Do you need consent to use employee photos internally and on your website?
In almost every case, yes. You should get written consent before you use an image of a member of staff, whether it appears on your company's public website, in marketing, on social media, or internally on an intranet, a staff directory, or across your internal network. A signed photo release names the intended use, records an affirmative signature, and gives the person a clear route to withdraw permission later. That protects their privacy and shields your organization from claims over misuse of personal information or image rights.
Below is what to include, when consent is required, how internal use differs from public use, how staff can revoke it, and what to do when an image shows more than one person.
Does using employee photos internally still need consent?
Yes, in most cases. Internal use feels lower risk than a public campaign, but the same data protection principles apply. An employee's image is personal data whether it sits on a login-protected intranet, in an internal newsletter, on a team page, or in a company directory. People still need to know where their picture will appear and have a say in it.
Consider the internal uses most companies overlook:
- Intranet and staff directories. Profile images, org charts, and "meet the team" pages inside your network.
- Internal communications. Newsletters, onboarding decks, training material, and company-wide announcements.
- Internal events. Photos from away days, conferences, or socials that get shared back to the wider team.
- Collaboration tools. Profile pictures in your messaging, project, and HR systems.
- Products and services. Staff images used in a demo, a product screenshot, a help center, or customer-facing service material.
Name internal uses explicitly in your consent form and your privacy policy so there is no gap between what staff agreed to and where their image actually appears. It is common to reuse an internal photo later for an external site or a LinkedIn post, and when you want to publish it that way, the second use is a general public use that needs its own prior consent. Keep the two uses separate on the form so one tick does not provide blanket agreement to everything.
Why does consent matter?
Using someone's image without permission can expose your organization to real risk. The most common issues in the United States are:
- State privacy and publicity rights. Many states protect a person's right to control how their name and likeness are used. Ignoring that can lead to fines or lawsuits.
- Discrimination and harassment claims. If an image is used in a way that unfairly targets people based on protected characteristics, or contributes to a hostile work environment, it can trigger a complaint.
- Disclosure obligations. If your company is publicly traded, the Securities and Exchange Commission requires certain disclosures in filings and communications, which can extend to how employee images are used.
There is no single federal statute that governs employee likeness across the country, so an employer has to work with a patchwork of state privacy and publicity laws. That makes a lawful, documented basis for using the image the safest position wherever your staff and customers are based. It records that the person understood how their image would be used and agreed to it, and it gives you the protection you need if a question comes up later.
If your staff or customers are based in Europe or the UK, a photo is personal data under the General Data Protection Regulation. Article 6 requires a lawful basis to process it, and clear consent is the most straightforward one for employee images. Factor in any changes landing in 2026 if you operate across multiple jurisdictions, and make it easy to consult someone when a use is unusual rather than guessing.
How do you obtain proper consent?
Document the agreement through a photo release form, or a clause in the employment contract or handbook. A written release is stronger than a verbal one because it names the use and captures a signature you can rely on later.
A well-drafted release should include:
- A clear statement of the intended use, covering both internal placements (intranet, directory, internal network) and any external use (company website, marketing, social media, LinkedIn).
- A statement that the employee understands and agrees to that use, including how the image and any related personal data will be stored and for how long.
- Whether the use is paid, and if so what compensation the employee receives, so there is no dispute later over a commercial placement.
- A signature line for the employee to sign and date.
- A named contact and a route for the employee to withdraw consent at any time.
Consent has to be voluntary. Staff should be free to decline without any fear of retaliation, and declining should carry no negative consequence at work or to their career. Only collect what you need to know for the stated use, and reflect the same commitment in your privacy policy so staff can see how their data is handled across the business.
If you need a starting point, GenieAI provides customizable templates you can adapt to your own policy and jurisdiction. Browse the full template library or set up the release as part of your employment contract so permission is captured at onboarding. For staff who are leaving, capture the same permission in your employment separation agreement so you know which images you can keep using.
Is email consent valid?
Email consent can be valid, but it is not the most reliable approach. Consent should be clear and affirmative, and a short reply email may not meet that standard. An email thread also gets messy to search when you need proof months later. A signed release lets you set out the exact use, take an affirmative signature, and keep organized records in one place.
Can employees revoke consent?
Yes. Staff can withdraw permission for the use of their image or personal data at any time, and privacy law treats consent as an ongoing choice rather than a one-off. If someone revokes it, stop using their picture as soon as you can and remove it from live pages, internal systems, and marketing content.
Set up a simple, named process for withdrawing permission and act on requests promptly. When a request comes in, HR or your resourcing team should have a clear checklist to follow so nothing is missed, including internal network locations that are easy to forget. Continuing to use someone's image after they have revoked consent can breach privacy law and damage trust across the team. Updating your records each time someone joins, leaves, or changes their mind keeps the whole set current.
What if an image includes other people?
If a picture shows other employees or non-employees, get written consent from each identifiable person before you use it. A release form lets you document everyone's permission. If a customer or client appears in a photo taken at your premises or an event, ask for their sign-off too. For images taken at public events or locations, you may not need consent for incidental appearances in the background. If you are unsure about a group shot, treat the safest option as getting each identifiable person's sign-off.
Best practices for using employee photos
To keep risk low and maintain a respectful workplace, follow these steps whenever you use employee images, internally or in public-facing materials:
- Obtain written consent using a clear, specific release form that lists each intended use.
- Name the exact placements, internal and external, so the person knows where their image will appear before you publish it.
- Record whether any use is paid and what compensation applies.
- Give staff a straightforward way to withdraw consent, with a named contact.
- Use images professionally, avoiding anything that could look discriminatory or create a hostile work environment.
- Review and update your policy, privacy policy, and records regularly as your team and the law change.
Don't skip the paperwork just because a shot is already live. If you find an old image you can't tie to a signed release, ask the person again and record their answer. Consent and data protection rules vary by state and by country, so if your situation is unusual it is worth checking the specific state privacy and publicity rules that apply to your staff. Handled this way, you can showcase your people and your company culture while respecting their privacy.
At GenieAI, we make it straightforward to draft and review the documents behind these decisions, from release forms to employment agreements, so your team can get the paperwork right without waiting on outside counsel.
