When do you need consent for photos and video?

PhotoConsent is the tool for content creators

When you use photos or video of recognisable people, you are generally processing personal data. You therefore need a lawful basis. This may be consent, but in some situations it may be a specific balancing of interests.

What matters is not only whether the photo was taken in a public setting. It also matters whether the person can be identified, the intended use and context, and whether the person could reasonably feel exposed, exploited or offended.

The Danish Data Protection Agency has changed its practice so that the distinction between situational images and portraits is no longer sufficient on its own. Instead, the image and the purpose of publication must be assessed as a whole.

For municipalities, educational institutions and other organisations, the question is therefore rarely “Is this a situational image or a portrait?” A better question is:

Can we document why we may use the image, what the person was told and how we handle an objection or withdrawal afterwards?

We make collecting consent easy

With PhotoConsent, a consent form is always at hand and you can quickly obtain agreement from the people you photograph. PhotoConsent replaces paper consents with automatic, secure archiving.

Short answer: When do you need consent for photos and video?

As a starting point, collect consent when a photo or video is used for marketing, campaigns, social media, recruitment, employer branding, customer stories, websites, newsletters or other purposes in which the person becomes a visible part of your organisation’s communications.

Consent is particularly important when:

• The person is clearly recognisable.
• The image is used externally, for example on a website, LinkedIn, Instagram, Facebook or in advertising.
• The image is used for marketing or recruitment.
• It features children, young people, citizens, pupils, students, patients or others requiring particular care.
• The image may reveal sensitive or private matters.
• The context may make the person feel exposed or cast in a particular role.

In some situations, you can publish images without consent if you have a legitimate interest that outweighs the person’s rights and interests. This requires a specific assessment. PhotoConsent’s guide likewise explains that organisations need a lawful basis, typically consent or a balancing of interests.

Some of our customers

←→

When are photos and video personal data?

Photos and video are personal data when a person can be identified directly or indirectly. This is not limited to traditional portraits. Clothing, context, workplace, school, event, location, a name in a caption or other characteristics may identify someone.

An atmosphere shot from an event may therefore be personal data if participants can be recognised. The comprehensive GDPR guide highlights that identifiability, not the photographer’s intention, is decisive.

Consent or a balancing of interests?

There is no single rule requiring consent for every image. However, there must always be a lawful basis.

Consent is often the right choice when images are actively used in communications

Consent is particularly relevant when a person is highlighted, an image is used for marketing or material will be used across channels over an extended period.

Valid consent must be freely given, informed, active, documented and withdrawable. The person must know who uses the image, for which purposes, on which channels, for how long and how to withdraw consent.

A balancing of interests may apply in some situations

This may be relevant where the image is harmless, the purpose is justified and the person’s rights do not outweigh the organisation’s interest in using it.

For example, this might be a wide shot of an open event where no particular individual is highlighted and the image is used in a neutral context.

The more an image is used for marketing, recruitment, campaigns or branding, however, the stronger the need for consent becomes.

• Make GDPR compliance easier

  With PhotoConsent, consent records are always at hand, helping you comply with the rules.
• Make better use of your time

  PhotoConsent removes cumbersome paperwork and makes producing marketing content easier.
• Benefit from Danish security

  PhotoConsent is a Danish solution with servers and hosting in Denmark to protect your data.

Do situational images require consent?

Not always. But a lawful basis is always required.

The distinction between situational images and portraits used to receive much attention. Today, that distinction is not enough. The Danish Data Protection Agency emphasises an overall assessment of the image and the purpose of publication.

A situational image may be used without consent if it is harmless, natural to the situation and does not expose anyone. But where it is used for marketing, depicts children, highlights particular people or appears in a sensitive context, consent should generally be collected.

Do you need consent for photos on social media?

Often, yes.

Social media makes photos highly visible, easy to share and hard to control afterwards. Organisations should therefore be particularly careful with recognisable people’s images on social media.

If an image is used on LinkedIn, Facebook, Instagram, TikTok or YouTube as part of communications, branding, recruitment or marketing, consent is typically the safest basis.

This is particularly relevant for citizens, pupils, students, employees, children or others who cannot naturally be expected to appear in external communications.

Do you need consent for video?

Video often requires even more care than photography.

A video shows more than a person’s appearance. It can reveal their voice, behaviour, relationships, location, emotional reactions and context, making it more intrusive than a single photo.

As a starting point, consent should be collected when a person actively appears in a video for campaigns, social media, customer stories, websites, recruitment or marketing.

For larger productions, consider whether a model agreement is more appropriate than ordinary consent. PhotoConsent’s guide notes that consent can be withdrawn, whereas a model agreement can provide a more binding framework for some productions.

Do you need consent for photos of children?

Yes, in many cases you should obtain consent from a parent or guardian when using children’s photos in your organisation’s communications.

Children receive particular protection under GDPR because they cannot always understand the consequences of images being published and shared. The comprehensive guide states that children under 15 cannot give their own consent and that a parent or guardian must therefore provide it.

This is particularly important for websites, social media, campaigns, printed materials, press, recruitment and marketing.

Even with parental consent, consider the child’s own experience. An image may be lawful to use but still inappropriate if it could later make the child feel exposed.

Do you need consent for employee photos?

Often, yes, especially for marketing, recruitment or social media.

In a specific case, the Danish Data Protection Agency stated that using images of former or current employees for marketing generally requires their consent.

The balance of power between employer and employee must also be considered. Employee consent must still be freely given. It should therefore not be hidden in an employment contract, but obtained specifically for the intended use of the photo or video.

Is verbal consent enough?

Verbal consent can be valid in some cases. In practice, however, it is often a poor solution because it is difficult to document afterwards.

If the person later asks questions, complains or withdraws consent, you must be able to document what was agreed, when, by whom and what information was provided.

PhotoConsent’s guide also explains that verbal consent may be quick but almost impossible to document during an inspection.

Organisations, municipalities and educational institutions should therefore use a documented process that allows consent records to be retrieved.

Is opt-out consent valid?

No. Opt-out consent is not valid consent.

A sign saying “We are taking photos; let us know if you do not want to be included” can provide information, but it is not active consent.

Valid consent requires an active action. Silence, passivity or a failure to object is not enough. PhotoConsent’s guide highlights that opt-out consent is not valid under GDPR because silence or passive behaviour cannot be equated with an active yes.

How do I get consent to use photos?

When consent is your legal basis, the person must understand how the photos will be used and actively agree. Explain the purposes and channels, provide a genuine free choice, and explain how consent can be withdrawn. Keep evidence of the agreement, the date and the information shown to the person.

With PhotoConsent, you can share a consent form through a link or QR code and keep the documentation in one place.

How do I get consent for marketing?

If you collect consent to use a person’s photos or video in marketing, make the specific use clear. Describe the purposes, channels and planned period of use. Allow separate choices for different purposes where relevant, and retain evidence of consent.

Consent to appear in photos is not the same as consent to receive advertising by email or SMS. Electronic marketing is subject to separate rules.

What should consent for photos and video include?

Consent should explain at least:

• Controller: Who is responsible for the data.
• Purpose: What the photo or video will be used for.
• Channels: Which channels the material may be used on.
• Duration: How long the material may be used.
• Withdrawal: How the person can withdraw consent.
• Contact: How the person can contact you.
• Rights: What rights the person has.
• Documentation: How consent is documented and stored.

A signature alone is not enough. The person must understand what they are agreeing to.

What must you be able to document?

You must be able to demonstrate that consent was properly given. You should therefore be able to answer:

• Person: Who gave consent?
• Time: When was it given?
• Scope: What was consent given for?
• Use: Which channels and purposes were covered?
• Information: What wording was the person shown?
• Status: Is consent still active?
• Withdrawal: Has consent been withdrawn?
• Material: Which photos or videos are linked to the consent?

This is where many manual processes become vulnerable. Your own value propositions describe how municipalities and educational institutions often struggle with paper, email, spreadsheets, inconsistent processes and consent without an audit trail.

Why is consent management difficult in practice?

For many organisations, the problem is not just the law. It is everyday work.

Photos are taken for events, campaigns, social media, graduations, open days, public meetings, teaching, projects and recruitment. Consent is collected on paper, in emails, spreadsheets or verbally. When an image is needed again six months later, nobody can quickly see what was actually permitted.

This creates three problems:

• Uncertainty: The organisation is unsure whether it may use the image.
• Wasted time: The communications team spends unnecessary time searching for records.
• Lost stories: Good stories may be dropped because the process feels too cumbersome and risky.

PhotoConsent is positioned to address this through digital consent management, automatic archiving, audit trails, access management and a central searchable consent database.

Practical test:
Do you need to collect consent?

How to create a secure process for photos and video

A secure process is not just about collecting consent. It covers the entire lifecycle of an image.

Start during planning. Decide how material will be used, who will participate, which channels are relevant and how long it will be used.

Collect consent in a way that is easy for the person and easy for your organisation to document.

Store consent centrally rather than scattered across emails, folders, paper forms and local drives.

Link consent to the relevant photos or videos so the documentation can be found later.

Create a clear withdrawal process so you can respond quickly when someone no longer wishes to participate.

PhotoConsent’s guide also recommends a consistent workflow, clear responsibilities, digital documentation, a deletion policy and a withdrawal process.

FAQ

When do you need consent for photos?

You need consent when an image shows a recognisable person and the use requires their clear agreement. This is particularly relevant for marketing, social media, campaigns, recruitment, customer stories and images of children or others needing special protection.

When may images be used without consent?

Only where you have another lawful basis, such as legitimate interests, and the person’s rights do not override it. This always requires a specific assessment of the image, purpose and context.

Do you need consent for photos on Facebook and Instagram?

Often, yes, when an organisation, municipality, school or business uses images for communications, marketing or branding. Social media makes images highly visible and easy to share, so consent is often the safest basis.

Do you need consent for video?

Yes. As a starting point, collect consent when recognisable people appear in videos for marketing, campaigns, social media, websites, recruitment or customer stories. Video can be more intrusive than photography because it reveals the person, voice, behaviour and context.

Is verbal consent valid?

Verbal consent can be valid, but is difficult to document and therefore risky in practice. Your organisation should be able to prove what the person agreed to, when and what information they received.

Is opt-out consent enough?

No. Opt-out consent is not valid consent. Wording such as “let us know if you do not want to be photographed” is insufficient because consent requires an active action.

Do you need consent for photos of children?

Yes, in many cases. For children under 15, a parent or guardian must give consent. Children receive special protection, and images of children should always be assessed particularly carefully.

Do you need consent for employee photos?

Often, yes, especially for marketing, social media or recruitment. Employee consent needs particular attention because of the power imbalance between employer and employee.

What should consent for photos and video contain?

It should explain who uses the material, its purpose, where it will be published, for how long and how consent can be withdrawn. It must also be documented afterwards.

How long may images be retained with consent?

Images may only be kept while there is a valid purpose. Maintain a defined deletion policy and regularly assess whether the purpose still applies. You must be able to respond quickly if consent expires or is withdrawn.

Want to make consent for photos and video easier to manage?
Book an advisory meeting for a specific review of your current process.

Find further information on the Danish Data Protection Agency’s website

Last updated: 1 September 2026