Posting photos of customers and staff: the consent you need.
A happy customer in the chair, your team at work, a child at a birthday in your café: photos with people in them bring a post to life. Here is when you need their consent, how to ask for it so it holds, and what changes for staff and children.
Updated 16 October 2026
The short version.
If you can recognise someone in a photo, it is their personal data in the EU and the UK, and in Germany publishing their picture needs their consent by a law of its own. In the United States, using a person's picture to advertise needs their consent under the laws of states such as New York and California.
So the safe habit is the same everywhere: before a recognisable person appears in your business's posts, ask them, write it down, and stop when they change their mind.
A consent that holds
- Who agreed, and to which photos or videos
- Where they will appear: your Instagram, your website
- That they can withdraw it, and how
- When they agreed, kept where you can find it
- A statement of its own, not hidden in other terms
Customers, staff and children.
A customer
Ask before you post, not after. Say where the photo will appear. Under the GDPR you must be able to show they agreed, and they can withdraw their consent at any time, as easily as they gave it. A customer's photo from one of your reviews is theirs: do not take it into your own posts.
Someone in your team
Consent from staff is hard to make truly free, because they depend on you. European regulators accept it only where saying no has no consequences at all, such as a colleague who would rather not be filmed simply working elsewhere that day. In Germany, an employee's consent is given in writing or electronically, and the Federal Labour Court held in 2015 that it does not end by itself when they leave.
A child
Ask a parent. A German regulator (Baden-Württemberg's) expects a parent's consent for a picture of a child who is more than a background detail, and the UK's regulator expects consent from someone with parental responsibility unless the child is old enough to decide.
People in the background
German law lets you publish a picture where people appear only beside a place, or of a gathering, without asking each person, but never where it harms someone's legitimate interest. Simplest: if a face can be recognised and is not the point of the photo, choose another shot or ask.
In the United States.
There is no single federal rule; the states decide. In New York, using a living person's picture for advertising or trade needs their written consent, or a parent's for a minor, and the person can sue for damages. In California, knowingly using someone's photograph or likeness to advertise without their prior consent costs at least $750 in damages, plus any profit made from it. A written release before the photo is posted avoids the question.
Where Neaion helps.
Your office plans posts from your own photos and clips. When a photo or a clip shows a person, it is not used in any post until you tick that you have their consent; who ticked and when is kept, and taking the tick back stops it being used again. Photos customers posted on your Google profile are never copied into your library. A presenter your office makes for a video is a fictional person, unless you choose your own photo for it, with your consent recorded. See how your office makes your posts.
It never
- Posts a recognisable person without your tick
- Copies a customer's photo from your reviews
- Makes a presenter from another person's likeness
Asked before you start.
Do I need consent to post a photo of a customer?
If they can be recognised, yes in practice: in the EU and the UK the photo is their personal data, and in Germany publishing a person's picture needs their consent by law. Ask before you post and keep a record.
Can my employees refuse to be in our posts?
Yes, and they must be able to without any consequence. In Germany their consent is given in writing or electronically.
What about photos of children?
Ask a parent. Regulators in Germany and the UK expect a parent's consent unless the child is old enough to decide.
What if someone withdraws their consent?
Under the GDPR they can withdraw it at any time, as easily as they gave it. Stop using the photo from then on.
Sources
The rules and dates on this page come from these sources, read on the day shown. This guide is general information, not legal or tax advice: rules change and your case may differ, so ask your adviser before you rely on it. If something here is out of date, write to us at hello@neaion.com and we will correct it.
- Regulation (EU) 2016/679, the GDPR, articles 4, 6 and 7, checked 16 October 2026
- European Data Protection Board: Guidelines 05/2020 on consent, checked 16 October 2026
- § 22 KUG: consent to publish a picture (Germany), checked 16 October 2026
- § 23 KUG: the exceptions (Germany), checked 16 October 2026
- § 26 BDSG: employees' data, consent in writing or electronically (Germany), checked 16 October 2026
- Federal Labour Court, 19 February 2015, 8 AZR 1011/13 (Germany), checked 16 October 2026
- Baden-Württemberg data protection authority: photography and data protection, FAQ of 2018 (Germany), checked 16 October 2026
- ICO: how the lawful bases apply to children's personal information (UK), checked 16 October 2026
- New York Civil Rights Law § 50, checked 16 October 2026
- New York Civil Rights Law § 51, checked 16 October 2026
- California Civil Code § 3344 (read from an archived copy of the official page, 10 January 2026), checked 16 October 2026
Read next
Set up your office in an afternoon.
Free to set up, no card needed. It reads your website, asks what it could not find, and nothing goes live until you have checked it.