Right to One's Image on a Website: What You Need to Know Before Publishing
Publishing an identifiable person's photo on a website generally requires their prior consent, independently of the copyright attached to the image itself. This right to one's image protects every individual, including employees, customers photographed at an event, or minors, the latter requiring the agreement of their legal representatives.
The real issue: two rights get confused, and they call for two separate consents
A common mix-up is assuming that holding the copyright on a photo (having taken it yourself, or paid a photographer for it) is enough to authorize any use of it. In reality, two distinct rights coexist on a single photograph showing a person: copyright, which protects the creation of the image by its author, and the right to one's image, which protects the person shown in it, regardless of who took it. Publishing a photo of someone lawfully means securing both: authorization from whoever holds the copyright on the image, and consent from the identifiable person or people appearing in it.
The general principle behind the right to one's image
Every individual holds a right over the use of their own image, tied to respect for private life. This right means that capturing and distributing the image of an identifiable person generally requires their prior consent, subject to narrow exceptions recognized by case law (a public figure acting in their official capacity, a crowd scene where no individual is singled out, breaking news under certain conditions). These exceptions are interpreted strictly and should never be assumed to apply without a careful look at the actual situation.
Common situations on a business website
| Situation | What to do |
|---|---|
| Employee photos on the team page | Written consent recommended, kept separate from the employment contract |
| Photos of customers at an event (trade show, opening) | Prior consent, or clear notice giving them a chance to object before publication |
| Photo of a minor | Consent from legal representatives, mandatory in all cases |
| Customer testimonial with a photo | Explicit consent covering both the text and the accompanying image |
| Photo taken in a public place with identifiable bystanders | Consent required as soon as a person is recognizable and singled out, outside of crowd scenes |
| Photo of executives or company spokespeople in a professional context | Consent presumed within the scope of their duties, but still worth formalizing |
What an image rights authorization should cover
To hold up, an image rights authorization should ideally spell out several elements: the identity of the person concerned, a description of the permitted use (website, social media, printed materials), the duration of the authorization, and the person's ability to withdraw their consent. A vague authorization ("I authorize the use of my image") leaves room for disagreement over its actual scope if a dispute arises later, especially if the use ends up going beyond what was originally intended.
The special case of minors
A minor's photo generally cannot be published without the consent of their legal representatives, regardless of the context (a school website, a sports club, an association). This consent should ideally be collected in writing, specify the exact intended use, and remain revocable at any time by the legal representatives, even after an initial authorization has been given.
How this fits with GDPR
A photograph showing an identifiable person is also personal data under GDPR, which adds a second layer of protection on top of the right to one's image. Collecting and distributing that image must therefore also comply with GDPR principles: a defined purpose, informing the person concerned, and the ability to exercise their rights (including withdrawal). In practice, the consent collected for image rights and the GDPR notice can be formalized together in a single document.
Key takeaways
- The right to one's image protects the person shown, separately from copyright, which protects the photo's author.
- Publishing an identifiable person's photo generally requires their prior consent, with only strictly limited exceptions.
- Written consent, even a simple one, is strongly recommended to keep proof of it and clarify its scope.
- Minors always require the consent of their legal representatives.
- Consent can be withdrawn at any time, which means being able to remove the image in question on request.
- A photo of an identifiable person is also personal data under GDPR, adding a separate information obligation.
Frequently asked questions
Can you publish a photo of a customer taken during an event without their agreement? As a rule, no, if the person is identifiable and the situation falls outside a narrow exception like an unindividualized crowd scene. Consent is the default rule.
Does the agreement need to be in writing, or is a verbal one enough? A verbal agreement can theoretically suffice but remains hard to prove. A written agreement is strongly recommended to have proof of consent.
Can someone withdraw their consent afterwards? Yes, generally at any time. The website must then remove the image concerned within a reasonable time after the request.
Does the right to one's image apply to employees on their company's website? Yes, an employee keeps their right to their own image even in a professional context. Written consent, separate from the employment contract, is recommended.
In summary
The right to one's image requires collecting the consent of identifiable people before publishing their photo on a website, on top of the copyright attached to the image itself. This overview covers the main principles of image rights; for a specific situation, particularly in case of refusal or dispute, seeking a lawyer's advice remains recommended. VeryAppi systematically advises its clients to secure the necessary authorizations before publishing photos of people on their website.
Frequently asked questions
›Can you publish a photo of a customer taken during an event without their agreement?
As a rule, no, if the person is identifiable and the photo doesn't fall under a narrow exception (such as a crowd scene where no individual can be singled out). Consent is the default rule; the exceptions are interpreted strictly and should never be assumed to apply without checking the specifics.
›Does the agreement need to be in writing, or is a verbal one enough?
A verbal agreement can, in theory, be sufficient, but it's very hard to prove if a dispute arises later. A written agreement, even a simple one, is strongly recommended so you have proof of consent and of its exact scope (permitted uses, duration).
›Can someone withdraw their consent afterwards?
Yes, consent to the use of one's image can generally be withdrawn at any time, as the person remains free to reconsider their initial agreement. A website must then remove the image concerned within a reasonable time after the request.
›Does the right to one's image apply to employees on their company's website?
Yes, an employee retains their right to their own image even in a professional context. Publishing their photo on the company website (team page, news) generally requires their consent, ideally collected in writing and kept separate from the employment contract.