Approve Customer Photos Before Using Them in Local Marketing

A customer sending a photograph to a shop does not automatically mean the business can publish it everywhere. The image may show a child, a vehicle registration plate, a medical setting, a private home, or another person who never agreed to appear in an advertisement. A simple “photo received” status is therefore not a permission record.

Small businesses need a repeatable approval path that distinguishes the right to possess a file from the right to use it in a particular context. The process described here is an operational control, not legal advice. Where the image involves children, health services, sensitive circumstances, paid advertising or unclear ownership, obtain appropriate professional guidance before use.

Capture the intended use at the start

When a customer offers a photo, record where they expect it to appear: a review response, a website gallery, an organic social post, a printed brochure, a paid campaign, or a business profile. Those uses are not interchangeable. Someone may be comfortable with a one-time social mention but not with their image becoming a recurring advertisement.

The request should describe the proposed use in plain language. Avoid a vague statement such as “we may use this for marketing” if the business expects to crop the photo, add a promotional claim, run paid ads, or reuse it for years. Record the approved channels, whether editing is planned, any expiry date, and how the person can ask a contact to review or withdraw future use where applicable.

Check ownership and other people in the frame

Ask who took the photograph and whether the sender has authority to grant the proposed permission. A customer may have downloaded a picture from another creator or forwarded a photo taken by a friend. Permission from the person pictured does not necessarily settle copyright ownership; permission from the photographer does not automatically resolve privacy concerns for everyone visible.

Review the frame before publication. Remove unnecessary personal details where appropriate, and do not expose receipts, phone screens, addresses, vehicle plates or appointment information simply because they are in the background. For clinics, salons and other settings where the image can reveal sensitive circumstances, use a much stricter review path.

Use a status that reflects the evidence

A practical asset register can use four states: received, permission pending, approved for named uses, and retired. Avoid an ambiguous “approved” label with no scope. A photograph cleared for a testimonial page should not silently migrate into a paid campaign because another employee finds it in a shared folder.

Field	Why it matters
Asset identifier	Connects the record to the exact image file
Photographer or source	Helps establish who supplied the work
Permission evidence	Records the approval and its scope
Approved channels	Prevents use beyond the agreed context
Sensitive details checked	Captures privacy review without unnecessary personal notes
Review or expiry date	Prompts reassessment of long-running use
Withdrawal status	Stops future publishing when permission changes

Limit access to permission records. A marketing assistant needs to know whether an asset is cleared, not necessarily to see unrelated personal correspondence.

Avoid changing the meaning of the image

Editing can turn a harmless image into a misleading endorsement. Adding a discount sticker, claim about results, or before-and-after framing may imply that the person supports a promise they never approved. Keep the original file, record material edits, and send the altered version for review when the context changes significantly.

Do not fabricate customer experiences or make a staged scene appear to be spontaneous evidence. If an image is illustrative rather than a real customer situation, label it accurately where that distinction could affect interpretation. For profile uploads, follow the platform’s current photo guidance; technical acceptance by a platform is not a substitute for permission or truthful presentation.

Build a withdrawal path

A permission process is incomplete if nobody knows what to do when a person asks for removal. Identify the person who receives the request, the locations where the image was published, the person who can remove it, and the expected confirmation step.

Keep a record of actions taken rather than retaining more personal information than necessary. Check scheduled posts, shared creative libraries and paid campaigns as well as the original page. Mark the asset as retired so it is not accidentally reused months later by someone who never saw the original request.

Hypothetical example: a furniture showroom

A buyer sends a photograph of a newly delivered sofa in their living room. The showroom wants to share it on social media. Before posting, the team confirms who took the photo, asks permission for the intended channel, checks whether family members or private details appear, and agrees on a caption that does not imply a paid endorsement. The record identifies the approved file and channel.

Sources

• Google Business Profile photo guidance
• Ministry of Electronics and Information Technology: Data Protection Framework