Can Businesses Take Photos Without Permission? Legal Risks And Rules

If you run a business, chances are you’ve taken photos for marketing at some point - product shots, team photos, customer events, before-and-after images, or even CCTV stills that help manage security.

But there’s a common and risky assumption many businesses make: “If it’s in public, or if it’s on my premises, I can take photos without permission.”

In Australia, the rules around taking photos without permission in Australia aren’t as straightforward as people think. The legal risk usually isn’t just about the act of taking the photo - it’s often about how that photo is used, whether it’s reasonably private, and whether your business is complying with privacy, surveillance, and consumer laws.

Below, we’ll break down what small businesses need to know, the biggest legal pitfalls, and practical steps you can implement right away to protect your brand and avoid complaints. This article is general information only and isn’t legal advice.

Is Taking Photos Without Permission Illegal In Australia?

In many situations, taking a photo without asking isn’t automatically illegal in Australia. However, that doesn’t mean it’s “safe” from a business perspective.

Whether your business can take photos without permission depends on:

• Where the photo is taken (public place vs private premises vs a workplace area like bathrooms or change rooms)
• What the photo shows (identifiable people, sensitive information, children, medical details, etc.)
• Why you’re taking it (security, marketing, record-keeping, internal training)
• How you use or publish it (website, ads, social media, internal use only)
• Which state or territory you’re in (surveillance and recording laws vary, and some laws regulate using cameras or optical surveillance devices in certain circumstances)

As a small business owner, the real risk usually comes from one of these issues:

• privacy complaints and investigations
• surveillance law breaches (especially if the photo comes from CCTV or another surveillance device)
• misleading advertising or unfair practices if the image is used in promotions
• workplace disputes if staff feel monitored or singled out
• reputation damage (even where the law is “grey”)

So the better question is often: “Can I use or publish this photo without permission?” Because publishing is where businesses get into trouble quickly.

Public Places Vs Private Premises: What’s The Difference For Businesses?

A good starting point is understanding the difference between taking photos in a public place and on private premises.

Taking Photos In Public

In Australia, taking photos in public spaces is often lawful. However, there are important exceptions and related laws that can still create risk (for example, state and territory surveillance/device laws, harassment or stalking laws, and situations where a person has a reasonable expectation of privacy).

From a business perspective, “lawful to take” also doesn’t always mean “low risk to use”. For example, if you take photos at a street market to post on your business Instagram, you may still run into problems if:

• people are clearly identifiable and it looks like they’re endorsing your business
• the image includes children
• the photo captures something sensitive (like someone in distress or a medical incident)
• you use the image in paid ads, promotions, or commercial materials

Even when the photo was taken in a public place, a person might object to your business using their image for marketing. If you can’t justify the use, it can quickly become a complaint (and a brand headache).

Taking Photos On Your Business Premises

If someone enters your store, studio, warehouse, office, or venue, that doesn’t automatically mean your business can freely photograph them for any purpose.

You can set conditions of entry (for example, “this event is being photographed”), but the conditions need to be communicated clearly, applied fairly, and can’t override laws that apply to your business (including privacy and surveillance rules). If someone doesn’t agree, your main remedy is usually to ask them not to enter or to leave (rather than forcing photography).

This is where having clear privacy notices and event signage matters, because they help show you were transparent about what you were doing.

High-Risk Areas: Bathrooms, Change Rooms And Other Private Spaces

Some locations are almost always “high risk” from both a legal and reputational perspective, including:

• bathrooms and toilets
• change rooms
• medical treatment rooms
• areas where someone would reasonably expect privacy

In these areas, taking photos (or having cameras) can create serious legal exposure. If you’re unsure whether a space counts as “private” under the relevant state or territory laws, it’s worth getting advice early.

Privacy Laws And Surveillance Rules: When Does A Photo Become “Personal Information”?

For businesses, the privacy question usually isn’t “can I take the photo?” - it’s “am I collecting personal information?” and “what am I allowed to do with it?”

A photo can become personal information if it identifies an individual (or makes them reasonably identifiable). That might include:

• their face
• distinctive tattoos
• their uniform name badge
• a car number plate (in some contexts)
• any context that links them to a particular incident (for example, “customer who stole from us”)

Whether the Privacy Act 1988 (Cth) applies to your business depends on factors like your turnover and what you do. Many small businesses are exempt, but there are important exceptions (for example, if you’re a health service provider, you trade in personal information, or you handle certain types of sensitive information). Even where an exemption applies, good privacy practice (and clear communication) can reduce complaints and reputational risk.

If your business is covered by the Privacy Act (or chooses to follow privacy best practice), you’ll typically need to think about:

• collection: are you being transparent about taking photos?
• purpose: why are you collecting the images?
• use and disclosure: are you sharing them publicly or with third parties?
• storage and security: where are the images stored, who has access, and how long do you keep them?

Many businesses cover this through a clear Privacy Policy and simple on-site or online notices that explain what images may be collected and why.

Also keep in mind that surveillance rules can apply where photos are taken via camera systems. In many states and territories, there are specific rules about surveillance devices (including CCTV), notice requirements, and how footage can be used or shared. If your question overlaps with workplace monitoring or security systems, it may help to look at the broader rules around CCTV laws and how they intersect with privacy expectations.

Using Photos For Marketing: The Biggest Legal Risks For Small Businesses

Most disputes involving taking photos without permission in Australia happen because the business uses the image in marketing.

Marketing use can include:

• posting on Instagram, Facebook, TikTok, LinkedIn
• website banners and testimonials
• flyers, brochures, posters
• Google Ads and Meta Ads
• email marketing campaigns

Here are the key legal risk areas to be aware of.

1. Misleading Or Deceptive Conduct (Australian Consumer Law)

If your marketing suggests someone endorses your business when they don’t, this can raise issues under the Australian Consumer Law (ACL).

For example:

• you post a photo of a customer leaving your salon with a caption implying they loved your service, but they didn’t agree to be featured
• you use a photo of someone at your venue in an ad that implies they are a regular or supporter

Even if the photo was taken lawfully, the way it’s presented can create a consumer law risk. It’s one reason businesses need to be careful about the context they add to photos.

2. Consent For Commercial Use (Practical Risk Even When Law Is Unclear)

Australia doesn’t have a single, universal “image rights” law that clearly says you must always get consent to use someone’s image commercially.

But from a small business risk perspective, consent is still the safest approach, because it reduces:

• complaints and takedown demands
• platform reports (which can impact your social media accounts)
• negative reviews and reputational damage
• allegations your advertising is misleading or unfair

In practice, a short written consent (even a simple form or email) can save a lot of time and stress later.

3. Extra Care With Children

Photos of children are a special risk area. Even when taken at a family-friendly venue or public event, parents or guardians may object strongly if children are featured online.

If your business interacts with children (for example, childcare, education, sports, parties, retail events), it’s wise to treat consent as essential and make sure you have a consistent process.

4. Capturing Confidential Information Or Trade Secrets

Sometimes the legal risk isn’t the people in the photo - it’s what’s in the background.

Examples include:

• whiteboards with strategy notes
• customer booking screens
• staff rosters
• payment terminals showing customer details
• contracts or project documents

Accidentally publishing sensitive information can trigger privacy issues and also weaken your business’s confidentiality protections.

5. Employee And Workplace Issues

If you photograph staff (or have cameras capturing staff), issues can arise around workplace monitoring, fairness, and trust.

A good starting point is ensuring your business has clear rules about workplace surveillance and acceptable conduct, supported by employment documentation like an Employment Contract and related workplace policies.

This helps make expectations clear: when photos may be taken, what they can be used for, and what’s not acceptable.

Practical Steps: How To Take And Use Photos Legally (And Respectfully)

If your business relies on photography - whether for marketing, events, proof of work, or security - you can reduce risk significantly by building a simple “photo compliance” process.

Here are practical steps that work well for many small businesses.

1. Be Clear About Purpose Before You Take The Photo

Ask yourself:

• Is this photo for internal records only, or will it be published?
• Does it show identifiable people?
• Could it embarrass or harm someone if it was shared?
• Does it include children?

If the image might be used publicly, treat that as a higher-risk category and move to consent.

2. Use Signage And Simple Notices

If you run events, workshops, or a venue where photography is likely, clear signage at entry is an easy win.

Your signage can explain:

• that photos and videos may be taken
• the purposes (eg marketing, social media, internal promotions)
• how guests can opt out (eg speak to staff, wear a wristband, or stand in a non-filming area)

This doesn’t replace consent in every situation, but it helps show transparency and reduces surprise.

3. Get Consent In Writing (Especially For Testimonials And Promotions)

When the photo is clearly focused on a person (or a small group), and you plan to use it in advertising, the safest approach is written consent.

This is particularly important for:

• before-and-after photos (beauty, health, fitness, trades)
• customer testimonials with photos
• case studies
• promotional “hero” shots used in ads

Consent can be as simple as a signed form, an email confirmation, or an online checkbox - as long as it’s clear what the person is agreeing to.

4. Don’t “Name And Shame” Customers Or Staff

It’s common for businesses to want to post CCTV stills of alleged shoplifters or bad behaviour.

This is a very high-risk strategy. Even if you feel justified, publicly identifying someone can expose your business to defamation risk and privacy complaints, and it can escalate matters quickly.

In most cases, it’s safer to report incidents to police and manage internal security rather than running a public campaign online.

5. Store Images Securely And Limit Access

If you store staff or customer photos, treat them like any other sensitive business record:

• limit access to staff who genuinely need it
• use password-protected systems
• avoid storing images on personal phones
• set a retention period (don’t keep images forever without a reason)

This is not only good privacy practice - it also reduces the impact if your systems are breached or a device is lost.

6. Put The Rules In Your Website Terms And Privacy Documents

If you run an online business, a booking website, or you collect images through forms or reviews, it’s worth ensuring your legal documents match what you actually do.

Depending on your setup, this might include:

• Website Terms and Conditions (covering how content is used and what users can expect)
• Privacy Policy (covering collection and use of personal information, which can include images)

Small mismatches - like saying you “don’t collect images” when you post identifiable customer content online - can create avoidable disputes.

What Legal Documents Can Help Protect Your Business When Taking Photos?

There isn’t a single “photo permission law document” that suits every business. But there are a few common documents that can make your approach much clearer and safer.

Here are options many small businesses consider, depending on how photography fits into their operations:

• Consent forms (photo/video releases): a straightforward written agreement allowing your business to use a person’s image for defined purposes (often essential for marketing and testimonials).
• Privacy Policy: sets expectations around how your business collects, uses, stores and shares personal information, including images where relevant.
• Website Terms and Conditions: helpful when users upload content, when you publish user-generated content, or where your business uses images as part of online marketing.
• Employment Contract: helps manage expectations about workplace policies, including photos at work events or internal promotions.
• Workplace policies: internal rules covering photography, social media use, and surveillance (especially important where staff may take photos during work or where workplace cameras operate).

Not every business needs all of the above. But if photos are central to your marketing (or you operate a venue, studio, clinic, or workplace with surveillance), it’s worth making sure your documents are consistent and fit your actual practices.

Key Takeaways

• Taking photos without permission in Australia isn’t always illegal, but the legal risk for businesses often comes from how the image is used, not just how it was captured.
• Even when photos are taken in public, using identifiable people in marketing can create disputes, privacy complaints, and potential issues under the Australian Consumer Law.
• Photos can be “personal information” if people are identifiable, which means privacy and secure storage practices matter (especially for CCTV and customer databases). Whether the Privacy Act applies depends on your business and any relevant exceptions to the small business exemption.
• High-risk areas like bathrooms and change rooms should be treated as off-limits for photography and surveillance unless you have very specific legal advice supporting it.
• Practical steps like clear signage, written consent, limited access to images, and consistent policies can significantly reduce risk.
• Having the right legal documents in place (such as a Privacy Policy, Website Terms and Conditions, and Employment Contract) helps set expectations and protect your business.

If you’d like help setting up consent wording, privacy documents, or workplace policies for photography and surveillance, you can reach us at 1800 730 617 or team@sprintlaw.com.au for a free, no-obligations chat.