Image rights guide: copyright, privacy, publicity, contract, confidentiality, data protection

What to take away

One photograph can involve several people and several rights. The photographer may own the image copyright, the subject may hold privacy or publicity interests, an agency may have a license, and a brand may have a narrow release. None of those facts automatically answers the others. This guide provides issue spotting, not legal advice.

Start with the actors and conduct

List the creator, depicted people, client, employer, agency, publisher, platform, and current claimant. Then describe the challenged conduct: capture, access, copying, editing, captioning, sale, advertisement, disclosure, training, or reposting. Rights attach to specific acts and parties.

Copyright

Copyright can protect original photographic expression. Initial ownership often belongs to the photographer, subject to employment, work-made-for-hire, joint-authorship, and transfer rules. Owning a print or being pictured does not itself transfer copyright.

In the US the governing law is the Copyright Act, Title 17 of the U.S. Code. Under 17 U.S.C. § 201(a), copyright in a work vests initially in the author or authors of the work; under § 201(b), in the case of a work made for hire the employer or other person for whom the work was prepared is considered the author. Section 106 gives the owner the exclusive rights to reproduce the work and to prepare derivative works based on it, which is why reposting or editing someone else's photograph is a copyright question first.

A license can authorize only specified rights, channels, territories, or dates. Copyright exceptions and limitations vary. Registration may affect remedies and procedure even when protection began earlier. The U.S. Copyright Office puts it plainly: registration is in general voluntary, and copyright exists from the moment the work is created, but you will have to register if you wish to bring a lawsuit for infringement of a U.S. work.

The fastest copyright route for an image posted without permission is a takedown notice under section 512 of Title 17, the DMCA notice-and-takedown system. Once an online service provider has received a compliant notice, it must act expeditiously to remove or disable access to the infringing material. The notice goes to the platform's designated agent: the U.S. Copyright Office keeps a DMCA Designated Agent Directory, a centralized online directory of the agents service providers designate to receive notifications of claimed infringement, and a takedown notice is legally effective only when it reaches that agent in writing. The notice must be signed by the copyright owner or an authorized agent, so a person who is only pictured, and does not own the copyright, usually needs a privacy, policy or intimate-image route instead.

Privacy and data protection

Privacy is not one global claim. It can include intrusion, public disclosure of private facts, false light in some U.S. jurisdictions, confidentiality, or constitutional and statutory protections. Location, expectation, newsworthiness, public interest, and sensitivity can matter. In US tort law, the Restatement (Second) of Torts recognizes four types of invasion of privacy: intrusion, appropriation of name or likeness, unreasonable publicity, and false light.

For intimate images shared without consent, federal law adds a specific claim: under 15 U.S.C. § 6851, an individual whose intimate visual depiction is disclosed without consent, by a person who knows or recklessly disregards that there was no consent, may bring a civil action against that person in federal district court. Most states also have their own non-consensual intimate image laws.

Data-protection systems ask whether an identifiable person's information is processed under a valid basis with transparency, purpose limits, minimization, security, retention, and rights. A photograph is not automatically biometric data merely because a face appears; technical use for recognition can change the analysis. In the EU, the General Data Protection Regulation applies to personal data, which the European Commission describes as any information that relates to an identified or identifiable living individual, so a photo of a recognizable person posted by an organization is usually personal data.

In the United States there is no single federal equivalent, and state laws fill the gap. California's Consumer Privacy Act, explained by the state Attorney General's CCPA guidance for consumers, gives California residents the right to know what personal information a business collects about them and how it is used and shared, the right to delete personal information collected from them, with some exceptions, and the right to opt out of the sale or sharing of their personal information. A deletion request reaches the personal information a business collected from you, and the business must also tell its service providers to delete it, subject to exceptions such as a legal duty to keep the information.

Publicity and commercial identity

Publicity law can protect a person's name, likeness, voice, signature, or other recognizable identity from unauthorized commercial exploitation. Cornell's Legal Information Institute explains that U.S. publicity rights are largely state-based and unevenly recognized. The same overview notes that only about half the states have distinctly recognized a right of publicity, that many protect it as part of the right of privacy, and that the federal Lanham Act, § 1125, can also provide protection where a person's identity is used to falsely advertise a product. California is a common example of a statutory right: its right of publicity for living persons is codified in section 3344 of the California Civil Code. That overview does not decide whether a particular editorial, expressive, advertising, or cross-border use is actionable.

Do not label every unwanted image a publicity violation. Identify the commercial message, identity cue, jurisdiction, consent, and applicable exceptions or speech protections.

Contract and confidentiality

Contracts can allocate capture, ownership, license, approval, payment, credit, disclosure, retention, and termination. A release may waive or authorize defined claims without transferring copyright. An agency cannot grant more authority than it holds.

Confidentiality may arise from an agreement, professional duty, employment relationship, or law. Marking a file "confidential" is evidence of an expectation, not automatic proof of an enforceable obligation against every recipient.

Defamation and false context

An authentic image can be paired with a false caption or arranged to imply a false factual association. Defamation rules vary, including fault standards, public-figure treatment, opinion, truth, privilege, harm, and deadlines. False light is not recognized everywhere.

Correct verified errors promptly without admitting a legal conclusion that has not been reviewed. Preserve the original publication and correction record.

Platform rules

A service may ban impersonation, privacy invasion, harassment, or unauthorized intimate imagery beyond what a court would order. Its upload license may permit technical operation without granting users rights in third-party material. Policy removal does not prove legal liability, and legal ownership does not guarantee policy removal.

Common questions

Does the subject own a portrait?

The subject may own a copy or have personal rights, but the photographer or another author may own copyright. Contracts and law can change that result.

Does a model release transfer copyright?

Not unless its valid terms do so. Many releases address likeness use rather than ownership of the photograph.

Is every commercial website use an endorsement?

No. Placement, message, identity use, audience understanding, consent, jurisdiction, and exceptions need review.

Which claim should a report name?

Name only the issue the claimant can support with facts and authority. Several separate routes may apply, but they should not be blended carelessly.