- A photograph of an identifiable living person is personal data. That is true of a billboard and of a school hockey team.
- Consent is not the only lawful basis for photography — but it is usually the right one for commercial and marketing use.
- Paper releases fail in the same two places every time: scope drifts away from what was agreed, and nobody can retrieve the record when asked.
- Binding consent to the asset fixes both, because the terms travel with the file rather than sitting in a folder.
This is not a niche problem
Verified consent tends to be discussed in the context of the sectors where the stakes are most obvious. That framing is too narrow, and it lets a lot of organisations conclude the topic is not about them.
Article 4(1) does not carve out commercial photography. If a living person can be identified from an image, that image is personal data, and publishing it, licensing it, storing it or editing it is processing. A brand shoot is processing. A stock library is a processing operation at scale. A school newsletter photograph is processing, with a subject who cannot consent for themselves.
What follows is four sectors that share almost nothing operationally, and exactly one failure mode.
One clarification worth making early, because it is where a lot of compliance advice overreaches: consent is not always the lawful basis you need. Journalism and artistic expression are treated differently under Article 85, and incidental crowd capture is usually handled through transparency and legitimate interests rather than individual sign-off.
Where consent is the basis — advertising, stock licensing, promotional and marketing use, images of children — it has to be specific, informed and demonstrable. That last word is the one paper cannot deliver.
Four sectors, one failure mode
Brand campaigns and commercial advertising
- A release is signed for a defined use: paid social in three European markets, twelve months.
- Eighteen months later the same footage is cut for a channel that did not exist when the contract was drafted.
- Nobody consults the original PDF, because it lives in a folder nobody opens.
- Usage terms are captured as structured data: channels, territories, end date.
- The asset carries its own limits, so the constraint travels with the file rather than the contract.
- Expiry can trigger archival before reuse becomes a breach of purpose limitation.
Stock libraries and digital asset management
- A flat PDF sits beside the image. Nobody checks whether the signature is real or whether the ID belongs to the person in frame.
- Licensing buyers inherit that uncertainty and price it as risk, or discover it during a dispute.
- The exposure lands on the brand and the library together, alongside the reputational cost.
- The subject verifies their own identity and approves the specific asset, so the release is bound to the file.
- A consent certificate can travel with each licensed download.
- Enterprise buyers get a documented provenance chain rather than an assurance.
Schools, youth sport and family-facing brands
- Consent arrives as paper forms at the start of a season and is never reconciled against what gets published.
- A form may be signed by an adult without the legal authority to give it.
- When consent is withdrawn mid-year, staff search manually through thousands of photos.
- A guardian verifies their own identity once and links it to the child they are responsible for.
- Every published asset carries the tag recorded at upload — so withdrawal is a lookup, not a search.
- The withdrawal, the affected assets and the removal are all recorded in one trail.
Conferences, festivals and live production
- A sign at the door announcing that entry implies filming consent rarely meets the standard for freely given, specific consent for marketing use.
- Featured interviews and close-ups get paper releases chased around a venue on a clipboard.
- Forms go missing between the floor and the edit suite, and the footage is already in the cut.
- A crew member generates a QR code on a phone; the attendee scans it on their own device.
- They see the clip, verify, and approve in well under a minute, in the room.
- The approval arrives attached to the specific roll and timecode, before the edit begins.
Scope drift is the expensive one
Of the failure modes above, the one that quietly generates the most exposure is scope. Nobody sets out to breach purpose limitation. What happens is that a campaign performs well, a new channel opens, an agency changes hands, and the asset outlives the terms that were attached to it.
The contract said twelve months on paid social in three markets. The asset is now a YouTube pre-roll in eleven. No individual made a decision to exceed the grant; the grant simply became invisible the moment the PDF was filed. A release form is a document about an asset, stored somewhere the asset is not.
Attaching the terms to the file inverts that. Channels, territories and expiry become properties of the asset that a system can read, query and act on — the difference between a limit somebody has to remember and a limit the pipeline can see.
A careful note on photographing children
The youth sector deserves more than a bullet list, because it is where the ambition to be helpful most easily produces something harmful.
The practical failure in schools and youth sport is rarely the initial consent. Forms do get signed. The failure is honouring withdrawal: a parent changes their mind in March, and there is no realistic way to find every photograph of that child across a season's galleries, newsletters and social posts. The right is real; the mechanism does not exist.
ProntoTag closes that gap using the tag recorded at upload. Every published asset already carries a reference to the person it features, recorded when it was published and approved. Withdrawal becomes a lookup against that reference — the affected assets are identified because they were labelled at the point of entry, not because anything was scanned afterwards.
There is an obvious-sounding alternative: run facial recognition across the whole library to find every image of a given child. We do not do that, and we would advise against buying it from anyone who offers it.
Searching a photo archive by face means processing biometric data of minors at scale — precisely the processing that European regulators have taken the hardest line on, and several national authorities have blocked facial recognition in school settings outright. A tool that requires you to run biometric identification on children in order to protect children has not solved the problem. Tag at the point of publication, and the takedown works without ever building that capability.
The identity check in this flow sits with the adult, not the child. A guardian verifies themselves once and that verified identity is linked to the consent they are giving — which also addresses the quieter problem of forms signed by someone without the authority to sign them.
Sector by sector, in one view
| Sector | Where paper fails | What asset-linked consent adds |
|---|---|---|
| Advertising | Static terms that campaigns quietly outgrow in channel, territory and time. | Usage boundaries stored as data on the asset, with expiry the pipeline can act on. |
| Stock & DAM | Attached PDFs nobody verifies, in a market where buyers are paying for certainty. | Subject-verified approval per asset, and a consent record that ships with the licence. |
| Youth & schools | Consent that can be given but not meaningfully withdrawn months later. | Guardian-verified consent, and withdrawal resolved by tag lookup rather than manual search. |
| Live events | Clipboard releases that go missing between the venue floor and the edit. | QR approval on the subject's own phone, attached to the roll and timecode. |
What this does not do
Three limits worth stating, because a compliance tool that oversells itself creates a false sense of coverage — which is worse than no tool at all.
- Recording a limit is not the same as enforcing it. ProntoTag makes usage terms structured and queryable, and can flag assets whose terms have lapsed. Whether an expiry actually pulls an asset out of circulation depends on the integration you build into your own DAM or publishing stack.
- Consent is one obligation among several. Transparency notices, retention schedules, processor agreements, DPIAs where the processing warrants one — none of these are replaced by a good consent record. It is the evidence layer underneath them, not a substitute for them.
- Crowd scenes remain a judgement call. Verified consent is the right instrument for featured subjects. Incidental background capture is a different analysis and should be handled as one, rather than pretending every face in a wide shot needs a signature.
Where to start
A useful test, whichever sector you are in: pick an asset currently in circulation and try to answer three questions about it. Who is in it, and did they personally approve this file? What were the agreed limits, and has the asset stayed inside them? And if that person asked you to stop using it this afternoon, how long would compliance actually take?
Most organisations can answer the first question, struggle with the second, and quietly dread the third. That third one is the one a regulator will ask.