Posting customer photos without consent

Key takeaways

Posting customer photos without consent risks complaints, lost trust and, because photos of identifiable people are personal data, breaches of UK GDPR. Ask before posting, record the answer, take extra care with children and anything sensitive, and remove photos promptly when asked. A simple consent line at booking or on the day covers most cases.

• Photos of identifiable people are personal data.
• Ask and record consent before posting.
• Children need parental consent; health contexts need extra care.
• Remove photos promptly if someone asks.

When do you need consent to post a customer photo?

You should get permission whenever a customer can be identified, such as their face, name or home. Consent is the clearest lawful basis for marketing photos. Crowd shots at a public event where nobody is the focus are lower risk, but a notice at the event is good practice.

• The most common social media marketing mistakes small businesses make
• GDPR and social media marketing in the UK

Which situations need extra care?

Extra care is needed for children, where you need a parent's consent, for anything that reveals health, such as clinic or gym results, and for homes, where an address can be identified. Health information is special category data under UK GDPR and needs a stronger basis.

• Clinic social media mistakes: rules and trust

How do you record consent simply?

Record consent with a line on your booking form or job sheet, a short form on the day, or a saved message reply. Note what the photo is, where it will be used and the date. Make it as easy to withdraw as to give.

• Ask at booking or on the day.
• Say where photos will be used.
• Keep a record with the date.
• Make withdrawal easy.

What if a customer asks you to remove a photo?

Remove it promptly from your accounts, apologise and confirm. If it was used in ads or printed materials, stop using it. Responding quickly usually ends the matter and keeps the relationship.

• Using other people's photos on business social media

How do you check you have consent for posted photos?

Check by listing every post in the last six months that shows an identifiable customer, and finding the consent record for each. Any photo without a record should be checked with the customer or removed. Take particular care with children, homes and anything health-related.

• Identifiable customers with no consent record.
• Children without parental consent.
• Homes with visible addresses.
• Health-related images.

What does this look like in practice?

A pattern we see: a salon or trades business posting happy-customer photos taken on the day, with no record of consent, until one customer asks why their home is online. A consent line on the booking form and a quick check on the day solves it.

• See client work
• Social Media Marketing for UK businesses

Photo consent checklist

• Ask before posting identifiable people.
• Record consent with a date.
• Get parental consent for children.
• Avoid revealing health details or addresses.
• Remove photos promptly on request.

• GDPR mistakes on social media small firms make
• Fake or edited testimonials on social media: the law

Next step

Add a photo consent line to your booking form or job sheet this week.