Guides
Image consent guide: purpose, people, capture, editing, publication, reuse, withdrawal, retention, and records
Image consent runs as a lifecycle: define the purpose, name who controls the files, and keep withdrawal and records working after publication.
What to take away
- Consent covers one defined use with a start date and an end date. A new use needs a new decision from the person.
- Write the purpose as one testable sentenceorganization, campaign, channels, end date.
- A signed release is one document among several. Publicity, privacy, copyright and employment rules sit on the same image.
- Withdrawal stops covered future use. It does not recall prints, archives or copies held by others.
- Keep one record per person, with a separate retention clock for each file type.
Write the purpose as one testable sentence
"Marketing" decides nothing, because it excludes nothing. A usable purpose names four things.
[Organization] will use [what was captured] for [campaign], on [named channels], until [end date].
Example: "North Street Garden will use the volunteer portraits on the spring recruitment page and two organic social posts until 31 December."
Then split the project into choices a person answers one at a time.
Advantages
- Stills yes, audio no.
- Current publication yes, sponsor licensing no.
Drawbacks
- Website profile yes, paid advertising no.
- Internal training yes, public conference booth no.
Each unticked box is an assumption caught before the camera comes out. The image consent checklist covering people, purpose and boundaries works through the same boxes.
Name the roles and the authority behind each yes
List every role that touches the file before anyone signs.
Name the roles
- The commissioner who sets the purpose
- The photographer who captures
- The producer who holds the schedule
- The editor or retoucher who changes the file
- The publisher who posts it
- The records lead who keeps the file
- Any partner, sponsor or vendor who receives a copy
[figure 2]
Roles that touch the file
- Person depicted
- Photographer and videographer
- Commissioning party
- Editor and publisher
- Platform and archive owner
- Partner receiving a copy
"We" is not a role, and several organizations may each hold a piece of the decision. A workplace portrait for a staff directory does not license a recruiting campaign.
An adult speaks for themself. A guardian, an agent under a mandate and an employee acting under a contract each need separate proof.
For a child, guardian permission, the child's own willingness, safeguarding duties and platform rules are four different questions. Our comparison of guardian permission, child assent and platform age rules sets them out.
Capture, edits and the two edit categories
Describe the recording before it starts. Capture can include:
- Stills, video, audio and screen capture
- Location data and timestamps
- Identifying details in frame, such as uniforms, badges and school logos
- Clothing and artwork
- Bystanders and background faces
Give the setting, the likely duration and a route out before the first frame. Then sort edits by what they do to meaning.
Two edit categories
| Edit | Changes meaning? | Consent line |
|---|---|---|
| Crop, exposure, colour balance | No | Covered by a general edit clause |
| Caption, subtitle or translation | Sometimes | Flag wording and language |
| Background removal or compositing | Yes | Separate permission |
| Beauty retouching or body reshaping | Yes | Separate permission |
| Voice processing or synthetic generation | Yes | Separate permission |
Publication, reuse and the jurisdiction rules
Spell out channels, audience, territory and term. Paid promotion, syndication, partner access, downloads and archival display need their own lines.
Under UK GDPR, the ICO standard for valid consent is freely given, specific, informed and unambiguous, shown by a clear affirmative action. That governs one legal basis in one country, not the whole rulebook.
In the United States, California Civil Code section 3344 covers unauthorized commercial use of a name, voice, signature, photograph or likeness, and other states rely on their own statutes and common-law misappropriation.
In Canada, PIPEDA covers personal information held by commercial organizations, and a photograph of an identifiable person falls inside it.
A release documents permission. It does not erase the other claims. Read how a model release differs from a licence or an assignment before you treat one signature as the whole file.
Example: a portrait that moves channels
A clinic photographs a patient for a staff training slide deck. The signed scope names internal training, one year and no external distribution. Eight months later a vendor asks to feature the portrait at a conference booth.
A portrait that moves channels
| Proposed use | Inside the recorded scope? | Action |
|---|---|---|
| Replay in next year's onboarding | No, term expired | Ask again |
| Internal newsletter | Channel not named | Ask again |
| Vendor conference booth | No | Refuse or renegotiate |
| Archived copy for an audit | Yes, records retention | Keep under the records policy |
Withdrawal, retention and the record fields
Handle a withdrawal as a route, not a promise.
Withdrawal
- Log the request with the date, the person and the asset IDs named.
- Confirm identity without collecting more than you need.
- Freeze the asset in the publishing queue and the asset library.
- Stop covered future use and remove it from channels you control.
- Reply in writing with what was removed, what stays and why.
Do not promise total deletion. Printed copies, lawful archives, third-party copies and litigation holds limit what an organization can remove. Withdrawal stops future processing that relied on consent, and it does not make earlier publication unlawful.
A DMCA notice covers material you own, and a counter-notice under 17 U.S.C. section 512(g) is the route when your own upload was removed by mistake. Copies outside your account sit under the platform image rights for uploads, reposts and embeds.
The periods below are typical ranges, not rules. Set each clock separately.
Retention by file type
| File type | Typical retention | Reason |
|---|---|---|
| Rejects and raw captures | 30 to 90 days after delivery | No ongoing purpose |
| Selects and working files | Project life plus a short window | Rework and dispute cover |
| Published masters | Licence term plus a records period | Proof of what ran |
| Releases and consent records | Often 3 to 7 years after last use | Show which scope applied |
For each person, keep one file with these fields:
Record fields
- Name and contact details
- Who consented and under what authority
- The purpose sentence and its end date
- Channels, audience, territory and paid-use status
- Edit permissions by category
- Capture date, location and asset IDs
- Withdrawal history with dates
[figure 8]
One consent record per person
- Notice and consent wording they saw
- Date, method, language, who took response
- Each separate choice, including refusals
- File or shoot identifiers covered
- Release, license, contract, privacy versions
- Approvals for sensitive edits or changed uses
- Withdrawal, restriction, complaint history
- Publication locations, takedowns, retention, disposition
A model release needs the same spine. Check for:
Release contents
- Named parties and the project
- The images covered
- Permitted purposes and channels
- Territory and term, with an end date
- Editing limits, including generated media
- Payment, credit and approval rights
- A withdrawal route and the treatment of existing copies
Common questions
Does posing for a camera mean someone consented to publication?
No. Posing shows awareness of capture in that moment. It says nothing about the publisher, the audience, the edits, the term or commercial reuse.
Is a signed model release enough to publish or reuse an image?
It is necessary more often than it is sufficient. Wording, jurisdiction, capacity, authority and the actual use all matter, and copyright, privacy, publicity and employment claims can survive a signed release.
How long should images and consent records be kept?
Set a separate clock for each file type. Raw captures and rejected frames usually go within 30 to 90 days, while releases often need to outlast the last public use by three to seven years.
When does reuse need fresh consent?
When the new use falls outside the recorded purpose, channels, audience, territory, term or edit permissions. A similar picture is not the same purpose.
In this guide
- How to plan and document consent for a photo or video projectDocument image consent by scoping the use first, offering separate choices, and keeping a record that ties each person to the files they approved.
- Consent, permission, notice, release, license, contract, and legitimate legal basis comparedConsent, permission, notice, releases, licenses, contracts, and legal bases compared so creators can identify what each instrument does and leaves unresolved.
- Image consent checklist: people, purpose, boundaries, reuse and withdrawalImage consent checklist for creators and publishers, with U.S. legal checks, consent records, reuse controls, and routes to report non-consensual images.
- Image consent problems: vague permission, changed context and indefinite reuseImage consent problems explained, from vague permission and bundled terms to changed context, missed withdrawal, weak records, and unjustified indefinite reuse.
- Planning a fictional community portrait project with layered consent caseA fictional community portrait case shows how layered consent, channel choices, file controls, changed-use review, withdrawal, and retention work in practice.
