Portrait Rights in Australia: Using Employee and Customer Photos Legally

If you run a small business, you’ve probably relied on photos to market what you do. A team headshot on your website, a “meet the crew” post on social media, customer testimonials with before-and-after shots, or candid images from an event can all build trust quickly.

But there’s a legal catch: just because you took the photo (or paid for it) doesn’t automatically mean you can use it however you want.

In Australia, “portrait rights” is the term many people use to describe the legal rights and risks around using someone’s image, face, or likeness. And for small businesses, portrait rights issues most commonly pop up when you use photos of employees, contractors, customers, or members of the public in your marketing.

Below, we’ll break down how portrait rights work in Australia (in plain English), what legal risks small businesses should watch for, and the practical steps you can take to use photos safely and confidently.

What Are “Portrait Rights” In Australia (And Do They Actually Exist)?

“Portrait rights” isn’t a single, standalone legal right in Australia in the way people sometimes assume. In some countries, there’s a clearer “right of publicity” or a specific “image right”. Australia doesn’t have one simple law that covers everything.

Instead, portrait rights is a useful umbrella term for a few different legal areas that can apply when you use someone’s image:

• Consent and privacy expectations (especially where the photo is sensitive or taken in a private setting)
• Australian Consumer Law (ACL) issues such as misleading or deceptive conduct (for example, implying a person endorses your business)
• Defamation risks if the use of the image conveys something damaging or false
• Copyright (usually owned by the photographer, not the person in the photo)
• Employment law considerations where the person is your employee and the image is used in workplace-related material

So when business owners ask, “Do I need permission to use someone’s photo?”, the real answer is: it depends on how you’re using it, who is in it, and what impression the use creates.

Why Portrait Rights Matter For Small Businesses Using Photos In Marketing

For small businesses, portrait rights problems rarely begin as a “big lawsuit situation”. More often, it starts with a complaint like:

• “I didn’t agree to be used in your ad.”
• “I’m no longer your employee and I want that removed.”
• “Your post makes it look like I endorse your business.”
• “That photo includes my child.”

Even if you believe you’re in the right, these complaints can still cost time, money, and reputational goodwill to resolve. They can also escalate to formal disputes if they involve alleged privacy breaches, bullying/harassment contexts, or misleading advertising.

From a risk management perspective, it’s usually cheaper and easier to set up your consent process early than to fix it after the post goes live.

Do You Need Consent To Use Employee Or Customer Photos?

Consent is the practical foundation for managing portrait rights risk. You don’t want to rely on assumptions like “they smiled at the camera” or “they were at our event so it must be fine”.

Here’s a workable way to think about consent in a small business setting.

Employee Photos

If you’re using employee photos for business purposes (website bios, social media, internal comms, brochures), you should get clear consent.

Even where the use feels “normal”, employees can feel pressured to say yes if consent isn’t handled carefully. This is why it’s best to:

• Ask for consent in writing (not just verbally)
• Explain where the images might appear (website, social media, paid ads, print material)
• Explain whether the consent is ongoing and how an employee can withdraw it

If your employee documentation is already being updated, this is often a good time to align your photo consent approach with your broader workplace documents, like an Employment Contract and a clear staff policy on marketing content.

Customer Photos

Customer photos are high-impact marketing, but they also carry higher risk, because customers aren’t part of your business and may be more protective of their image.

As a general rule, you should obtain consent (preferably written) before using a customer’s image in:

• Testimonials
• Before-and-after photos
• Case studies
• Social media promotions
• Website galleries and paid advertising

If the photo involves sensitive context (for example, health-related services, counselling services, cosmetic procedures, or anything that could expose personal information), it’s even more important to get explicit, informed consent and store it properly.

If you’re collecting and keeping customer consent records (names, email addresses, signed forms), make sure your privacy settings and documents keep pace. For many businesses, that includes having a Privacy Policy that matches what you do in practice.

What About “Implied Consent”?

Implied consent is where someone’s behaviour suggests they’re okay with something (for example, they pose for a photo at an event).

Implied consent is risky for marketing use because it’s often unclear:

• what the person believed they were agreeing to, and
• whether they understood it could be used publicly (and potentially boosted as an ad).

If your marketing matters (and it does), it’s worth getting express consent so you’re not guessing later.

Key Legal Risks: Privacy, Misleading Endorsements, Defamation, And Copyright

Portrait rights issues usually map back to a small set of legal risks. If you understand these, you’ll spot problems early.

1) Privacy And Personal Information

In many cases, a photo is personal information because it can identify an individual.

If your business is covered by the Privacy Act 1988 (Cth) (for example, because you’re an “APP entity”), you’ll generally need to comply with the Australian Privacy Principles (APPs) when you collect, store and use photos that identify someone. While many small businesses may rely on the small business exemption, there are important exceptions and triggers (including for some health-related businesses and other specific activities), and privacy expectations can still apply even where the Act doesn’t.

Common privacy red flags include:

• sharing images that reveal sensitive information (health, disability, religious beliefs, etc.)
• using images of minors without a parent/guardian consent process
• publishing images taken in a context where someone reasonably expected privacy (for example, staff-only areas, behind the counter, private appointment spaces)

Even if you’re a small business that isn’t required to comply with the Privacy Act in every circumstance, it’s still smart to treat consent and image-handling seriously. Clear consent, clear storage practices, and clear customer-facing documentation help reduce complaints.

2) Misleading Or Deceptive Conduct (Australian Consumer Law)

One of the biggest portrait rights traps for businesses is accidentally implying an endorsement.

For example, using a customer’s photo next to text like “Our clients love us” might be fine if they agreed. But using an influencer-style headshot of a person in an ad could suggest they personally recommend your product or service.

This is where the Australian Consumer Law can bite. If your marketing creates a misleading impression, you can face complaints or action even if you didn’t mean to mislead.

Importantly, even if you have consent to use a photo, you still need to be careful about the overall impression your ad creates (including any claims, captions, and placement of the image).

3) Defamation And Context Risks

A photo can become risky because of the context you publish it in.

Defamation risk can arise where:

• the photo is used alongside words that imply misconduct, dishonesty, incompetence, or other damaging traits
• the person is identifiable, even if not named
• the post is shared publicly (including community groups)

Even well-intended posts can be misread. For example, a “customer banned” post that includes CCTV or a customer photo can quickly become a legal headache.

If you’re dealing with complaints, difficult customers, or incidents, it’s often safer to keep communications factual, minimal, and private, rather than naming/shaming with images.

4) Copyright: Owning The Photo Versus Having Permission To Use It

This is a big one: the person in the photo usually does not own copyright in the photo.

Copyright typically belongs to the photographer, unless an exception applies or it’s assigned in writing. For example, where an employee takes photos in the course of their employment, the employer will usually own copyright. If you commission a freelance photographer, ownership and usage rights will depend on your contract (often the photographer owns copyright and grants you a licence, unless copyright is assigned to you).

That means you can have two separate issues at once:

• Image/portrait rights issue: do you have the person’s consent to use their likeness?
• Copyright issue: do you have the photographer’s permission to use the photo?

If you hire a professional photographer for staff headshots or a brand shoot, make sure your agreement covers the usage rights you need (website, social media, paid ads, print, editing, cropping, etc.). If you’re unsure, it’s better to clarify up front than to find out later you can’t use the images the way you planned.

A Practical Consent Process (That Won’t Slow Your Business Down)

Most small businesses don’t need an overly complex system. What you need is something consistent, easy to follow, and easy to prove later.

Step 1: Decide What You’re Actually Using Photos For

Start by listing your typical use cases:

• website team page
• LinkedIn and “meet the team” posts
• testimonials and case studies
• before-and-after galleries
• paid ads (Meta/Google)
• print flyers or signage

This helps you write a consent statement that matches reality.

Step 2: Use A Simple Written Consent Form

A good consent form (or clause) typically covers:

• who is giving consent (name and contact details)
• what is being used (photo/video, specific shoot or ongoing content)
• where it may appear (channels and platforms)
• whether it can be edited (cropping, filters, text overlays)
• how long consent lasts
• how consent can be withdrawn (and what happens after withdrawal)

If you’re collecting customer images through a website form, booking form, or online sign-up flow, your written consent approach should align with your online terms. Depending on your setup, that can include Website Terms & Conditions that reflect your content rules and permissions.

Step 3: Store Consent Records Properly

If someone later asks you to take a photo down, you’ll want to quickly find:

• the consent record
• the date it was provided
• what it covered

This can be as simple as storing signed PDFs in a secure folder, or tagging consent emails in your CRM.

Step 4: Make Withdrawal Requests Easy To Handle

Even with consent, people’s circumstances change. An employee leaves. A customer becomes uncomfortable. A person involved in a project wants a lower profile.

Plan for this and decide internally:

• who receives requests
• how quickly you respond
• whether you remove the content everywhere or only in certain channels
• how you handle printed materials already distributed

It’s also worth setting expectations: withdrawing consent can be managed going forward (for example, taking down posts you control and stopping future use), but it may not be practical to “undo” past distribution in every case (such as printed materials already circulated, third-party resharing, or cached copies). Being clear about this in your consent wording helps avoid misunderstandings.

Being calm and organised here protects your brand and keeps disputes from escalating.

What Legal Documents Should You Have In Place To Manage Portrait Rights?

Portrait rights compliance is often less about one perfect “photo law” and more about having the right documents and processes that support what you’re doing day-to-day.

Depending on your business model, it may be worth having (or updating) the following:

• Consent form (photo/video release): your main tool for obtaining and proving permission to use someone’s likeness in marketing.
• Privacy Policy: helps explain how you collect, store, and use personal information (which can include identifiable images). This should match what you actually do in your marketing and record-keeping. A suitable Privacy Policy is a common baseline document for many businesses with an online presence.
• Website Terms & Conditions: particularly useful where customers upload content, participate in promotions, or interact with your brand online. Clear Website Terms & Conditions can reduce disputes about what content can be used and what behaviour is permitted on your site.
• Employment contract and workplace policies: useful if you regularly photograph staff for marketing and need a consistent expectation-setting process, starting with an Employment Contract and supported by internal policy guidance.
• Customer contract or service terms: if you provide services where images are a key part of the deliverable (for example, photography, beauty, home services, events), your service terms should explain how images are used and who can publish them.

Not every business needs every document. The right mix depends on how you market and how you collect and store content.

If you’re unsure, it’s usually better to set up a simple, tailored system early rather than patching together different templates later (especially if your content becomes a core growth channel).

Key Takeaways

• Portrait rights in Australia aren’t one single law, but a mix of consent, privacy expectations, Australian Consumer Law, defamation risk, and copyright issues.
• If you use employee or customer photos for marketing, getting clear written consent is one of the simplest ways to reduce risk and avoid disputes.
• Even with consent, make sure your marketing doesn’t create a misleading impression (for example, implying endorsement) and doesn’t put someone in a defamatory context.
• Remember that copyright usually belongs to the photographer (unless an exception applies or there’s a written assignment), so you may need permission to use the photo even if the person pictured is happy for you to post it.
• A practical portrait rights process includes: defining use cases, using a simple consent form, storing records, and having a plan for handling withdrawals (including setting expectations about past distribution).
• Helpful supporting documents can include a Privacy Policy, Website Terms & Conditions, and workplace documents like an Employment Contract, depending on how your business operates.

If you’d like a consultation on portrait rights and using employee or customer photos safely in your marketing, you can reach us at 1800 730 617 or team@sprintlaw.com.au for a free, no-obligations chat.