Posting photos is a big part of modern marketing. Whether you’re running a café, a gym, a salon, a tradie business, an online store, or a growing company with a social media team, photos can help you build trust, show what you do, and connect with customers.
But there’s a common trap: assuming that because you took the photo (or because it’s “just for Instagram”), you can use it however you like.
In Australia, there isn’t one simple “social media photo law” that covers every situation. Instead, the rules and risks around posting pictures without consent can come from several different legal areas - privacy, surveillance, copyright, consumer law, defamation, discrimination, harassment, and even contract law.
If you get it wrong, the consequences can be more than an awkward DM asking you to take a post down. You could face complaints, legal claims, takedown requests, regulatory attention, or reputational damage that is hard to undo.
Below, we’ll break down how Australian law approaches posting photos without consent, what risks matter most for small businesses, and the practical steps you can put in place to protect your brand.
This article is general information only and doesn’t constitute legal advice. If you need advice on your specific situation (including which state/territory laws apply), get in touch with a lawyer.
Is There A Specific “Law Against Posting Pictures Without Consent” In Australia?
This is usually the first question business owners ask, and it’s an important one.
In most situations, Australia doesn’t have one single, standalone rule called “the law against posting pictures without consent”. Instead, whether posting photos without consent is unlawful (or commercially risky) depends on:
- who is in the image (customer, employee, child, member of the public)
- where the image was taken (public space vs inside your premises vs a private area like a change room)
- how the image is used (a casual story vs a paid ad vs a testimonial vs internal training)
- what you say alongside the image (captions can create separate legal issues)
- what consent you have (written, verbal, implied, or none)
So, when people talk about “the law against posting pictures without consent”, they’re usually referring to a bundle of overlapping legal and reputational risks that can apply at the same time.
As a practical approach: if the photo could reasonably affect someone’s privacy, safety, reputation, employment, or commercial rights, you should treat it as higher risk and consider getting clear permission before posting.
When Is Posting Photos Without Consent Most Risky For Businesses?
Not every photo is equally risky. For example, a wide shot of your shopfront with no identifiable faces is usually low risk. But the risk increases quickly when people are identifiable, the photo is personal, or the use is promotional.
Here are the most common business scenarios where posting photos without consent can cause problems.
1. Using Customer Photos In Marketing (Especially Ads)
If you post a customer’s face alongside a promotion, testimonial, or “before and after” result, you’re using their image to market your business.
Even if the customer seemed happy at the time, marketing use is where complaints most often turn into legal disputes - because it can feel like an endorsement, and because the post can be shared widely.
Getting a signed Consent Form (or a well-designed written consent process) is one of the simplest ways to reduce risk.
2. Photos Taken In Private Or Sensitive Areas
Images taken in or around private areas can raise serious legal issues. For example:
- change rooms or bathrooms
- medical treatment rooms
- back-of-house staff areas
- customer homes (for in-home services)
Even if you didn’t intend harm, this is where privacy and surveillance-related laws can come into play. Keep in mind these rules can vary depending on your state or territory and the exact circumstances (including whether audio is recorded). If you’re unsure about boundaries, it’s worth reading up on photography consent laws in a business context.
3. Photos Of Employees Or Contractors
Many small businesses post team photos, staff spotlights, “day in the life” content, and behind-the-scenes footage.
This is generally fine when everyone is on board - but it becomes risky when:
- the employee has not agreed to be featured
- the image reveals personal information (name badges, rosters, medical details, location)
- the photo is used after they leave your business
- the image is used in a way that could embarrass or disadvantage them
Even where it’s not strictly illegal, the business risk is real: it can lead to workplace complaints, disputes, or claims that you failed to provide a safe working environment.
If you use cameras at your premises (including for security), make sure you’re also across workplace camera laws, because recording for security/safety and then reusing footage for marketing can raise different issues.
4. Children And Vulnerable People
Photos of children require extra care. This is common for childcare, tutoring, sports clubs, family-friendly venues, and community organisations.
There isn’t a single Australia-wide rule that always requires written consent in every scenario. However, as a business, getting written consent from a parent or guardian is often the safest approach, especially where images will be used for marketing or published publicly. It also helps to set clear limits on how and where images will be used (website, socials, print, paid ads, etc.).
What Laws Can Apply To Posting Photos Without Consent In Australia?
Depending on what’s happening in the photo and how you use it, several laws may apply at once. Here are the most common ones for businesses.
Privacy law can become relevant when a photo identifies a person, especially if it links to other details (name, location, health information, workplace, or customer status).
Not every small business is automatically covered by the Privacy Act 1988 (Cth), and whether it applies can depend on factors like your turnover and what information you handle. That said, privacy obligations can still arise in practice - for example through contracts, platform rules, customer expectations, and other laws.
If you collect and use images of customers (or even user-generated content), it’s usually wise to have a clear Privacy Policy that explains what you collect, why you collect it, and how people can contact you about complaints or removal requests.
Surveillance And Recording Laws (State-Based)
Surveillance and recording laws differ across Australian states and territories, and they can affect:
- how you record images (especially where audio is involved)
- whether people must be notified
- whether recording in certain places is restricted
If your “photo” is actually pulled from video or CCTV footage, you should be particularly careful. In some jurisdictions, different rules apply to recording in a “private” place, and audio recording can trigger additional requirements. A good starting point is understanding CCTV laws and how notice and consent concepts apply in a commercial setting.
Copyright (Who Owns The Photo?)
A separate issue - and one businesses often miss - is that the person in the photo is not automatically the person who “owns” the photo.
Copyright generally sits with the photographer (or the business, if it was taken by an employee in the course of employment), unless a contract says otherwise.
That means you can run into legal trouble even if the person in the photo is happy, if you don’t have the rights to use the image (for example, you repost a professional photographer’s content without permission, or you use a contractor’s photos beyond what was agreed).
If you’re commissioning content, contracts and releases matter. Depending on the shoot, you might use a Model Release Form and/or a written agreement covering image ownership and usage rights.
Australian Consumer Law (Misleading Or Deceptive Conduct)
If you use someone’s image in a way that implies they endorse your business (or achieved a certain result), Australian Consumer Law (ACL) issues can arise.
For example:
- posting “before and after” images without a genuine, provable connection to the claim in the caption
- using a customer’s photo in an ad that suggests they recommend your services
- reposting influencer-style content without a clear agreement, then using it as paid advertising
Even if your intention was simply to show your work, the overall impression matters.
Defamation And Harmful Captions
A photo on its own might be harmless, but captions can create risk quickly.
If a post identifies a person and implies something damaging about them (even indirectly), you could face defamation risk. This is especially relevant in “naming and shaming” posts about customer disputes, unpaid invoices, banned customers, or negative reviews.
As a general rule, avoid turning disputes into social media content - it rarely ends well for a business.
Workplace Law, Discrimination And Harassment Risks
Posting staff photos without consent can create workplace issues, particularly if an employee feels targeted, embarrassed, or exposed.
Risk increases if the image is linked to:
- a joke at someone’s expense
- a personal attribute (health, religion, disability, pregnancy, etc.)
- discipline, termination, or performance concerns
Even where a strict privacy law claim isn’t available, you still need to manage the employment relationship carefully and provide a safe workplace culture.
How Can Your Business Get Consent The Right Way (Without Killing Your Marketing)?
Consent doesn’t need to be complicated - but it does need to be clear and match what you actually plan to do with the images.
Here are practical options that work well for small businesses.
If you plan to use images in:
- paid ads
- your website homepage
- printed flyers or signage
- case studies or testimonials
- before-and-after galleries
… written consent is strongly recommended.
This is where a tailored Location Release Form (for private premises) or an image consent document can help, because it sets expectations and reduces “but I didn’t agree to that” misunderstandings.
2. Make Consent Specific (What, Where, How Long)
“Consent” is much stronger when it covers details like:
- Where you can post (Instagram, TikTok, website, print, email marketing)
- Purpose (general brand marketing, promoting a specific product/service, recruitment, internal training)
- Time period (e.g. 12 months, ongoing until withdrawn)
- Editing (cropping, filters, adding text overlays)
- Withdrawal (how someone can ask you to remove the image later)
This is the difference between a safe marketing asset and a future dispute.
3. Don’t Rely On Silence Or Assumptions
A common mistake is thinking:
- “They saw us taking photos, so they must have agreed.”
- “They didn’t complain, so it’s fine.”
- “It was in public, so we can do what we want.”
Those assumptions are exactly what lead to complaints. If someone is identifiable and the image is used for your business promotion, the safer approach is to get explicit permission.
4. Build A Simple “Takedown Request” Process
Even with consent, people’s circumstances change. They might change jobs, leave a relationship, have safety concerns, or simply become uncomfortable with their image being online.
It helps to have a process, such as:
- a dedicated email address for content/privacy queries
- a standard response timeframe (e.g. within 2 business days)
- internal rules about when you’ll remove content without debate (often the best move)
This is mainly a practical risk-management and customer service step. While you won’t always have a strict legal obligation to remove an image immediately, having a clear and reasonable process can help you handle issues quickly and reduce escalation.
What Policies And Legal Documents Help Protect Your Business?
Consent is a big part of the picture, but it’s not the only one. Your contracts and policies can make a huge difference to how confidently you can create and publish content.
Depending on your business model, here are documents worth considering.
- Photography/Video Consent Form: This sets out permission to use images for your marketing and is especially useful for testimonials, before-and-after images, events, and client features.
- Employment Contract: If staff will be involved in content creation or appear in marketing, it can help to deal with expectations upfront in an Employment Contract (for example, whether appearing in content is voluntary and what happens after employment ends).
- Privacy Policy: Useful where images are treated as personal information, or where you collect user-generated content or run competitions. A clear Privacy Policy also supports good complaint handling.
- Website Terms And Conditions: If users can upload reviews, photos, or comments, your Website Terms and Conditions can help set rules around what content is allowed and how you’ll respond to complaints.
- Contractor/Creative Agreements: If a photographer, videographer, or marketing contractor creates content for you, a clear agreement helps define who owns the content and what usage rights you have (including for future campaigns).
Not every business needs every document, but having the right set for your operations can significantly reduce the risk around posting photos without consent.
Key Takeaways
- In Australia, the legal risk around posting pictures without consent usually comes from multiple areas of law (privacy, surveillance, copyright, consumer law, defamation, and workplace obligations), not a single rule.
- Posting photos without consent is highest risk when people are identifiable and the image is used for marketing, endorsements, before-and-after promotions, or content involving employees, children, or private locations.
- Consent should be clear and, for promotional use, it’s often best to get it in writing. Ideally, it should cover where the content will be used, the purpose, how long it will be used for, and how removal requests are handled.
- Copyright is a separate issue: even if someone agrees to be photographed, you still need the right to use the image (especially if a photographer or contractor created it).
- Strong documents and policies (like a Privacy Policy, Website Terms, and consent forms) can protect your business and make marketing smoother.
- If you’re unsure whether a post crosses the line, it’s usually cheaper (and better for your reputation) to pause, check, and get the right consent first.
If you’d like help setting up your consent forms, privacy documents, or contracts so you can market your business confidently, you can reach us at 1800 730 617 or team@sprintlaw.com.au for a free, no-obligations chat.
