Publishing Images Found on Social Media: GDPR Risks

Publishing images found on social media does not mean those images are free to use. A photo, video or screenshot showing an identified or identifiable person may be personal data. If it is used for informational, commercial or professional purposes, an appropriate legal basis is required.

What the Spanish Data Protection Authority says

The AEPD explains in its FAQs on internet and social networks that image publication may affect data protection rights. The fact that an image is available on a social network does not automatically authorise reuse on another website, campaign or corporate profile.

When problems may arise

• The image of a person is used without consent or another legal basis.
• The image is reused for a purpose different from the original one.
• Images of minors are published without appropriate authorisation.
• An image remains online after consent has been withdrawn.
• Social media screenshots are used for commercial or reputational purposes.

Media, companies and content creators

Media organisations may rely on freedom of information where public relevance, truthfulness and proportionality apply. But that does not cover every reuse of third-party images. Companies, agencies, schools, influencers and shops should carefully check whether they have sufficient authorisation.

Good practices before publishing

• Check who appears in the image and whether they are identifiable.
• Verify consent or another clear legal basis.
• Avoid reusing images of minors unless express authorisation exists.
• Limit the purpose, channel and publication period.
• Remove the image when rights are exercised unless there is a lawful reason to keep it.

Conclusion

An image published on social media is not a free resource. Before reusing third-party photos or videos, organisations should review consent, purpose, proportionality and the rights of the person concerned.

Frequently asked questions

Is an image public because it is on social media?

No. Being accessible online does not remove GDPR protection or the right to one’s own image.

Can the media publish it?

Only if it is newsworthy and proportionate to the information given. That requires a case-by-case balancing.

Can a company reuse a customer’s Instagram photo for marketing?

Only with the consent of the person who appears and the permission of the author of the photo.

What can the affected person do?

Ask the publisher to remove it and, if needed, complain to the AEPD, which runs a priority channel for sensitive content.