Photo of you online without permission: your rights and removal

A photo of you published online without permission can be removed under Dutch law through two separate routes: the portrait right (portretrecht) in Articles 20 and 21 of the Dutch Copyright Act (Auteurswet) and the right to erasure in Article 17 of the GDPR. The main exception: for a photo you did not commission, there is no general consent requirement, so publication is only unlawful if you have a reasonable interest that outweighs the publisher’s freedom of expression.

Neither route requires you to own the photograph. The copyright in the photo belongs to whoever took it. Below we explain what each route requires, in what order to use them, and when the matter becomes criminal.

¿Puede alguien publicar tu foto sin permiso?

Sometimes, but not always. Dutch law has no rule that every photo of you needs your consent; the answer depends on whether the photo was commissioned, what it shows and how it is used.

• Did you commission the portrait? Then under Article 20 Auteurswet the photographer may not publish it without your consent, unless agreed otherwise.
• Was the photo taken without your commission? Then under Article 21 Auteurswet publication is allowed unless your reasonable interest opposes it, for example privacy, a harmful context or advertising use.
• Did you take the photo yourself? Then you hold the copyright, and someone who posts it without a licence infringes your copyright.
• Is the image sexual or taken secretly in a private place? Then it is a criminal offence under Articles 254ba and 139f of the Dutch Criminal Code (Sr).
• Is the photo posted with personal details to intimidate you? Then it may be doxing, a criminal offence under Article 285d Sr.

What does the portrait right protect?

The portrait right lets you oppose publication of an image in which you are recognisable; it does not let you control every image of you. A portrait is any depiction in which you can be identified, by your face but also by posture, a tattoo, clothing or the context.

You do not have to be the main subject. Someone clearly identifiable in a group photo is portrayed just as much as the person in the centre. Under Article 20(2) Auteurswet, a commissioned group portrait needs the consent of everyone portrayed, and after death the consent of relatives for ten years.

Commissioned portraits: no consent, no publication

Where you ordered the portrait, for example from a wedding photographer or for a business profile, Article 20 Auteurswet prohibits the photographer from publishing it without your consent, unless your agreement says otherwise. Check the photographer’s terms: many include a clause allowing use in a portfolio.

Other portraits: the reasonable interest test

Street, event and press photos fall under Article 21 Auteurswet. Publication is then lawful unless a reasonable interest of the person portrayed opposes it. That is a balancing test, not a consent requirement, and it decides most disputes. Our article on the retrato a la derecha discusses the case law in more detail.

¿Qué se considera un interés razonable?

Dutch courts recognise two kinds: a privacy interest and, for people whose image has market value, a commercial interest. The court weighs your right to private life under Article 8 of the European Convention on Human Rights (ECHR) against the publisher’s freedom of expression under Article 10 ECHR.

A privacy interest exists where publication exposes your private life, places you in a damaging or misleading context, links you to something you have nothing to do with, or exposes you to harassment. A commercial interest applies to athletes, performers and others whose image is used to promote a product; they may claim a fee even where no privacy issue arises.

Factors the court considers are the nature of the image, the context of publication, whether you are a public figure, whether the publication contributes to a public debate, and how the image was obtained. A close-up of you at a demonstration used to illustrate an unrelated story is treated very differently from a crowd shot reporting on that demonstration.

How does the GDPR help you?

A photo of an identifiable person is personal data, so whoever publishes it needs a lawful basis under Article 6 GDPR, usually your consent or a legitimate interest that outweighs your rights. Consent can be withdrawn at any time.

The GDPR gives you concrete rights against the publisher. Article 17 GDPR gives a right to erasure, for example when you withdraw consent or successfully object. Article 21 GDPR lets you object to publication based on a legitimate interest; the publisher must then stop unless it shows compelling grounds. Article 15 GDPR lets you ask what is processed and where it came from. Under Article 12(3) GDPR such requests must be answered within one month, extendable by two months for complex requests.

Purely personal or household use falls outside the GDPR, for example photos kept for yourself or shared in a genuinely closed group. Posting to an open social media profile that anyone can see is not covered by that exemption. The portrait right applies in both cases.

Against companies and organisations you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP). The AP can investigate and enforce, but it does not award compensation; that is for the civil courts.

Who owns the copyright in a photo of you?

The photographer, not you. Under Article 1 Auteurswet copyright belongs to the maker, and it lasts until 70 years after the maker’s death.

This works against the person depicted. You may not repost or reuse a photo of yourself taken by someone else without the photographer’s permission, not even to complain about it. For a commissioned portrait, Article 19 Auteurswet does allow you to reproduce it yourself. Our article on Derechos de autor de las fotos covers the photographer’s side.

So when you send a takedown request, describe the photo and give the URL; do not attach it to a public post. Screenshots taken as evidence for your lawyer or a court are not a publication.

How do you get the photo removed?

Work in a fixed order: secure evidence, report to the platform or site owner, ask search engines to delist, and go to court only if that fails. Each step builds the file for the next one.

Paso 1: asegurar las pruebas

Before you contact anyone, take dated screenshots of the image, the page around it, the account that posted it and the URL, and note when you first saw it. A takedown request often leads to immediate deletion, and without screenshots you have nothing to show the preliminary relief judge if the photo reappears.

Step 2: report it to the platform

Under the Digital Services Act (Regulation (EU) 2022/2065), hosting services must offer a notice mechanism for illegal content, confirm receipt, decide carefully and give reasons. If your notice is rejected, online platforms must offer an internal complaints procedure, and you can take the dispute to a certified out-of-court dispute settlement body.

Write a notice that can be acted on: give the exact URL, state that you are the person depicted and did not consent, and explain in one sentence why publication is unlawful under the portrait right and the GDPR. Do not rely on copyright, which belongs to the photographer. In the Netherlands, the Autoriteit Consument & Markt (ACM) supervises platforms’ compliance with the DSA, and you can report a platform that ignores a valid notice.

Step 3: approach the poster, the website owner or the host

For an ordinary website, write to the site owner using the contact details in the imprint or privacy statement. Set out when you found the photo, where it is, that you did not consent, what you require, and a deadline of seven to fourteen days. Keep every message: in court, this correspondence proves both the infringement and the refusal to remedy it.

If the owner does not respond, notify the hosting provider. A host that is made aware of clearly unlawful content and does nothing can lose its liability exemption under the DSA, which is why a well-documented notice to a host often works.

Step 4: ask search engines to delist

Removal at the source does not clear search results. A separate request to the search engine, based on the right to erasure in Article 17 GDPR, can have the URL removed from searches on your name. If the search engine refuses, you can ask the AP to assess the refusal or go to the civil court. Delisting removes the search result, not the page itself.

When should you go to court, and what can you claim?

If voluntary removal fails, the usual route is summary proceedings (kort geding) before the preliminary relief judge of the district court. The judge can order removal, a ban on republication and a rectification, backed by a penalty payment (dwangsom) per day of non-compliance; you need a lawyer (advocaat) to bring the case.

Publication in breach of the portrait right or the GDPR is a wrongful act (onrechtmatige daad) under Article 6:162 of the Dutch Civil Code (BW), which is the basis for damages. Material loss, such as the licence fee that should have been paid for commercial use of your image, is recoverable if you can prove it.

Compensation for non-material loss is available under Article 6:106 BW where you have been harmed in your honour, reputation or person. Dutch courts set a high threshold and awards in privacy cases are modest. In practice, the removal order is usually worth more than the money. Court fees, bailiff costs and legal fees often exceed the damages you can realistically obtain, so check whether your legal expenses insurance covers privacy disputes.

When is it a criminal offence?

An ordinary photo posted by an acquaintance is rarely a police matter, but several situations are criminal offences under Dutch law.

• Publishing a portrait without being entitled to do so is a minor offence under Article 35 Auteurswet, punishable by a fine of the fourth category.
• Making a sexual image of someone without consent, or sharing one, is punishable under Article 254ba Sr, introduced by the Sexual Offences Act (Wet seksuele misdrijven) on 1 July 2024.
• Secretly photographing someone in a home or another private place with a hidden device is punishable under Article 139f Sr.
• Spreading someone’s personal data to intimidate them or cause serious nuisance (doxing) is punishable under Article 285d Sr, with up to two years’ imprisonment.

Where sexual images are involved, report to the police and contact Helpwanted, the helpline of the Offlimits foundation, which helps victims remove images across platforms. Never pay anyone who threatens publication. Our article on ciberacoso y daños a la reputación en línea covers the options where publication is part of a wider campaign, and our piece on suplantación de identidad y fraude por internet explains how to preserve evidence when an account impersonates you.

Which common assumptions are wrong?

Three misconceptions cause most disputes. Each one is answered by Article 21 Auteurswet and its reasonable interest test.

• “Photography in public is unrestricted.” Taking the photo is generally lawful, but publication is regulated, on the street as anywhere else. A photo taken through your window is treated differently from one taken at a demonstration you chose to attend.
• “Non-commercial use is always allowed.” A private social media post can breach the portrait right; commercial use only raises what you can claim.
• “Attending an event means consent.” It makes it harder to object to a general crowd photo used to report on the event, but it does not allow a close-up of you to be used in advertising or for an unrelated story.

What should you check as the person in the photo?

Most problems are found by looking, and the GDPR’s one-month response period only starts once you send a request.

• Search your name, earlier names and usernames on more than one search engine, and run a reverse image search on photos you know about.
• Check whether the photo was commissioned (Article 20 Auteurswet) or not (Article 21 Auteurswet).
• Restrict who can see and tag you on social media, and remove connected apps you no longer use.
• If you have ever modelled, check whether a model release exists; without one a stock library cannot license your image for advertising.
• Keep dated screenshots and copies of every takedown request and reply.

What should you check as a publisher or organisation?

If you photograph staff, customers or visitors, you need a lawful basis under Article 6 GDPR before you publish.

• Decide in advance whether you rely on consent or legitimate interest, and document the assessment.
• Tell people what the images will be used for, and record consent where you rely on it.
• Make withdrawal of consent genuinely possible and act on it promptly.
• Remove photos of former employees from your website within a reasonable period after they leave.
• Answer access and erasure requests within one month (Article 12(3) GDPR). Our Orientación sobre las declaraciones de privacidad según la legislación neerlandesa. explains how to document these choices.

What can we do for you with a photo published without permission?

Nuestros Abogados especializados en tecnología informática y privacidad act for people whose image has been published and for organisations that want to publish photos lawfully:

• We assess whether the publication breaches the portrait right, the GDPR or criminal law.
• We draft takedown demands and DSA notices to platforms and hosting providers.
• We send erasure, objection and delisting requests under the GDPR and follow up on the one-month deadline.
• We bring summary proceedings for removal, a ban on republication and rectification.
• We calculate and claim damages, including a licence fee for commercial use of your image.
• We review an organisation’s photo and consent policy against the GDPR.

Resumen

• A commissioned portrait may not be published without your consent (Article 20 Auteurswet); other portraits only if no reasonable interest of yours opposes it (Article 21 Auteurswet).
• A photo of you is personal data: you can object and ask for erasure under Articles 17 and 21 GDPR, with an answer due within one month.
• The copyright belongs to the photographer, not to the person depicted.
• Secure evidence first, then report to the platform, the site owner or host and the search engine; summary proceedings are the last step.
• Sexual images without consent and doxing are criminal offences (Articles 254ba and 285d Sr).

Looking for related topics? Our Índice de guías sobre legislación holandesa en materia de tecnología de la información y privacidad. lists all our articles on this subject.

Preguntas frecuentes