3 cross-border consent problems when US creators work with EU platforms

What to take away

Consent online is not one rule: a US creator's image can be governed by GDPR in the EU, PIPEDA in Canada and state law at home at the same time.
GDPR requires a lawful basis for every processing of a creator's image, and consent is only one option.
Canadian PIPEDA consent rules give people a right to access and correct images a platform holds.
US state law still applies to an EU-hosted repost, including right of publicity and biometric privacy statutes.
Platform terms often make the creator the controller and the platform the processor, which shifts consent duties onto the creator.
A written consent record with purpose, scope, withdrawal and transfer terms is the practical defense.

Three cross-border consent problems US creators hit with EU platforms

A US creator uploads a photo to an EU-hosted platform. The image is copied, reposted and used in ads. The creator wants it gone. Three legal problems appear at once.

First, the creator's consent may not travel. A release signed under California law may not satisfy GDPR. The EU regime asks for a lawful basis before processing, not just a signature.

Second, the platform's terms may name the creator as the data controller. That means the creator, not the platform, must answer access and erasure requests from people in the image.

Third, US and EU rules point in different directions. A US platform may remove content under the DMCA, while an EU platform may keep it under a different notice regime.

These problems are common because the same image crosses borders in seconds. The sections below take each regime in turn.

Why the same image can have three legal homes

An image has a copyright owner, a subject and a host. Each may sit in a different country. The EU platform applies GDPR to the subject and the creator if they are in the EU, or if the platform targets EU users.

Canadian PIPEDA applies to commercial activity with a Canadian link. US state law applies where the subject lives or where the harm occurs.

No single contract resolves all three. A creator needs a consent record that names the regimes and the lawful basis for each.

What the platform's role does to your consent

Under GDPR, the platform can be a controller or a processor. If it is a processor, the creator is the controller and must have a lawful basis for the upload.

If the platform is a controller, it may rely on its own basis, such as legitimate interests. The creator's release then governs only the creator's own use.

Read the terms before you upload. A platform image rights guide explains how upload licenses, reposting and deletion work on major hosts.

The practical result for a US creator

Assume three duties: a GDPR basis, a PIPEDA consent record and a US state law check. Keep them in one file.

If a subject asks for deletion, the creator may need to act as controller and forward the request to the platform. If the platform refuses, the creator can still be liable under state law.

GDPR lawful basis when a US creator's images are hosted in the EU

GDPR does not start with consent. It starts with a lawful basis. Article 6 lists six: consent, contract, legal obligation, vital interests, public task and legitimate interests.

For creator images, three bases matter most: consent, contract and legitimate interests. Each has different duties and different exit rights.

Consent as a GDPR lawful basis

People must give their permission willingly, clearly, knowingly, and without any doubt. A blanket release that covers all future uses is weak. A pre-ticked box is not consent.

The subject can withdraw consent at any time. After withdrawal, the creator must stop the processing unless another basis applies.

The creator must be able to prove consent. A dated record with the exact wording and the purposes is the standard.

Contract as a GDPR lawful basis

If the image is needed to perform a contract with the subject, contract can be the basis. A paid model shoot with a signed license may fit.

Contract does not cover uses beyond the deal. Using the image for a new ad campaign is a new purpose and needs a new basis.

Legitimate interests as a GDPR lawful basis

Legitimate interests can cover editorial, artistic or security uses. The creator must balance their interest against the subject's rights.

A subject with a reasonable objection can override the balance. Document the balancing test if you rely on this basis.

A legitimate legal basis compared explains how consent, contract and legitimate interests differ in practice.

What US creators often get wrong

Many US creators treat a model release as global consent. Under GDPR, a release is evidence of consent at best. It does not create a lawful basis by itself.

Others assume the EU platform handles everything. If the creator is the controller, that assumption fails.

A worked example

A Texas photographer shoots a model in Austin. The model signs a release for portfolio use. The photographer uploads to an EU portfolio platform. The platform shows the image to EU users.

GDPR applies because the platform targets the EU. The release covers portfolio use, so consent is the basis for that purpose. If the photographer later sells the image to an EU ad agency, that is a new purpose and needs a new basis or new consent.

Canadian PIPEDA consent and access rules for reused images

PIPEDA applies to private-sector organizations that collect, use or disclose personal information in commercial activity. A photo of an identifiable person is personal information.

If a US creator's image is hosted or reused by a Canadian business, PIPEDA consent rules apply. Consent must be meaningful and based on clear information.

What PIPEDA consent requires

PIPEDA allows express or implied consent depending on sensitivity. Images can be sensitive, so express consent is safer.

The organization must state the purpose before or at collection. It must not use the image for a new purpose without new consent.

Access and correction rights

A person can ask a Canadian organization for access to their personal information, including images. The organization must respond and correct errors.

A creator who acts as the organization must keep records. A platform that hosts the image may also have duties.

Withdrawal under PIPEDA

A person can withdraw consent, subject to legal and contractual limits. The organization must then stop using the image and explain the consequences.

Withdrawal is not always retroactive. Published copies may remain, which is why retention terms matter.

Where PIPEDA and GDPR overlap

Both regimes require a purpose, a record and a way to withdraw. Both give access rights. A single consent record can serve both if it names both regimes.

A child image consent compared review should cover copyright, privacy, publicity, contract and confidentiality together.

Where US state law still applies to an EU-hosted repost

An EU host does not switch off US law. If the subject lives in California, New York, Texas or Florida, state rules can apply. Washington, Illinois, Georgia and Nevada have their own statutes too.

Right of publicity states

California Civil Code Section 3344 protects name, voice, signature, photograph and likeness for commercial use. New York has a similar right under its civil rights law.

Texas, Florida, Illinois, Georgia and Nevada also recognize a right of publicity. A repost used in ads can trigger it even if the server is in the EU.

Biometric and health privacy statutes

Illinois BIPA covers biometric identifiers, including face geometry. Washington's My Health My Data Act covers health data, which can include images.

These statutes have their own consent rules and private rights of action. They can apply to an EU-hosted image if the subject is in those states.

Platform immunity and takedown

Section 230 of the Communications Decency Act shields platforms from many user-content claims. It does not shield the creator who uploaded the image.

DMCA takedown applies to copyright, not to privacy or publicity. A creator may need both a takedown and a state law claim.

The U.S. Code table of contents is the starting point for citing Section 230 and DMCA provisions.

Attorneys general and reporting routes

The National Association of Attorneys General runs an image-based abuse working group. State attorneys general can act on patterns of abuse.

NCMEC takes reports involving minors. The FTC Endorsement Guides and .com Disclosures apply when an image is used in advertising.

Transfers, processors and platform terms that shift consent duties

An EU platform may store the image outside the EU. That is a transfer, and GDPR Chapter V governs it.

A transfer needs a legal mechanism, such as an adequacy decision or standard contractual clauses. The platform usually handles this, but the creator should know who is responsible.

Controller and processor roles

If the creator is the controller, the platform is often the processor. The processor acts on the controller's instructions.

A processor agreement must cover purpose, security, sub-processors and deletion. Without it, the creator carries the risk.

What platform terms often say

Many platforms claim a broad license to use and sublicense images. Some name the creator as controller for subject requests.

Others disclaim responsibility for third-party reposts. Read these clauses before you upload, and use a checklist to review platform terms before upload.

Data transfer consent

Consent to a transfer must be informed. The subject should know the destination country and the risks.

If the platform relies on standard contractual clauses, the creator does not need separate consent for the transfer. But the creator still needs a basis for the processing.

Processor terms to demand

Named purposes for the image
Deletion timeline after withdrawal
Sub-processor list and notice of changes
Security measures for storage and transfer
Contact for subject access requests
Governing law and dispute forum
Audit or report rights

Choosing a lawful basis: consent, contract or legitimate interest

There is no default basis. The creator must choose one for each purpose and record the choice.

Basis	Best for	Subject right	Record needed
Consent	Marketing, portfolio, broad reuse	Withdraw anytime	Signed or logged consent
Contract	Paid shoots, licensed deliverables	Limited to the deal	Contract and scope
Legitimate interests	Editorial, artistic, security	Object and erasure	Balancing test

How to pick

List every purpose for the image.
Match each purpose to one basis.
Check that the basis fits the subject's expectations.
Record the basis and the date.
Review when the purpose changes.

When consent is the wrong basis

Consent is weak if the subject has no real choice, such as an employee or a client. Contract or legitimate interests may fit better.

Consent is also weak for open-ended future uses. A specific license is stronger.

When legitimate interests is the wrong basis

Legitimate interests fails if the subject's rights outweigh the creator's interest. Sensitive images, minors and health data usually tip the balance.

If in doubt, get consent.

Copyright Office international issues and cross-border notice routes

The Copyright Office international issues page covers cross-border copyright questions and links to foreign law resources.

The LII world law index helps compare EU platform rules and cross-border consent duties. The uniform laws index covers model privacy and consent frameworks.

Wex legal definitions explain consent terms across regimes, which helps when a contract uses words like release, license and permission.

Notice routes by problem

Copyright: DMCA notice to the host or platform.
Privacy or publicity: direct demand to the creator and the platform.
Data protection: erasure request to the controller.
Image-based abuse: platform report and, for minors, NCMEC.
Advertising misuse: FTC or state attorney general complaint.

Registration and agents

The Copyright Office registration and DMCA agent directory help identify the right agent for a takedown. Registering your images makes takedowns easier.

An international copyright notice should name the work, the owner and the infringing URL. Keep copies of every notice.

Consent online: a cross-border consent record template

A consent record is the document that proves your basis. It should work in the US, the EU and Canada.

Use an image consent guide to set purpose, capture, editing, reuse and records.

What the record must contain

Subject name and contact
Image or shoot identifier
Purposes, listed one by one
Lawful basis for each purpose
Countries where the image will be hosted
Transfer mechanism if outside the EU
Withdrawal method and effect
Retention period and deletion date
Controller and processor names
Signatures and date

How to use it

Fill it before the shoot or upload.
Give the subject a copy.
Store it where you can find it within one day.
Update it when a purpose changes.
Log every access or erasure request.
Delete the image when the retention period ends.

Common gaps

Missing transfer terms, vague purposes and no withdrawal route are the usual failures. Each one weakens the basis.

A record that names GDPR, PIPEDA and the relevant state law is stronger than a generic release.

Common questions

Does GDPR apply to a US creator with no EU office? Yes, if the platform targets EU users or the creator offers goods or services to people in the EU. The creator can be the controller.

Is a US model release enough for GDPR? It is evidence of consent, not a lawful basis by itself. The release must be specific, informed and withdrawable.

Can I rely on legitimate interests for portfolio use? Sometimes, if the image is not sensitive and the subject has no strong objection. Document the balancing test.

What does PIPEDA require for a reposted image? A stated purpose, meaningful consent, access and correction rights, and a way to withdraw.

Does Section 230 protect me from a publicity claim? It protects platforms for user content in many cases. It does not protect the creator who uploaded the image.

Where do I send a takedown for an EU-hosted repost? Send a copyright notice to the host and a data protection request to the controller. Use the platform's report route for abuse.