Publishing photos of people: plan consent and specific uses

A good photograph of a person can make a website more credible. It can also lead to a publication the person never expected. The photographer may have licensed an image for an annual report. The subject may have agreed only to a group picture. Meanwhile, the editorial team may be preparing an advertising campaign for a different audience. The gap between those three understandings is where a proper review needs to begin.

This guide concerns photographs of people used by businesses, organisations and their agencies in Germany under European data protection law. Legal position and source review: 9 November 2026. It describes an editorial process rather than determining disputed individual cases. Journalistic privileges, employment relationships and sensitive circumstances may require specialist assessment. The working arrangements recommended below are organisational choices, not additional statutory forms or an automated legal approval system.

Describe the intended use before selecting the picture

Start with a complete use statement: the organisation wants to publish a particular portrait on its publicly accessible team page, associate it with the person's name and role, and use it for that purpose until the next review. This is more useful than writing “marketing”. It identifies who is acting, what the picture shows, the intended public exposure and the surrounding context. A later paid social media advertisement then becomes visible as a separate proposal rather than a routine resizing exercise.

Next, identify the versions that will be produced. A group photograph in an event report can become an individual portrait after cropping. A neutral image can acquire a political or medical meaning through a new caption. A collage may imply that the people pictured endorse particular products or positions. The assessment must therefore concern the actual image together with its accompanying words and placement.

Give the editorial team this use statement before commissioning photography. It can then plan suitable images instead of trying to rescue a beautiful but unsuitable picture afterwards. A strong alternative without identifiable people may be particularly helpful for a campaign expected to run for a long time.

Keep three different rights questions separate

The photographer's licence does not answer the same question as the subject's permission. Data protection adds another question about the processing involved. An invoice for a photographic session is consequently not complete evidence for every later publication. Equally, a person's agreement to use their likeness does not automatically give the publisher the necessary copyright permissions for the photograph itself.

One working record can connect these materials, but the documents should remain distinguishable. Otherwise a photographer's contract may appear in a media library as supposed approval from everyone pictured. Clear descriptions prevent that category error before a designer selects the image. They also make it easier to locate the right person when a planned use changes.

Taking the photograph and publishing it are separate decisions

Section 22 KunstUrhG addresses distributing and publicly displaying portraits. Section 23 describes exception categories and limits them through the legitimate interests of the person depicted. These provisions do not create a general permission for every photograph taken in a public place. Capturing and subsequently processing the image also require the appropriate data protection assessment.

The relationship between data protection, image rights and journalistic rules depends on the context. The Rhineland-Palatinate supervisory authority discusses the separate assessment of taking and publishing photographs and the role of contextual balancing. That is supervisory guidance rather than a judgement deciding every case. Calling an ordinary business publication a “journal” does not by itself establish a journalistic privilege.

In practice, create a decision point after photography and another before publication. Some images may initially exist only for internal selection. Choosing a particular version, identifying its purpose and checking its supporting evidence then prepares the publication decision. A folder called “event approved” does not reliably capture those differences, particularly when images are reused months later by another team.

Identification involves more than an unobscured face

Work clothing, a name badge, a tattoo, a distinctive location or the accompanying text may identify someone. Covering their eyes does not necessarily resolve the issue. Examine the photograph from the perspective of a relevant viewer familiar with the activity or setting. In a small organisation, a job title combined with a physical characteristic may be enough to make the association.

Check details outside the main subject as well. A background screen may display names. A visitor list may be visible on a table. Reflections can reveal additional people. Inspect the original resolution before the file spreads through crops, automatically generated thumbnails and several publication channels. This makes selection more reliable than discovering the background problem in an enlarged social media preview.

If editing genuinely makes the person unidentifiable, assess that exact version. A soft blur or an automatic face detection marker does not prove the result. Keep the source image and the publication version distinguishable so that the record shows which image was actually reviewed. The decision should concern an existing file, not a promised future edit.

Prepare a clear and specific consent request

Where consent is the chosen basis, the person needs a real and informed choice. A practical request should explain the intended uses in understandable terms. The Berlin data protection authority stresses distinguishing the making of images from their publication, explaining purposes and providing usable contact details.

A public team page, a printed brochure and a platform advertising campaign have different audiences and consequences. Separate choices where the purposes are genuinely independent. People should not have to discover paid advertising hidden in a long paragraph of broad permissions. Explain whether their name and role will accompany the picture or whether only the image is intended for use.

A short editorial example might say: “We plan to use your portrait on our public team page together with your name and role. Paid advertising is a separate use and is not being requested here.” This is not a complete consent form. The controller's identity, required information, real choices and withdrawal arrangements must fit the actual circumstances. The example simply makes the proposed use visible instead of replacing it with a vague reference to communications.

Evidence does not mean collecting the largest possible dossier

A signed document with no connection to a particular image can be difficult to interpret later. A media library flag saying “permission available” is hardly better. Connect the supporting record to an image identifier, the proposed purpose and the information version used when the decision was made. Store the underlying declaration securely. Editors often need to know only which use was checked and who can resolve further questions.

This register is a working aid. It does not decide whether a declaration is valid or whether an exception applies. Software should preserve that distinction. A complete record demonstrates completeness of the record, rather than proving that a legal assessment has succeeded. Avoid a reassuring green status if the underlying review has not taken place.

Assess actual voluntariness in employee photography

Dependency in an employment relationship requires particular attention. Section 26(2) BDSG contains specific requirements concerning employee consent, its form and information about the purpose and withdrawal. A friendly atmosphere at the photographic session does not demonstrate that staff could decide without pressure.

Organise the session so that someone can decline without making an announcement in front of colleagues. Offer a private response route and a genuinely usable alternative without a portrait. A manager should not stand beside the form treating participation as evidence of loyalty. These arrangements are recommendations for a fair decision environment. They do not replace assessment of the applicable legal basis or cure an unsuitable proposal.

Distinguish functional contact information from a promotional portrait. Someone's responsibility for customer enquiries does not automatically explain why their image is needed in every campaign. Changes of role, departure and changes in presentation should trigger a review of the real purpose. Giving an agency unrestricted access to personnel files is not a sensible way to perform that task. Provide only the information needed for the editorial decision.

Plan event coverage without an invented group exemption

There is no general permission triggered by a particular number of people in a photograph. An event may provide a reason for reporting, but that does not make every visitor available as an advertising subject. An overview of an occasion and an isolated individual portrait require different consideration. A report about the event also differs from a later advertisement for an unrelated product.

The BayLDA guide on photographs and associations discusses contextual balancing and event photography. The document itself is dated 16 May 2019 and concerns association activities. It is not blanket permission for every commercial campaign or every regional situation. Compare its context with the actual intended use instead of copying a favourable sentence into an approval record.

Visible advance information, an approachable responsible person and a practical way to respect those who do not want to be photographed can improve organisation. A notice does not substitute for consent where consent is needed. Plan photographic positions and subjects so that the photographer is not forced to improvise between an attractive scene and a clearly expressed objection. The briefing should make this a normal part of the assignment.

Treat children and sensitive circumstances separately

Photographs involving children call for particular care. The authority of a guardian, the child's situation and the child's own wishes cannot be dealt with by simply reusing an adult form. Whether a particular person can represent the child and what decision the child can make require contextual assessment. The age provision in Article 8 GDPR for certain information society services is not a universal age threshold for publishing every kind of photograph.

Limit exposure early. An internal keepsake is different from a publicly searchable campaign containing a name, location and recurring attendance times. Several individually ordinary details may create an unnecessary risk when combined. Review the caption and supporting metadata as part of image selection instead of checking only the central photograph.

Apply similar care to medical, religious, political and otherwise highly personal situations. A face in isolation does not settle the assessment. The information revealed by the surrounding context and the way the photograph is processed may matter. Avoid treating a person in such a setting as interchangeable decoration for another subject. An image that is visually attractive can still be unsuitable for the proposed message.

Work through three fictional publication situations

These are invented learning examples, not resolved legal cases. They do not provide a shortcut to approval. Their purpose is to reveal the changed processing step. In an editorial meeting, everyone should be able to describe that step before discussing how attractive the image is. This keeps the decision anchored in a concrete proposal rather than a general feeling that permission probably exists.

Give photographers and service providers the same brief

Tell the photographer more than the required file format. They need the image concept, intended use and organisational boundaries. Who will obtain any necessary declarations? Who informs participants? Who marks images that have not yet been assessed, and who receives each selection? Allocate these tasks before the session rather than reconstructing responsibilities from email attachments afterwards.

A service provider's data protection role depends on what they actually do. Not every photographer is automatically a processor, and not every agency is automatically an independent controller. The relevant contractual arrangement must reflect the decisions and activities in practice. Asking everyone for a processing agreement does not answer that prior question about their role.

Agree how originals, rejected images and selected versions will be transferred. A broadly accessible gallery with a permanently valid link may undermine an otherwise carefully limited photography plan. Selection often requires only a restricted set of previews. The complete evidence folder does not need to circulate to every designer. Access should follow the actual task, with a route for obtaining further information when genuinely necessary.

Record publication locations before the first upload

An image rarely exists in one place only. A website generates thumbnails and several delivery sizes. A newsletter may copy it into another media store. A platform publishes an additional crop. A PDF remains available for download. Without a record of these uses, an editor can replace the main image while leaving other accessible versions untouched.

Record specific pages, documents and managed accounts instead of just channel names. Identify who can change each publication. Material shared with a partner organisation cannot necessarily be removed through your own website controls. An agreed contact and a record of the transfer make a later request easier to handle. At the same time, do not promise the person that every third-party internet copy can be recalled.

The register can remain small. An image identifier, a responsible use and an available contact may be more useful than an elaborate catalogue nobody maintains. Check new campaigns against it. That makes it less likely that an old team image will gradually become a permanent illustration for new messages that were never part of the original proposal.

Distinguish withdrawal, objection and erasure requests

Withdrawal concerns previously given consent. An objection can concern a different legal basis. An erasure request has its own conditions and possible exceptions. Editors should receive these requests and route them correctly rather than placing every message under the same heading of “permission cancelled”. This distinction improves handling without requiring the editorial team to decide every legal issue itself.

If future use relied on consent that has been validly withdrawn, the organisation should not silently switch to another basis simply because it still likes the photograph. Clarify the consequences and suspend new uses while the issue is assessed. Withdrawal does not retrospectively make earlier lawful processing unlawful. That distinction does not permit the same publication to continue indefinitely without further consideration.

A practical response identifies the image and person, holds further campaign exports and checks the recorded publication locations. Existing print stock, onward sharing, evidence requirements and possible exceptions need specific decisions. Document the response and the actions taken. A date showing when the request arrived does not establish that it was actually handled. Assign someone responsibility for completing the task and checking the result.

Checklist before publication

• The particular image, publication version and identifiable people are recorded.
• The purpose, audience, channel, accompanying text and intended exposure are understandable.
• Photographic usage rights, rights in the person's image and data protection have been considered separately.
• Taking and publishing the photograph each have an assessed basis.
• Any required consent is informed, voluntary and connected to the relevant use.
• Employees can decide without practical pressure and have a private contact route.
• The appropriate additional assessment has taken place for children or sensitive circumstances.
• Crops, names, background details and file metadata have been checked.
• Publication locations and responsible contacts are known.
• Requests, withdrawal and any applicable objection can be handled in practice.
• An unresolved issue holds the image instead of producing an invented approval.

A small editorial rule that changes everyday decisions

Do not publish a person's photograph simply because it is already in a shared folder. Ask which use has been assessed and which version that assessment concerned. If the connection is missing, an alternative image can be quicker and more appropriate than a hurried request for broad permission. A good photography brief plans that alternative before the session.

The process matters particularly after initial publication: when someone changes roles, a new advertising channel is added or the person contacts the organisation. If the image, responsible role and recorded uses can be found, the team can act coherently. That practical ability to respond is the purpose of the planning described here. It comes from clear responsibility and reliable evidence rather than the largest possible collection of forms.

Primary sources and their scope

The statutory starting points are section 22 KunstUrhG, section 23 KunstUrhG, section 26 BDSG and the GDPR. The consolidated text supplied by the Hamburg supervisory authority is a useful reading version; the official legal acts remain authoritative. The linked supervisory guidance addresses the situations described by each authority. The older BayLDA document is identified by its own date. Registers, session arrangements and editorial checkpoints proposed in this guide are implementation recommendations.