Who owns your face in the digital world?

By Eva Luksa. Personal opinion, not legal advice.

I have worked in marketing and communications for more than 15 years. During this time, I have worked closely with company content. People in marketing are storytellers. And one of the strongest tools in storytelling is still authenticity.

Artificial intelligence can now create perfect and polished images. But very often they look similar and feel impersonal. I still believe in real, "live" photos. They tell real stories and show the true nature of a company. What is more authentic than real emotions in a real photo? A customer truly enjoying a service. An employee who feels proud of their workplace. These photos are valuable and will stay valuable.

But this is where one of the biggest problems of the digital age begins: we focus so much on creating and publishing content that we forget one basic question: who does this photo really belong to? And by "belong," I do not mean the photographer's copyright. I mean the person's right to their own face.

Since GDPR came into force, this is no longer just theory. It is a practical issue. Latvia's Data State Inspectorate has clearly stated that a person's photo is personal data, and publishing it on social media can be personal data processing.

The reality hidden in fine print

Let us be honest about how photo consent is still often managed in Latvia. A common approach is a paper form, a general rule, or a sentence saying that "consent is included in the contract." This may be easy for the organization, but it is not always fair or transparent for the person whose face is being used.

This is especially risky at public events. Taking photos and publishing them is not automatically a "free zone." Organizers must assess whether publication is justified in the specific situation and inform people about the processing of their personal data.

To me, the phrase "attending an event or buying a ticket means consent" is very convenient for the organizer, but it does not protect the person very well. It is not a transparent conversation with the audience. It is simply a way to hide responsibility in the fine print.

Children's photos

In schools and other educational institutions, data protection should be at the highest level, because this is about children. And this is exactly where practice often shows how difficult paper-based consent can be. If permissions are kept in folders and are not easy to review, a teacher may have to remember which children can be photographed and which cannot.

This is not a sustainable process. It leads to mistakes, complaints, and reputational risk. For example, in 2025, a kindergarten in Italy received a €10,000 fine for publishing children's photos on its website and Google profile without proper safeguards. Practice in Europe shows that the processing of children's data, including in schools and kindergartens, is judged especially strictly.

One principle is very important to me: a person has the right not to be published if they do not want to be. And when children are involved, this becomes even more sensitive.

Why do people stay silent?

The biggest mistake is to think that if no one complains, everything is fine. It is not. People often stay silent not because they are okay with it, but because it feels awkward. They do not want to damage the relationship, sound difficult, or question the organization's actions.

This means a brand can lose trust without even noticing it. A customer may simply feel uncomfortable, hurt, or ignored, and that can be enough to damage the relationship. People are not against publishing itself. They want the organization to ask. They want the ability to choose, to have control, and to change their mind. The European Data Protection Board says that consent must be as easy to withdraw as it is to give. The real question is: is it?

From risk to opportunity

My view is simple: the old checkbox approach to consent is outdated. It is inefficient, risky, and harmful to brand reputation. We need digital solutions where consent is clear, transparent, and easy to change.

A platform where an organization can send a photo to the person in it for approval. The person receives a simple question on their phone: "May we publish this photo?" With one button: agree or decline. And if consent is not given, the person is automatically removed, while the rest of the photo can still be used.

People are ready for this. They want speed, clarity, and control. That is why digital consent management is not only a legal burden. It is also an opportunity to build more transparent and respectful relationships with customers, employees, and society as a whole.

What really matters

Every photo we publish is part of our brand story. But it is also part of someone else's identity.

So the question is not only: "Are we allowed to do this?"

It is also: "Are we doing it with respect?"