3 cross-border consent problems when US creators work with EU platforms

What to take away

Three cross-border consent problems US creators hit with EU platforms

A US creator uploads a photo to an EU-hosted platform. The image is copied, reposted and used in ads. The creator wants it gone. Three legal problems appear at once.

First, the creator's consent may not travel. A release signed under California law may not satisfy GDPR. The EU regime asks for a lawful basis before processing, not just a signature.

Second, the platform's terms may name the creator as the data controller. That means the creator, not the platform, must answer access and erasure requests from people in the image.

Third, US and EU rules point in different directions. A US platform may remove content under the DMCA, while an EU platform may keep it under a different notice regime.

These problems are common because the same image crosses borders in seconds. The sections below take each regime in turn.

Why the same image can have three legal homes

An image has a copyright owner, a subject and a host. Each may sit in a different country. The EU platform applies GDPR to the subject and the creator if they are in the EU, or if the platform targets EU users.

Canadian PIPEDA applies to commercial activity with a Canadian link. US state law applies where the subject lives or where the harm occurs.

No single contract resolves all three. A creator needs a consent record that names the regimes and the lawful basis for each.

Controller or processor: who answers requests

Under GDPR, the platform can be a controller or a processor. If it is a processor, the creator is the controller and must have a lawful basis for the upload. If the platform is a controller, it may rely on its own basis, such as legitimate interests.

Read the terms before you upload. A platform image rights guide explains how upload licenses, reposting and deletion work on major hosts.

Three duties, one file

A US creator should assume three duties: a GDPR basis, a PIPEDA consent record and a US state law check. Keep them in one file. If a subject asks for deletion, the creator may need to act as controller and forward the request to the platform.

GDPR lawful basis when a US creator's images are hosted in the EU

GDPR does not start with consent. It starts with a lawful basis. Article 6(1)(a) to (f) lists six: consent, contract, legal obligation, vital interests, public task and legitimate interests. Article 7 adds the conditions for consent.

For creator images, three bases matter most: consent, contract and legitimate interests. Each has different duties and different exit rights.

Consent as a GDPR lawful basis

People must give their permission willingly, clearly, knowingly, and without any doubt. A blanket release that covers all future uses is weak. A pre-ticked box is not consent.

Article 7 requires the controller to demonstrate that the subject consented. It also gives the subject the right to withdraw at any time.

The creator must be able to prove consent. A dated record with the exact wording and the purposes is the standard.

Contract as a GDPR lawful basis

If the image is needed to perform a contract with the subject, contract can be the basis. This is Article 6(1)(b). A paid model shoot with a signed license may fit.

Contract does not cover uses beyond the deal. Using the image for a new ad campaign is a new purpose and needs a new basis.

Legitimate interests as a GDPR lawful basis

Legitimate interests can cover editorial, artistic or security uses. This is Article 6(1)(f). The creator must balance their interest against the subject's rights.

A subject with a reasonable objection can override the balance. Document the balancing test if you rely on this basis.

A legitimate legal basis compared explains how consent, contract and legitimate interests differ in practice.

What US creators often get wrong

Many US creators treat a model release as global consent. Under GDPR, a release is evidence of consent at best. It does not create a lawful basis by itself.

Others assume the EU platform handles everything. If the creator is the controller, that assumption fails.

A worked example

A Texas photographer shoots a model in Austin. The model signs a release for portfolio use. The photographer uploads to an EU portfolio platform. The platform shows the image to EU users.

GDPR applies because the platform targets the EU. The release covers portfolio use, so consent is the basis for that purpose. If the photographer later sells the image to an EU ad agency, that is a new purpose and needs a new basis or new consent.

Canadian PIPEDA consent and access rules for reused images

PIPEDA applies to private-sector organizations that collect, use or disclose personal information in commercial activity. A photo of an identifiable person is personal information. Principle 1 makes the organization accountable for that information.

If a US creator's image is hosted or reused by a Canadian business, PIPEDA consent rules apply. Consent must be meaningful and based on clear information.

What PIPEDA consent requires

PIPEDA allows express or implied consent depending on sensitivity. Images can be sensitive, so express consent is safer. Principle 3 and Principle 4.3 set the consent standard.

The organization must state the purpose before or at collection. It must not use the image for a new purpose without new consent.

Access and correction rights

A person can ask a Canadian organization for access to their personal information, including images. Principle 4.9 requires the organization to respond within 30 days, with limited extensions.

A creator who acts as the organization must keep records. A platform that hosts the image may also have duties.

Withdrawal under PIPEDA

A person can withdraw consent, subject to legal and contractual limits. Principle 4.3.8 states that right. The organization must then stop using the image and explain the consequences.

Withdrawal is not always retroactive. Published copies may remain, which is why retention terms matter. Principle 4.5 limits retention to the time needed for the purpose.

Where PIPEDA and GDPR overlap

Both regimes require a purpose, a record and a way to withdraw. Both give access rights. A single consent record can serve both if it names both regimes.

A child image consent compared review should cover copyright, privacy, publicity, contract and confidentiality together.

Where US state law still applies to an EU-hosted repost

An EU host does not switch off US law. If the subject lives in California, New York, Texas or Florida, state rules can apply. Washington, Illinois, Georgia and Nevada have their own statutes too.

Right of publicity states

California Civil Code Section 3344 protects name, voice, signature, photograph and likeness for commercial use. A successful claim can recover at least $750 in statutory damages, plus profits and attorney fees. New York has a similar right under its civil rights law.

Texas, Florida, Illinois, Georgia and Nevada also recognize a right of publicity. A repost used in ads can trigger it even if the server is in the EU.

Biometric and health privacy statutes

Illinois BIPA, 740 ILCS 14, covers biometric identifiers, including face geometry. It allows $1,000 per negligent violation and $5,000 per reckless or intentional violation, plus attorney fees. Washington's My Health My Data Act covers health data, which can include images.

These statutes have their own consent rules and private rights of action. They can apply to an EU-hosted image if the subject is in those states.

Platform immunity and takedown

Section 230 of the Communications Decency Act shields platforms from many user-content claims. It does not shield the creator who uploaded the image.

DMCA takedown applies to copyright, not to privacy or publicity. A creator may need both a takedown and a state law claim.

The U.S. Code table of contents is the starting point for citing Section 230 and DMCA provisions.

Attorneys general and reporting routes

The National Association of Attorneys General runs an image-based abuse working group. State attorneys general can act on patterns of abuse.

NCMEC takes reports involving minors. The FTC Endorsement Guides and .com Disclosures apply when an image is used in advertising.

Transfers, processors and platform terms that shift consent duties

An EU platform may store the image outside the EU. That is a transfer, and GDPR Chapter V governs it. Articles 44 to 49 set the rules for transfers.

A transfer needs a legal mechanism, such as an adequacy decision or standard contractual clauses. The platform usually handles this, but the creator should know who is responsible.

Controller and processor roles

If the creator is the controller, the platform is often the processor. The processor acts on the controller's instructions.

A processor agreement must cover purpose, security, sub-processors and deletion. Without it, the creator carries the risk.

What platform terms often say

Instagram's Terms of Use grant a "non-exclusive, royalty-free, transferable, sub-licensable, worldwide" license to your content. Meta Platforms Ireland Limited is the controller for users in the EEA under Meta's Privacy Policy. Meta states that transfers rely on the European Commission's Standard Contractual Clauses and the EU-U.S. Data Privacy Framework.

TikTok's Terms of Service grant a similar license. TikTok Technology Limited is the controller for the EEA. TikTok's privacy policy lists Standard Contractual Clauses and the EU-U.S. Data Privacy Framework as transfer mechanisms.

Both platforms name the user as responsible for third-party rights in uploaded content. Read these clauses before you upload, and use a checklist to review platform terms before upload.

Data transfer consent

Consent to a transfer must be informed. The subject should know the destination country and the risks. Articles 44 to 49 apply when the platform moves data outside the EU.

If the platform relies on standard contractual clauses, the creator does not need separate consent for the transfer. But the creator still needs a basis for the processing.

Processor terms to demand

Choosing a lawful basis: consent, contract or legitimate interest

There is no default basis. The creator must choose one for each purpose and record the choice.

How to pick

The tests for each basis are set out in the GDPR section above. Apply them to every purpose you list.

Copyright Office international issues and cross-border notice routes

Copyright and consent are different rights. A copyright notice does not fix a privacy or publicity problem.

The Copyright Office international issues page covers cross-border copyright questions and links to foreign law resources.

The LII world law index helps compare EU platform rules and cross-border consent duties. The uniform laws index covers model privacy and consent frameworks.

Wex legal definitions explain consent terms across regimes, which helps when a contract uses words like release, license and permission.

Notice routes by problem

Registration and agents

The Copyright Office registration and DMCA agent directory help identify the right agent for a takedown. Registering your images makes takedowns easier.

An international copyright notice should name the work, the owner and the infringing URL. Keep copies of every notice.

Consent online: a cross-border consent record template

A consent record is the document that proves your basis. It should work in the US, the EU and Canada.

Use an image consent guide to set purpose, capture, editing, reuse and records.

A filled consent record

How to use it

Fixes for the usual failures

Missing transfer terms, vague purposes and no withdrawal route are the usual failures. Each one weakens the basis.

A missing withdrawal route is easy to fix: state a contact and a response time. GDPR erasure requests must be answered within one month under Article 12(3). PIPEDA access requests must be answered within 30 days under Principle 4.9. Illinois BIPA allows $1,000 per negligent violation and $5,000 per reckless violation under 740 ILCS 14/20.

Common questions