Two different rights sit on top of every photograph of a person, and confusing them is the most expensive mistake in this area. Copyright protects the photographer's work. Image rights, also called personality or likeness rights, protect the person in the frame. You can own the copyright to a photograph outright and still have no right to publish it, because the people in it never agreed to appear. This guide explains where the line runs, when you need consent, and, the part most articles skip, exactly when blurring a face removes the problem and when it does not.
As a Data Protection and Privacy Expert I regularly see organizations penalised for improper use of images, from unauthorised commercial use of someone's likeness to publishing photographs without a lawful basis under the GDPR. The financial and reputational consequences are substantial. What follows is the practical framework, not the theory.
What are image rights and why do they matter?
Image rights are the legal protections governing how photographs or videos featuring identifiable individuals can be used. They sit at the intersection of copyright, which protects the creator's work, and personality rights, which protect the subject's likeness. Taking a photograph generally makes you the copyright owner, but it does not grant you unlimited rights to use the people in it, especially for commercial purposes.
The GDPR strengthened these protections considerably by treating a photograph of an identifiable individual as personal data. That single classification is what pulls publishing, archiving and sharing photographs into a data protection framework with its own lawful basis requirements, subject rights and penalties.
The practical consequence for media organizations, photographers and any company that publishes visual content: you need to clear two separate things before publishing, the rights in the image and the rights of the people in the image. Clearing one does not clear the other.
What types of rights exist for images?
Four layers coexist on a single photograph. Keeping them apart is the whole skill.
Right | Who holds it | What it controls | Removed by blurring? |
|---|
Copyright | The photographer or their employer | Reproducing, distributing and displaying the image itself | No |
Personality or publicity rights | The person depicted | Commercial use of their likeness and identity | Usually yes, once they are no longer identifiable |
Data protection (GDPR) | The person depicted, enforced by regulators | Any processing of an image of an identifiable person | Usually yes, once identifiability is genuinely removed |
Contract and licence terms | Whoever you signed with | Whatever the model release, stock licence or event terms say | No |
Copyright arises automatically on creation and lasts for decades, in most countries the author's life plus 70 years. Personality rights protect individuals from unauthorised commercial exploitation of their identity. Commercial rights and licensing agreements determine how an image may be monetised. Read the right-hand column carefully, because it is where most of the confusion in this area lives.
When is permission required to use someone's image?
Permission is generally required when you use someone's image for commercial purposes. Commercial use covers advertising, merchandising and any application where the image helps generate revenue. Using an image to promote products or services without authorisation can infringe both copyright and personality rights at once.
Under the GDPR, publishing photographs of identifiable individuals requires a lawful basis, and in a commercial context that is normally consent. The standard is stricter for children. There are exceptions for public figures in public places where the photography relates to their public role, and news reporting benefits from certain exemptions, but those exemptions do not eliminate all obligations under image rights law.
The problem in practice is rarely the main subject, who is usually briefed and willing. It is everyone else in the frame: the passers-by, the people at the next table, the crowd behind the speaker, the parents in the second row. You cannot realistically obtain consent from thirty strangers, and that is precisely the situation the next section addresses.
When does blurring solve the image rights problem?
This is the question the rest of the internet leaves unanswered, so here is the mechanism in plain terms.
Image rights and GDPR obligations attach to identifiable individuals. Article 4(1) of the GDPR defines personal data by reference to whether a person can be identified, directly or indirectly. Recital 26 then says that data protection principles do not apply to information rendered anonymous in such a way that the data subject is no longer identifiable, taking account of all means reasonably likely to be used.
Blurring therefore does not get you permission. It removes the need for permission, by removing the thing the obligation attaches to. If a person in your published photograph cannot reasonably be identified, the personal data layer falls away, and with it the consent requirement and the data subject rights that come with it. The same logic applies to personality rights: a likeness that no longer identifies anyone is not being commercially exploited.
That is why face blurring is the standard operational answer for the situations where consent is impossible rather than merely inconvenient:
Bystanders and crowds in footage shot in public
Minors who appear incidentally, where parental consent was never obtained
CCTV or dashcam material released in response to a data subject access request, where the requester is entitled to their own data but not to everyone else's
Documentary, training and marketing material reused from an event years after it was filmed
Datasets prepared for analytics or machine learning, where the faces serve no analytical purpose
One important qualification. Blurring only reaches the layers where identifiability is the trigger. Look again at the right-hand column of the table above: copyright and contract survive it entirely. Blurring the faces in a stock photograph does not licence the photograph.
When is face blurring required for legal publication?
Requirements vary by jurisdiction, so treat the following as the pattern rather than the rule in your country. In broad terms, the higher the harm from identification, the closer blurring moves from prudent to mandatory.
Situation | Consent normally needed? | Does blurring resolve it? |
|---|
Bystanders in a public place, editorial use | Often not, but notice may be required | Yes, and it removes the argument entirely |
Bystanders, commercial or advertising use | Yes | Yes, for the bystanders. The named model still needs a release |
Minors | Yes, from a parent or guardian | Yes, and it is the usual default when consent is missing |
Victims of crime | Identity protection is mandatory in most jurisdictions | Yes, and it is normally required rather than optional |
Protests and demonstrations | Depends on jurisdiction and context | Yes, and it is widely treated as an ethical minimum where identification could cause harm |
Patients or clinical settings | Yes, and health data rules apply on top | Partly. See the next section on context |
Employees in workplace footage | Yes, with employment law rules on top | Yes for third parties, but the employment analysis stays |
CCTV released on an access request | The requester is entitled to their own data only | Yes, this is the standard method |
Public figure acting in a public role | Often not for news reporting | Not usually needed, and may defeat the editorial purpose |
When you are unsure, the asymmetry favours blurring. The cost of anonymising a face you did not need to anonymise is a slightly less useful photograph. The cost of publishing one you should have anonymised is a complaint, a takedown, and potentially a regulatory penalty.
When blurring is not enough
An honest guide has to cover the failure modes, because a blur applied badly gives you the paperwork of compliance without the substance of it.
The blur has to be irreversible. A blur effect sitting on a layer in a project file that can be switched off is not anonymisation, it is a filter. Only an exported file with the obscuring burned in removes identifiability. We go through this distinction in detail in our article on de-identification, anonymisation and whether face blurring is irreversible.
The face is not always what identifies someone. Recital 26 asks about all means reasonably likely to be used, not just the face. A distinctive tattoo, a uniform with a visible number, a wheelchair, a rare vehicle, a name in the caption, or a location and timestamp that narrow the field to three people can all restore identifiability on their own. This gap is the subject of a separate piece on when unique features reveal identity despite blurring. Automatic detection tools find faces and license plates. Everything else is a judgement call that a person has to make.
Context can carry the disclosure by itself. A blurred face outside a specific clinic still suggests something about the person's health. Where special category data under Article 9 is in play, the surrounding scene may need attention as much as the face does.
Copyright, contract and other claims are untouched. Blurring does not licence a photograph you do not own, does not override the terms of a model release or a stock licence, and does not answer a defamation claim arising from the caption rather than the image.
The workable rule: blurring is how you remove identifiability, and removing identifiability is how you discharge the image rights and data protection layers. It is not a general legal shield, and treating it as one is how organizations end up surprised.
How does the GDPR affect image rights management?
Because photographs of identifiable individuals are personal data, their processing must satisfy GDPR principles, starting with a lawful basis such as consent or legitimate interest. The European Court of Justice confirmed the breadth of this in Buivids (C-345/17), where publishing video of a police station on a video sharing site was held to be processing of personal data within the scope of the Directive, subject to the balance with freedom of expression.
For photographs taken at events or in public places, you must inform subjects how their images will be used, normally through privacy notices or visible signage. Where the use is commercial, explicit consent is generally required.
The GDPR also gives individuals rights over image use, including the right to object and, in many circumstances, the right to erasure. Any organization holding a visual archive needs a procedure for handling those requests, and in practice that procedure almost always involves anonymising third parties before releasing anything.
How can I use images legally without risking copyright infringement?
The most straightforward route is permission directly from the copyright holder, which may mean negotiating usage terms or buying a licence. Public domain material, where protection has expired or been waived, is another. Creative Commons offers work with clear usage terms, though you should always check the specific licence. Stock services provide legally cleared photographs subject to their own terms.
In limited cases use of a copyrighted work may qualify as fair use or fair dealing, for purposes such as news reporting, commentary or education, but the exception is interpreted narrowly and differs substantially between jurisdictions.
Note what none of these routes gives you: the right to use the people in the photograph. A stock licence covers the photograph. Whether the model release attached to it covers your intended use is a separate question, and for imagery containing crowds it usually covers nobody but the model.
What constitutes copyright infringement for images?
Infringement occurs when you use a protected image without permission in a way that violates the exclusive rights of the copyright holder: reproducing, distributing or displaying it without authorisation. Modifying the work can still infringe if the result substantially resembles the original.
Using images found through a search engine without checking their status is the most common route to unintentional infringement. Appearing in search results says nothing about whether an image is free to use. The commercial nature of the use weighs heavily in the analysis.
Platform terms of use, which every user accepts on joining, grant the platform a broad licence to use, modify and sometimes sublicense uploaded content, even though the uploader retains copyright. Content spreads across platforms quickly, which makes rights management harder rather than easier.
Never assume material found on social media is free of copyright. For businesses running influencer campaigns, the agreement needs to address both the influencer's copyright in the content and the right to use their likeness for promotion, since those are the two separate layers again.
What are the consequences of image rights infringement?
Copyright claims can bring statutory damages, orders to remove the content and liability for the other side's legal costs. Beyond the money, reputational damage often outlasts the judgment.
Under the GDPR, unlawful processing of someone's image sits within the enforcement regime whose upper tier reaches €20 million or 4% of annual global turnover, and individuals may also claim compensation for damage suffered. The regulatory layer is what turns a photography question into a board-level risk.
The mitigation is unglamorous: clear policies, trained staff, a record of what permissions exist for which assets, and a default of anonymising anyone whose consent you cannot evidence.
Public figures retain protection against unauthorised commercial use of their likeness for merchandising or endorsement, while their expectation of privacy is narrower in public contexts connected to their public role. News reporting about them is generally permitted where the images relate to matters of public interest.
Commercial use is the bright line. Using a celebrity's image to sell something without authorisation infringes publicity rights regardless of how the photograph was obtained, and where a likeness has become distinctive enough to function as a brand identifier, trademark law may add a further layer.
How can I protect my own image rights as a photographer?
You own copyright in your images automatically on creation, without registration, although registration with a national office provides additional remedies in some jurisdictions. Clear contracts and licences are what actually protect the work: specify how it may be used, for how long and in what contexts.
Metadata and watermarks help identify your work and deter casual reuse, and reverse image search makes monitoring practical. A graduated response starting with a takedown request usually resolves matters faster than litigation.
The point that catches photographers out is the reverse direction. Owning copyright does not entitle you to publish. If your frame contains people who did not consent, you still need either a release or anonymisation before commercial use, which is why photo anonymization belongs in a working photographer's toolkit alongside the licence templates.
How to publish a photograph without breaching image rights
Establish who owns the copyright. If it is not you, get a licence covering your intended use before going further. Blurring will not fix this layer.
List every identifiable person in the frame. Not just the subject. Everyone.
Check what consent you can actually evidence. A model release covers the model. It does not cover the crowd.
Anonymise everyone you cannot evidence consent for. Run the file through anonymization software so faces and license plates are detected and obscured automatically rather than masked by hand.
Review the result for residual identifiers. Tattoos, badges, name boards, unusual vehicles, captions. Fix them in the manual editor, because automatic detection covers faces and plates only.
Export the anonymised version and publish that file. The blur must be burned in, and the identifiable original should be retained or deleted according to your own retention policy.
Gallio PRO handles steps 4 to 6 on your own computer. It detects faces and license plates automatically across photographs and video, includes an editor for the residual identifiers no automatic tool can judge for you, and processes everything locally so the material never leaves your infrastructure. There is a walkthrough in our guide to how to anonymize photos, and the feature detail is on the face blurring software page.
Download the free demo and test it on your own images
FAQ: Common Questions About Image Rights
What is the difference between copyright and personality rights?
Copyright protects the creator's rights in the photograph itself. Personality rights protect the depicted person's control over commercial use of their likeness, name or identity. They are held by different people and cleared separately.
Does blurring a face mean I no longer need consent?
In most cases yes, for that person, because image rights and GDPR obligations attach to identifiable individuals. Once someone genuinely cannot be identified, the obligation has nothing to attach to. It does not affect copyright or any contract you have signed.
Is blurring enough to make an image anonymous under the GDPR?
Only if identification is not reasonably possible by other means. Recital 26 asks about all means reasonably likely to be used, so a blurred face alongside a name in the caption, a distinctive tattoo or a uniquely identifying context may still leave the person identifiable.
Do I need permission to publish photos of bystanders?
For editorial use in a public place, often not, though notice may be required. For commercial use, yes. Where consent is impractical, anonymising the bystanders is the standard solution.
Do I need model releases for street photography?
For artistic or editorial use, generally no. For commercial use where individuals are identifiable, yes. GDPR requirements may apply in addition across Europe.
Can I use images found on Google Images for my business website?
No. Appearing in search results does not make an image free to use. You must verify the copyright status and obtain a licence for commercial use.
How long does copyright protection last for photographs?
In most countries, the life of the creator plus 70 years, after which the work enters the public domain. Personality rights follow different and generally shorter timelines that vary widely by jurisdiction.
What counts as fair use for images?
Fair use and fair dealing typically cover criticism, commentary, news reporting, teaching and research, judged case by case on purpose, nature, amount used and market effect. The doctrine differs substantially between jurisdictions.
Can I photograph people at public events without consent?
Generally yes for editorial purposes, but commercial use requires permission. Under the GDPR you should give notice that photography is taking place and explain how the images will be used.
Someone asked me to remove their photo. Do I have to?
Where the GDPR applies, individuals have the right to object and in many circumstances the right to erasure. Anonymising them in the published version is often an acceptable alternative to removing the whole asset, and it is usually the better outcome for both sides.
References
European Union. (2016). General Data Protection Regulation (GDPR). Regulation (EU) 2016/679, in particular Article 4(1), Article 9 and Recital 26.
Court of Justice of the European Union. Case C-345/17 Buivids v. Datu valsts inspekcija (2019), on video recording, publication and the scope of data protection law.
Article 29 Working Party. (2007). Opinion 4/2007 on the concept of personal data, WP136.
Article 29 Working Party. (2014). Opinion 05/2014 on Anonymisation Techniques, WP216.
European Data Protection Board. (2020). Guidelines 3/2019 on processing of personal data through video devices.
World Intellectual Property Organization. (1996). WIPO Copyright Treaty.
Berne Convention for the Protection of Literary and Artistic Works (1886, last amended 1979).
European Union Intellectual Property Office. (2020). Copyright and Related Rights in the EU.
This article is general information, not legal advice. Image rights and personality rights differ significantly between jurisdictions, so check the position in yours before relying on any of it.
