Many believe that using images always requires consent, but GDPR is really about security and responsibility.

Here are 11 common myths about photos and consent – explained briefly and practically, without legal jargon.

Find out how to strengthen your consent management.

Book a short advisory call.

11 myths about photos and consent

1

“You always need consent to use photos”

In practice:
No. Consent is only one of several lawful bases for processing. In some cases, images can be published following a balancing of interests, for example an association’s ordinary activities.

Example:
A sports club publishes team photos from a match on its website. It may assess that publication is reasonable and justified and does not significantly infringe members’ rights, so consent is not necessarily required. If the image is used in a marketing campaign, however, consent is typically needed.

2

“Consent can be implied”

In practice:
No. Consent requires an active and unambiguous action.

Example:
You cannot simply state in an invitation: “By attending, you agree to be filmed”. Participants must actively agree, for example by ticking a box or signing a declaration.

3

“A YES is enough for valid consent”

In practice: No. Consent must be informed: the person must know exactly what they are agreeing to.

Example: An educational institution records a recruitment video and asks students to sign a list to give consent. It must ensure students are clearly informed of the purpose, intended channels (such as the website and social media), the controller’s identity and how to withdraw consent. The institution must also document that this information was provided.

4

“Once you give consent, it cannot be withdrawn”

In practice: Consent can always be withdrawn, and doing so must be as easy as giving it.

Example: If a boarding school collects consent to use students’ photos on its website, parents and students must be able to withdraw it at any time. The school must then remove the image promptly.

5

“People who refuse consent can be excluded”

In practice: Consent must be freely given. Saying no must not have negative consequences.

Example: An employer wants staff photos on its website. If an employee declines, it must not affect their employment or career; the photo must simply be omitted.

6

“Verbal consent is good enough”

In practice: Verbal consent can be valid, but only if it can be documented.

Example: A municipality asks citizens for consent to be interviewed at an event. If their agreement is recorded on video, this may be sufficient evidence. But verbal consent without any proof is not enough. It should then be combined with a record, such as a signature, email confirmation or recording, to demonstrate informed consent.

7

“One consent form can cover every purpose”

In practice: No. Consent must be specific and granular.

Example: A media agency cannot rely on a single combined declaration in which a participant agrees to appear in images on the website and in advertisements. Participants must be able to agree to one and decline the other.

8

“GDPR does not apply to people in the background”

In practice: GDPR applies if people can be identified.

Example: A photographer takes pictures at an event with participants in the background. The organiser must consider whether the photo is general event coverage, often lawful following a balancing of interests, or whether particular people stand out clearly, which typically requires consent.

9

“Children can give their own consent”

In practice: No. For children under 15, consent should generally be given by the holder of parental responsibility.

Example: A dance school wants to publish performance videos on YouTube. Parents must give consent for pupils under 15. A 16-year-old can typically give their own consent.

10

“Once you have collected consent, you are always covered”

In practice: No. Consent must be documented and remain relevant.

Example: If a business collected consent to use portraits in 2018, renewal may be necessary if the images are still used in 2025. Consent can lose relevance when the purpose or context changes.

11

“Not saying no means yes”

In practice: No. Consent must always be active; implied acceptance is not valid.

Example: At the beginning of an event, the organiser asks: “Is it okay if we take photos and video? If not, tell the photographer.”
This is not lawful consent, because silence cannot be interpreted as agreement. Each participant must actively consent, and consent must be freely given, specific, informed and unambiguous. There are several practical ways to approach this: Let participants choose a location, such as an area for those happy to be photographed and another for those who are not. Use colour-coded name badges or lanyards to indicate who has consented. Collect consent at registration and combine it with visual markers on the day.

Sources:

  • The Danish Data Protection Agency’s Guidance on consent, May 2021
  • General Data Protection Regulation (GDPR), Article 4(11) and Article 7

Last updated: