Disclaimer: this article is for general information only and does not constitute legal advice. Laws on copyright, image rights and privacy vary by country and region. Before making decisions, consult a qualified legal professional in your jurisdiction.
A single photo taken at your event is three legal objects at once. It is the work of the photographer who took it. It shows people who have rights over their own image. And as soon as someone can be recognized in it, it is personal data. This guide walks through each framework, the practices we see most often and the points to watch. The good news: a few simple habits go a long way, and this guide shows you which ones. For anything specific to your events, your legal counsel is your best ally.
The 3 legal frameworks behind an event photo
Copyright
A photo is a creative work, and its copyright belongs to the photographer who took it, not to the organizer who paid for it, unless a contract says otherwise. Copyright decides who may copy, publish, edit or sell the photo, and for which uses.
Image rights
Image rights protect the people who appear in a photo by letting them control how their likeness is captured and used. Depending on the country, publishing a recognizable person's image can require their permission, especially for advertising.
Data privacy
In most countries, a photo of someone whose face is visible is personal data, protected by privacy laws such as the CCPA in California, the GDPR in Europe or Law 25 in Quebec. That creates obligations on how photos are collected, stored, shared and deleted, with stricter rules when facial recognition is used.
The catch: it depends on where you are
None of these frameworks are global. Copyright ownership, image rights and privacy rules are set by national, and sometimes state or provincial law. The same photo can be fine to publish in one country and risky in another, so for an event abroad or an international audience, check the rules of each jurisdiction involved.
Common practices and points to watch
Copyright
Start with your event photographer contract. In most countries the photographer keeps ownership by default, so what you can do with the photos depends on the rights the contract transfers or licenses to you. List the uses you plan (internal communication, website, social media, press, advertising, sharing with sponsors) and check that each one is covered.
A few examples:
- United States: a hired photographer owns the copyright in event photos unless agreed otherwise. The client likely has an implied license for personal or internal use, but broader use calls for a written license or a written assignment of rights (GFR Law).
- France: a transfer of rights must be in writing, each right must be named separately, and its scope must be limited by extent, purpose, place and duration (Article L131-3 of the Intellectual Property Code). Courts read these clauses narrowly: any right not expressly transferred stays with the photographer. Common practice is a rights transfer clause in the quote or contract that lists the uses, territory and duration.
- Canada: since the 2012 Copyright Modernization Act, the photographer, not the client who commissioned the photos, is the first owner of copyright (Clark Wilson). Organizers need a written assignment or license covering the uses they plan.
Working through an intermediary, such as an event agency? Ask what guarantees you get. The agency should hold the rights from the photographer, pass them on to you in writing for the uses you need, and commit to cover you if the photographer or a third party later claims rights.
Good practice everywhere: credit the photographer. In France, the author's right to be named is part of their moral rights. Elsewhere, it costs nothing and keeps the relationship healthy.
Image rights
Depending on the jurisdiction, check that you have the right to take the photos in the first place, then to use them. Here again, the use matters: an internal recap is not an advertising campaign.
- United States: the right of publicity is state law, recognized in over half of the states. Using someone's name or likeness for commercial purposes without permission is generally a violation, while newsworthy uses are a defense (Venable).
- France: image rights derive from Article 9 of the Civil Code. People photographed in a public place who do not appear distinctly are considered to have given tacit consent, but that no longer holds once a person is centered, enlarged or isolated in the frame (Université Savoie Mont Blanc).
- Quebec: in Aubry v. Éditions Vice-Versa, the Supreme Court of Canada held that a photographer may take pictures in a public place but may not publish a person's image without their permission, except for people involved in a matter of public interest or who appear incidentally in the background (summary).
Practices we observe:
- A rights clause or photo release form in the RSVP or registration form. Three examples of wording, to adapt with your legal team:
- Example 1, a simple notice: "Photos and videos will be taken during the event and may be used in [Organizer]'s internal and external communications. If you prefer not to be photographed, please tell our team at check-in."
- Example 2, a defined scope: "[Organizer] may use photos in which you appear on its website, social media and event reports, worldwide, for three years. You can withdraw this authorization at any time by writing to [email]."
- Example 3, with facial recognition: "Photos will be taken during the event. If you wish, you can receive the photos in which you appear by scanning a QR code and taking a selfie. This optional step uses facial recognition. Your facial data is used only to find your photos and is deleted after [period]. [ ] I agree."
- Signage at the entrance saying that photos are being taken, how they will be used and who to contact, ideally with a simple way to opt out, such as a lanyard color or a badge sticker.
- Context matters. Depending on the jurisdiction, the rules differ between private and public events, between group shots and individual portraits, and between people who can be identified and people who cannot.
Data privacy
This topic cuts across the other two. In most jurisdictions around the world, a photo is personal data as soon as someone can be seen in it. A face in the frame is enough, even if the photo goes through no further processing.
That means you must be able to honor attendees' rights over their data: access, correction, deletion and the others the law provides.
You also need to know where the photos go. Which subcontractors handle them? What tool does your photographer use to collect, store and send them to you? Where are they hosted? How do you tell attendees how their photos are processed?
As a result, you cannot necessarily publish every photo on a public link or share the whole set with everyone. You may want to send each photo only to the people who appear in it, so the photos only reach the people concerned.
There are two ways to do that. You can sort and send them by hand, which is extremely time-consuming and impossible beyond a certain volume. Or you can use facial recognition, which more and more event photo platforms offer.
Facial recognition adds a further level of sensitivity. Almost everywhere, biometric data used to identify a person is treated as a special, sensitive category. The details vary from one law to the next, but the main ones converge:
Wherever your event takes place, the same frame applies. You need a legal basis, most often consent that is explicit, informed and recorded. You need to assess the risks before you start. And you need to show the processing is legitimate: proportionate, with safeguards and security measures. All these laws share the same approach: you cannot do whatever you want with this data, and it calls for vigilance.
One photo, three legal frameworks
As you can see, a photo is a single object where three legal frameworks collide: copyright, image rights and data privacy.
Guaranteeing compliant use of your photos is not always simple, especially since the rules change with how you use them and where you are in the world.
One thing is certain: your choice of provider is critical. Whether you capture photos for an archive or to create experiences that include your attendees, each photo is at once its author's work, your attendees' image and personal data. It calls for vigilance to keep processing compliant at a minimum, and respectful and pleasant for everyone involved.
Where MementoPhoto.ai stands
Since it was founded, Memento has taken a privacy-first approach to photography and helped event organizers manage their photos responsibly and compliantly in most jurisdictions across Europe and North America. With MementoPhoto.ai, we have worked with thousands of clients with high and demanding standards, from Fortune 500 companies such as Mastercard, to financial institutions such as Allianz and AXA, and public institutions. We can help you by sharing the best practices we have seen for the challenges that event photo management can raise.
Memento's best practices
Copyright: we plug into your photographer's workflow
Your photographer keeps their usual tools (Lightroom, Dropbox or FTP). We recommend listing every planned use in their brief and contract before the event, credit line included. When you need photographers, our network covers more than 50 countries.
Image rights: we recommend informing early
Mention photography in your registration form and on signage at the entrance. Give attendees who prefer not to be photographed a visible signal that your photographers know to respect.
Data privacy: photos are shared privately, never on a public link
Each attendee gets a private gallery with only the photos they appear in. Data is hosted exclusively in the European Union, and requests for access, correction or deletion can go to you or to our Data Protection Officer.
Facial recognition: always opt-in, always explained
Attendees choose to scan a QR code and take a selfie, with no app to install, after reading a notice on purpose, retention and deletion. Consents are recorded and traceable. Deleting their account erases their facial data immediately.
Subcontractors and retention: no surprises
Only the technical providers needed to run the service access the data, and the list is available on request. Photographers never access facial data, and no biometric data is sent to third-party AI providers. You set the retention period, and everything is deleted when it ends.
Compliance documentation: ready before your IT and legal teams ask
We provide a pre-filled data processing agreement, a data protection impact assessment and a one-page brief for your IT team. For US events, our setup follows Illinois (BIPA) and California (CCPA/CPRA) requirements.
Want to check your event photo setup with our team? Book a demo
See What Your Events Could Look Like
Turn every event into content that keeps working after it ends instant photo delivery,sponsor activation, and AI-powered organization, all in one platform.
Check out the article's FAQ
Who owns event photos?
In most countries, the copyright belongs to the photographer who took the photos, not to the organizer who paid for them, unless a contract says otherwise. What you can do with the photos depends on the rights the contract transfers or licenses to you, so list every planned use (website, social media, press, advertising, sponsors) and check that each one is covered.
Do I need consent to photograph attendees?
It depends on the jurisdiction and on how you use the photos. In France or Quebec, publishing a recognizable person's image generally requires their permission, and in the United States using someone's likeness for commercial purposes without permission is generally a violation. Common practice is a photo release clause in the registration form, signage at the entrance and a simple way for attendees to opt out.
Is facial recognition legal at events?
It can be, but almost everywhere biometric data used to identify a person is a sensitive category. Laws such as the GDPR, BIPA, CUBI, the CCPA/CPRA and Quebec's Law 25 generally require explicit, informed and recorded consent, a risk assessment before you start, and proportionate safeguards such as a defined retention period and deletion procedure.
