Why “we have the photo” is no longer enough
Companies regularly publish photos of people on social media, career pages, press releases, internal communication channels and event galleries. From a marketing point of view, this makes sense. Real people build trust, show company culture and help a brand feel more human.
But this is also where many questions begin. What is allowed? What has been agreed? Where can the photo be used? And where does the risk start?
The European Data Protection Board (EDPB) reminds us of an important principle: consent is not just a formal click or an assumption. If a company relies on consent, it must be clear, easy to understand and freely given. It cannot be assumed by default.
Consent under GDPR: When to act and what to do
From a communication and marketing point of view, this means one simple thing: it is not enough to think, “the person was at the event, so they probably do not mind.” Today, assumptions are not enough.
In my opinion, the use of photos in companies is still often viewed too narrowly. It is not only about whether a photo can be posted on Facebook or LinkedIn. It is really about the process. Where will the photo be used? For how long? Will it be used only in one social media post? Or will it stay on the website, in ads, presentations, HR materials and employer branding content for several years?
These questions show whether a company’s approach is clear and organized, or unclear and risky.
In practice, the problem often appears because content is created quickly and by different teams. One team takes photos at an event. Another team uses the same photos in a job ad. A third team uses them later in a campaign. After some time, it is no longer clear what was agreed, for which purpose and for how long.
Photo use is not only a legal question. It is also a reputation question. People expect respectful treatment of their image and personal data. If a company cannot clearly explain where and why a photo is being used, it can create mistrust.
If a person is identifiable in a photo, it is no longer just visual content. It is personal data. The clearer the process is, the safer both sides feel - the company and the person in the photo. That is why teams do not only need “more legal text”. They need better visibility. Where was consent collected? What exactly did the person agree to? Can the company prove it? And what should happen if the person withdraws consent?
This is already part of modern content management. In the past, a good photo was enough. Today, companies also need clear photo usage management.
For companies that regularly publish photos of people, this is becoming a quality standard, not only a data protection topic.
For marketing, HR and communication teams, this means three very practical questions:
- Do we know for which purpose the photo was approved?
- Can we prove it?
- Can we react if the photo should no longer remain public?
In the context of GDPR and EDPB guidelines, these are no longer theoretical questions. They are signs of a good everyday process.
Consent for photo use is not a barrier to communication. It is a way to publish content more clearly, more safely and with more respect for the people shown in it.
By Eva Luksa. Personal opinion, not legal advice.