Posting photos of employees and customers: consent

When do I need consent?

Anyone recognizable in an image has to agree to its publication (§ 22 KUG, the German Art Copyright Act). Someone who was paid for a photo, such as a model, is presumed to have consented. The exceptions in § 23 KUG rarely apply to advertising on business channels, for example people as incidental accessories next to a location, or participants in assemblies. A portrait of a hair salon customer is not an incidental accessory. The exceptions also don’t apply if a legitimate interest of the person depicted is violated.

On top of that comes the GDPR. A photo of a recognizable person is personal data. In practice, the legal basis is usually consent, and it can be withdrawn at any time (Art. 7 (3) GDPR). How the KUG and the GDPR interact is disputed in the literature. In practice, it is advisable to get a consent that meets both sets of requirements.

Without consent, you risk cease-and-desist claims, deletion and damages, plus GDPR fines.

What applies to employees?

• Voluntary and in writing. Under § 26 (2) BDSG (the Federal Data Protection Act), consent must be voluntary, taking the dependency in an employment relationship into account. It is generally given in writing or electronically. You must inform employees about the purpose and the right to withdraw in text form.
• Separate from the employment contract. On December 11, 2014 (8 AZR 1010/13), the Federal Labor Court (BAG) required employees to consent in writing and independently of the employment contract (report by the law firm CMS).
• No disadvantages for refusing. Anyone who doesn’t want to be in the team photo must not suffer any disadvantage for it.
• After leaving. According to the BAG (February 19, 2015, 8 AZR 1011/13), consent does not expire automatically when the employment ends, at least if the image is not tailored to the person. Whether that applies without restriction under the GDPR is disputed. It is better to take the images down when someone leaves or withdraws consent.

What applies to customers?

Before-and-after photos at the hairdresser, guests in the restaurant, customers on the construction site: get consent and document it, ideally in text form. On site, a short QR form does the job.

• Children and teenagers. For minors, you need the consent of the parents or legal guardians. For teenagers who understand what they are agreeing to, their own consent generally comes on top. This article names no fixed age limit.
• Groups and events. Put up clearly visible notice signs, set up photo-free areas and remove people from images on request.
• Without consent. Show shots without recognizable faces: hands on the workpiece, a shot from behind on the construction site, the finished work.

What belongs in the consent?

The consent fits on one page. These fields belong in it:

• Who is depicted?
• Which images or videos are meant?
• On which channels should they appear: Instagram, Facebook, LinkedIn, TikTok, YouTube, website?
• For what purpose: advertising, recruiting?
• How long may the images be used?
• The note that consent can be withdrawn at any time, and to whom to address the withdrawal.
• The privacy information under Art. 13 GDPR.
• Date and signature or electronic confirmation.

Avoid “for all purposes forever”. Name purpose, channels and duration specifically.

What do you do when consent is withdrawn?

If someone withdraws consent, deleting the published post is not enough. Scheduled posts, drafts and files still contain the image. This is how to proceed in companycore:

1. Find the affected posts. In the Calendar, go through the Draft, Planned and, if present, Approval segments in the list on the left and open posts with the image or video.
2. Reset or delete scheduled posts. Right-click the card (long-press on a phone). For Planned, choose Reset to draft or Delete; for the approval stages, Unschedule or Delete.
3. Check drafts and links. In the Post Generator, Unlink detaches a linked image from the draft. In the Visual Designer, you delete drafts and templates that contain the image.
4. Delete the image in Files (on Home: Photo Library). Deleting is final. If the file is still in a scheduled post, companycore blocks that with “Still used in a planned post” and names the post.
5. Remove published posts on the platform. companycore can no longer change or delete published posts. Remove them directly on Instagram, Facebook, LinkedIn, TikTok or YouTube.

May I share customer reviews and customers’ posts?

• Reviews. Don’t show the reviewers’ names and profile pictures unless they have consented. Don’t alter the review, don’t shorten it in a way that creates a false impression, and name the source, for example “Google review from …”.
• Legal position on reviews. Anyone who makes consumer reviews accessible must state whether and how they ensure the reviews come from real customers (§ 5b (3) UWG, Germany’s Unfair Competition Act). Fake reviews are prohibited, as is claiming that reviews come from real customers without having checked that adequately (UWG annex No. 23b and 23c).
• Photos and videos of customers. If you want to use them as your own post, in advertising or on your website, you need permission. For people depicted, the right to one’s own image comes on top. For example, ask in a comment “May we share this?” and keep a record of the answer. Whether the platforms’ repost features are legally covered is not conclusively settled.

What about other people’s photos and stock photos?

Every photo is protected by copyright, even a snapshot: for at least 50 years as a photograph (§ 72 UrhG, the German Copyright Act). “Copied from Google” is almost always an infringement. For stock photos, the license must explicitly allow social media and commercial use. Observe any attribution duties from the license.

What applies to AI images of real people?

You create AI images of real people, such as a personal AI model from team photos, only with the person’s consent, and publish them only with it. In companycore, a model requires exactly that: when you create it, a consent dialog with a mandatory checkbox appears. The person creating the model ticks the checkbox. For models of employees, get the person’s consent yourself before you create the model. What happens with the data is explained in the privacy policy. You label realistic-looking results as AI; more in AI labeling requirement and Models and AI double.

Checklist

• For every recognizable person, there is documented consent, with purpose, channels, duration and withdrawal.
• Employees consent separately, in writing or electronically, after being informed in text form.
• For minors, the parents’ consent is on file.
• The consents are filed: who, when, for what.
• There is a process for withdrawals that includes scheduled posts.
• Other people’s photos have a license or permission.
• For AI images of real people, the person’s consent is on file.

Which mistakes happen most often?

• The consent was only verbal or it “is in the employment contract”.
• It applies across the board “for all purposes forever”.
• Former employees stay in the recruiting video for years.
• A customer is recognizable in the background of the before-and-after Reel, and nobody asked her.
• Children in the photo, for example at a children’s birthday party in the café, without the parents’ consent.
• A customer’s photo from her story is used as your own post without asking.

Frequently asked questions

Sources

All sources were retrieved on October 13, 2026. Laws and authorities come first, reports after.

Laws, authorities, chambers

• § 22 KUG (in German) – statute text
• § 23 KUG (in German) – statute text
• § 26 BDSG (in German) – statute text
• § 72 UrhG (in German) – statute text
• § 5b UWG (in German) – statute text
• UWG, annex to § 3 (3) (in German) – statute text
• HBDI Hesse (data protection commissioner): guidance on employee data protection after the CJEU ruling, 05/2023 (in German)
• IHK Karlsruhe: leaflet on employee data protection (in German)

Reports and law firm articles

• CMS: employee photos online, the BAG wants it in writing (in German)
• dejure.org: BAG, February 19, 2015, 8 AZR 1011/13 (in German)
• Dr. Datenschutz: photographing in the employment relationship under the GDPR (in German)
• Kanzlei Plutte on OLG Koblenz: advertising with reviews without information on authenticity (in German)