves cropping, compression and format conversion. Retouching, composites or AI-assisted changes can also create different meanings. Check the editing rights and actual transformation rather than assuming that every edit is merely technical.
Section 23 UrhG addresses adaptations and transformations. Agreements and rights concerning the subject may matter as well. The assertion that any small change turns someone else's image into freely usable original work is not a sound basis for publication.
Context is particularly important. A composite can suggest that a real person endorses a product or visited a location. Such alterations need their own assessment. Access to an editing function says nothing about whether a particular edit is legally permitted.
Connect the edited version to the original in the record. Note the adjustment and approval covering it. That makes it possible to determine whether the version actually published was the one reviewed.
7. Understand attribution and image credits
The right to recognition of authorship is addressed by section 13 UrhG. Licence conditions may additionally specify wording, placement or links. Identify what is required for the particular image.
A general list in the legal notice may fail to provide the required association if different placement is specified. Alternative text is also not automatically an appropriate substitute for a required visible credit. Its primary role is to communicate the image's informational purpose.
Attribution does not supply the missing permission. Naming a photographer and source does not by itself authorise use. Review the authority to publish and the required designation as separate matters.
Check the credit in the actual output. After translation, an image change or a mobile redesign, it should still identify the correct asset. Preview images and social-sharing images can create additional contexts of use that need to be considered.
8. Connect an asset register to the file
| Record | Possible contribution | What does not follow automatically |
|---|---|---|
| Licence agreement | Permission within the agreed scope | Resolution of every right concerning the subject |
| Purchase record | Contract and payment association | Unlimited use across all channels |
| Person's consent | Evidence for a particular publication involving the person | The photographer's usage rights |
| Credit | Association and required attribution | Missing permission to use |
A simple register can support editorial review. It records an internal identifier, original source, applicable agreement and approved uses. Add expiry, editing restrictions and the required credit where appropriate.
{
"asset_id": "DEMO-IMAGE-014",
"file": "team-consultation.webp",
"rights_record": "contracts/photo-agreement-014.pdf",
"approved_uses": ["company_website"],
"credit_text": "Example name under reviewed agreement",
"person_review": "required",
"status": "review_required"
}This JSON is one possible documentation structure with fictional details. A field labelled “approved” would not replace missing permission. The register points to actual evidence and responsible review. It is not an automatic legal opinion.
Associate derivatives with the same internal identifier. If the original produces three responsive WebP files and a social crop, provenance does not need four disconnected, potentially inconsistent records. However, permission must still cover each relevant use.
Protect access to the register and evidence. Contracts and consent records may contain personal or confidential information. They do not belong in an unprotected public media directory. Only the required public credit should be included in the page output.
The register should also distinguish a source file from a final output. A similarly named image is not necessarily the same asset. Stable identifiers and, where useful, file hashes can support technical matching without purporting to establish legal authority themselves.
9. Work through a concrete approval example
A fictional consultancy receives a team photograph from its former provider for a relaunch. The file is technically suitable and was online before. Several questions still need recording: who grants the rights, which client is covered and what basis supports publication of the identifiable people?
The editorial team initially marks it for review. It obtains the agreement and relevant person-related records and compares them with the planned use. A new paid advertisement is assessed separately rather than inferred from previous website use.
Once the questions are resolved, the actual edited version is approved. Implementation carries over the corresponding credit. If an essential basis remains unclear, the team selects another appropriately cleared image. Publication pressure does not expand the permission required.
This is an editorial example, not a report of a real dispute. It illustrates the questions approval should answer. Particular cases may add requirements arising from the subject or a different contractual chain.
10. Reassess use when circumstances change
Image rights remain relevant after the first upload. A company may change its name, add services or adopt new channels. A time-limited campaign may end or a team member may leave. Check whether such changes affect the documented permission.
Copying an image to a new domain may involve a different contractual use from the one recorded. Transfer to another company can also raise questions. Whether it is covered depends on the agreement and actual context.
Plan reassessment when relevant changes occur. An asset register can flag expiry dates. The reminder does not decide the legal question, but helps prevent time-limited permission from being treated as permanent.
Removal also requires looking for derivatives: thumbnails, earlier articles, sharing images and language versions. This technical inventory is a separate task. Deleting one visible placement does not automatically remove every other output.
11. Handle unclear claims in an organised way
If a complaint arrives, identify the affected files and uses. Preserve the available records and investigate the claimed association. Deleting all supporting evidence without thought can make the situation harder to clarify.
Section 97 UrhG provides, among other things, remedies concerning removal and injunction, with damages subject to further requirements. A general checklist cannot determine conclusively which claims exist in a particular dispute.
Do not respond with unreviewed blanket acknowledgements or improvised binding undertakings. Obtain appropriate professional review of specific demands and attend to deadlines. Technical use may be suspended in a controlled way where appropriate to the circumstances and legal assessment.
After resolution, address the process failure. Was the licence missing, the file misidentified or a new use added without review? That investigation improves the workflow and reduces the chance of repeating the same problem with a different asset.
12. Connect editorial review with implementation
Reliable publication associates the legal approval with the file actually output. Rights records and technical media handling should not exist as unrelated collections. Otherwise an approved photograph can accidentally be replaced by an unreviewed version.
Name who reviews evidence, approves use and checks publication. One person may perform these roles in a small business, but the tasks should remain distinguishable. That makes omissions easier to identify during handover.
A final visual check examines the image, credit and context on the intended pages. Include mobile layouts, language versions and relevant sharing previews. A correct agreement does not prevent an implementation mistake that displays the wrong asset or name.
When handing work to another provider, supply the actual used files, stable identifiers and relevant usage evidence. Protect confidential records. A file-name list alone often leaves it unclear which variant appears where. Add usage locations and relevant limits so subsequent maintenance can assess replacements and new channels. Unresolved points should be handed over as unresolved rather than silently treated as confirmed permission.
A pre-publication image-rights checklist
- The actual file and origin are identified.
- The rights grantor and chain of permission are traceable.
- The intended use is covered by an agreement or another assessed basis.
- Temporal, territorial and content limits are considered.
- Identifiable people and other subject matter have been assessed separately.
- Edits and changed meanings are covered.
- The required credit is associated with the correct file.
- Evidence is protected and retrievable.
- Other channels and derivatives are considered.
- Changes, expiry and complaints have an organised handling route.
Common questions about business image rights
Is naming the source enough?
No. Attribution may fulfil a separate requirement, but it does not replace the necessary authority to use the image.
Are free images always permitted in advertising?
That depends on the applicable conditions and subject. Free describes the price, not automatically the entire rights position.
May an agency use every image supplied by a client?
Delivery alone does not establish permission. Document the intended use and its foundation specifically.
Does AI editing remove earlier rights questions?
No. Editing requires its own assessment and can introduce additional questions. Origin and affected rights remain relevant.
Sources and editorial status
Scope: Germany and the relevant European data-protection framework. Checked on 9 November 2026. Sources are the linked German Copyright Act and Art Copyright Act, plus the Baden-Württemberg data-protection authority's guidance. The register and approval examples are editorial implementation aids rather than individual assessments of unclear agreements or disputes.
For the wider publishing context, read What a professional business website needs to achieve. For the actual loading of external resources, see Website privacy and tracking.
