Privacy for Content Teams: GDPR Consent and Using Photos & Video of People the Right Way

GDPR consent is one of the legal bases that lets a company use personal data, including photos and videos of identifiable people. It means a person has clearly agreed to a specific use. Any marketing team that films people is inside the GDPR. In this conversation, Mats, a legal consultant focused on GDPR and AI, explains consent, model contracts and the requests teams will face.

Mats has advised marketing teams from a large Danish law firm. The goal of this conversation isn't to replace legal advice. It's to help marketing teams understand the landscape well enough to have a useful conversation with their legal team or advisor.

When are photos and video personal data?

The main rule: when someone is identifiable, directly or indirectly, in photo or video material, it's personal data. When a company handles that material for a commercial purpose, the whole GDPR framework applies. We cover this in more depth in When Are Videos and Photos Considered Personal Data?

The company is the data controller, responsible for handling it correctly. The marketing team is responsible on the operational side. In practice, that means knowing where your footage is and how it's used.

When someone asks "where am I in your footage?" or asks you to delete something, simply finding those assets can be a real challenge. That's especially true if you haven't put things in a system.

Three legal bases: consent, legitimate interest and contract

Inside the scope of the GDPR, every processing activity needs a legal basis. For footage of people, there are three to consider:

• Consent
• Legitimate interest, which Mats calls fluffy in this context because it can be difficult to apply
• Contract law, through a model contract

Each has pros and cons, and the right choice depends on the specific situation. That decision belongs with your legal team, lawyers or advisor. What's the right fit, what risks are you facing, and what's a pragmatic approach?

A common mistake is assuming consent is the only option. Teams often realise too late that people can withdraw consent, and critical material suddenly becomes unusable.

Consent is straightforward, but rarely simple

Consent looks easy: get people to sign a form. But two areas of law overlap here. Privacy law is the base underneath. Marketing law sits on top, covering how you're allowed to use people and their names. In Denmark, the Consumer Ombudsman has published guidance on this.

The first issue Mats sees is that consent forms are often drafted too simply. Consent defines what you can do with the material. If a use isn't covered by what the person signed, you can't use the footage for it. Consent is very purpose-specific.

That's also why consent has to be collected every time you film. "They signed last time" doesn't count, unless the original form specifically covered those exact dates and shoots. Read more in How Often Do You Need Consent From Participants?

The requirements for valid GDPR consent

Consent can't be passive. "You saw the camera, so you accepted" is not consent. Mats lists the requirements a consent form always has to meet, which come from Article 7 of the GDPR:

1. Freely given. You can't assume that the people in your footage have consented.
2. Informed. People have to understand what you're going to do with the material. Plain language, not terms and conditions no human can read.
3. Specific. The purpose has to be on point. "We'll use this for anything, in all worlds and all universes" doesn't work.

Informed and specific are close to each other, and they're the trickiest part. A consent drafted too broad or too deep falls apart entirely. Writing one that would hold up with the Danish Data Protection Agency is an art. The UK regulator's guide on what makes consent valid is a useful reference too.

The practical problem Mats meets most often is a team that doesn't know the purpose yet. "We'll figure it out along the way" isn't good enough. With consent, you need to know the purpose before the shoot.

Marketing content is almost always commercial

Anything a marketing team produces is typically considered a commercial purpose. The Danish Consumer Ombudsman sets the bar for "commercial" very low. Once the purpose is commercial, you're inside the GDPR framework, and there's no way around it.

The goal is a pragmatic approach with your legal team: staying productive and creating a lot of content without breaking the rules. That conversation has to happen before deciding between consent and model contracts.

Model contracts: more certainty, for a price

A model contract moves you partly from privacy law into contract law, while privacy law still applies underneath. Contract law works on a something-for-something principle: a payment on market terms has to be made.

What counts as market terms differs. Ask yourself: is this person an extra in the background for a moment, or the face of a major project with a large distribution budget? A professional model, or someone at a concert?

If you invest heavily in content, hiring a crew to film important material, relying on consent is not a solid foundation. Paying people under a model contract may be the better option.

The contract still has to be informed and specific, but the legal basis becomes fulfilling a contract. Unlike consent, the person can't simply withdraw it. A contract can only be revoked within its own terms, and the parties have more freedom to agree on those terms.

The essential part is having both tools in your arsenal and picking the right one for the job. Consent can be the better fit for shorter formats with lower stakes. Our post on consent vs. model contracts compares them side by side.

Questions to answer before you film

The first question any advisor will ask is: what are you going to use it for? Everything in privacy centres on the purpose. Bring answers to these:

• Where will the material be distributed, and to what extent?
• What's the timeframe? Using a photo or video for the next ten years points towards a model contract. One Instagram, TikTok or LinkedIn post may not.
• How valuable is the asset, and how much production effort goes into it? Basing a big investment on a simple consent may be too risky.

Evaluating the longevity of the material before filming is key: how critical it is, and how long you want to recycle it.

The information obligation

One of the hardest rules to comply with is the duty to inform. People in your material have to know what you'll do with it and how long you'll store it. They also need to know how to exercise their rights, how to contact you and how to complain.

The requests marketing teams will face

These requests often land with the legal department, because marketing teams are great at marketing, not at handling legal requests. But the team still has to be able to find the material.

Access requests are the most typical. Picture someone who was filmed at a concert and wants to see the footage, maybe wondering if they look drunk in it. You need to find that exact piece. That requires a paper trail: what material do we have, and who appears in it?

Without a system, that becomes detective work through a pile of signed papers, trying to figure out who's who and what each person signed.

Deletion requests and withdrawn consent are the other big one. The right to be forgotten is often misinterpreted. If someone withdraws consent, the data controller has to delete the footage. But not every situation gives a person the right to deletion. Before deleting anything, it's worth getting advice from a privacy professional, because the answer depends on the details.

Do your homework before you call a lawyer

Before talking to internal or external advisors, get clear on:

• The purpose of the material
• The extent: internal use only, or public?
• The technology you plan to use
• The workflow: who does what, how data flows from A to B to C, and whether external freelancers are involved

If freelancers are part of the workflow, read Should Freelance Photographers sign a Data Processing Agreement?

What most teams lack is internal governance. That means clear rules of engagement on who's responsible, who's accountable and who needs to be informed before or after. Pre-drafted templates help, along with instructions on when to use consent and when to use a model contract. So does making sure your privacy policy covers the purposes you actually have.

Build the foundation once

This doesn't have to be a conversation every two weeks. With a good foundation, you adjust on top. When the purpose changes, or you collect new types of data or new categories of people, you make small changes. Project A and project B follow the same approach, almost a checkbox exercise.

Mats's main advice is to tackle it up front. It's far easier to get advice on the boundaries before a shoot than to fix wrong behaviour for a long time afterwards. Getting started is halfway to the goal, and the compliance work is not as bad as it sounds.

This article is general information, not legal advice. Always check your specific case with your legal team or advisor.

Frequently asked questions

Are photos and videos of people personal data under the GDPR?

Yes, as a main rule, when someone is identifiable directly or indirectly. If a company handles that material for a commercial purpose, the full GDPR framework applies.

What are the requirements for valid GDPR consent?

Consent has to be freely given, informed and specific. People must understand in plain language what the material will be used for, and the purpose must be defined before the shoot.

Do I need new consent every time I film the same person?

Yes, unless the original consent specifically covered those dates and shoots. Consent is tied to a purpose, and a new project usually means a new purpose.

When should I use a model contract instead of consent?

When the content is a big investment or meant to be used for years. A model contract involves a payment on market terms and can't simply be withdrawn, which gives more certainty than consent.

What happens if someone withdraws their consent?

The data controller has to delete the footage. Not every situation gives a right to deletion, so it's worth getting advice from a privacy professional before deleting anything.

Keep a paper trail without the paperwork

See how release forms stay linked to every clip, with a workflow reviewed by external counsel in our Legal Framework. Book a demo of Mediacloud.ai.

‍