Using Customer Photos in Marketing in New Zealand

Customer photos can make marketing feel real, but using them without a clear consent process can create privacy, advertising and brand trust problems. Common mistakes include assuming a tagged social media post is permission, using a before-and-after image beyond the original campaign, or posting a photo of a child because a parent was present at the appointment.

For New Zealand businesses, the safer approach is to treat customer images as both marketing content and potentially personal information. You need to know when consent is required, what your release form should say, and how to handle testimonials, social media reposts, minors and sensitive situations.

A practical consent workflow lets your team move quickly without guessing. It also gives customers control over how their image, name and story will be used, which usually leads to better marketing and fewer complaints.

Customer Photo Consent Checklist for New Zealand Businesses

A business should get clear, specific and recorded consent before using an identifiable customer photo in marketing. A casual yes during a busy appointment is rarely enough if the image will later appear on Instagram, your website, paid ads or printed materials.

Customer image consent is most relevant where the person can be identified from their face, body, name, social media handle, voice, location or story. A close-up of a tattoo, smile makeover, fitness transformation, hair colour result, event attendee or client using your product may all identify someone, even if their full name is not shown.

Use a simple consent workflow that your staff can follow at the exact moment photos are collected or selected for marketing.

1. Decide the purpose first: Be clear whether the photo is for internal records, customer service, your portfolio, organic social media, paid advertising, website content, email marketing, case studies or all of these.
2. Ask for active consent: Use an opt-in checkbox, signed form, digital approval or written message. Do not rely on silence or a broad statement hidden in standard terms for high-visibility promotional use.
3. Explain where the image may appear: List channels such as your website, Instagram, Facebook, TikTok, Google Business Profile, brochures, email newsletters, in-store screens and advertising campaigns.
4. Cover the content around the image: If you plan to use the customer name, testimonial, location, before-and-after comparison or health, beauty or fitness outcome, include that in the consent.
5. Set sensible boundaries: State whether the consent is ongoing, campaign-specific, limited to certain platforms, or able to be withdrawn for future use.
6. Store the record: Keep the consent form, email, SMS confirmation or booking-system consent record with the photo file or customer record.
7. Review before reuse: Check the release before turning an old image into a new ad, franchise brochure, investor deck or influencer campaign.

For example, a beauty clinic may photograph a client after treatment for clinical records. That is different from using the same image in a sponsored social media advertisement that promotes the treatment. The customer may be comfortable with one purpose but not the other.

A small business can usually build this into its normal operations. A hair salon might add a photo permission step to the checkout process. A gym might collect written participant consent before filming transformation content. A childcare provider should have a more careful parent or guardian approval process and a strict internal rule on where images of children can be published.

How the Privacy Act Applies to Photos in Marketing

Under the Privacy Act 2020, a photo can be personal information if it identifies, or can reasonably identify, an individual. That means a marketing photo is not just creative content. It may also be information about a customer that your business collects, uses, stores and discloses.

The Privacy Act does not ban businesses from using customer photos in marketing. It expects organisations to collect personal information for a lawful purpose, be transparent about the purpose, use the information for the purpose it was collected for, keep it secure, and allow people to access and correct information about them where the Act applies.

In practice, the privacy issue usually starts before the photo is posted. It starts when your business takes, receives or saves the image. If your team asks a customer to pose, takes a photo at your premises, saves a screenshot of a customer tag, or downloads an image from a review, you should be clear about why you are collecting it and how it will be used.

Consent is one of the most practical ways to manage the Privacy Act risk, especially for promotional use. A customer who agrees to a staff member taking a photo for their file has not necessarily agreed to that image being used in a national advertising campaign. A customer who tags your cafe in a story has not necessarily agreed to your business using their image in paid ads for the next two years.

Your privacy policy and privacy consent wording should support your photo process. It can explain that your business may collect images, video, names, feedback and social media content where customers provide it or consent to it. It should also describe the types of marketing use, who the information may be shared with, how customers can contact you about privacy, and how you handle requests to remove or stop using images.

Staff training matters because many privacy problems happen through informal marketing habits. A store manager might quickly repost a customer story without checking whether the customer is identifiable. A clinic may save before-and-after images to a shared drive without access controls. A franchisee may use head office testimonial templates without matching the consent wording to the actual campaign.

Photos may also reveal sensitive details, even though the Privacy Act does not use the same sensitive information terminology as some overseas laws. A photo might show a health condition, disability support service, cosmetic treatment, religious setting, school uniform, location pattern or financial hardship context. These situations deserve a higher level of care and a more specific consent process.

Good privacy practice for customer images usually includes:

• only taking the photos you actually need for the stated purpose;
• telling customers if images will be used publicly or in paid marketing;
• limiting access to image libraries and testimonial folders;
• removing images from draft campaigns where consent is unclear;
• using secure storage rather than staff personal phones where possible;
• having a clear process for withdrawal requests and complaints.

If a customer asks you to remove an image, your legal position may depend on the consent terms, the type of use and whether the image has already been printed or shared by third parties. Even where you are not required to undo every past use, it is often sensible to stop future use and remove content from channels you control.

What a Customer Image Release Should Say

A customer image release should clearly record who is giving permission, what content can be used, where it can be used, and whether the business may edit, reproduce and promote it. The form does not need to be intimidating, but it should be specific enough to avoid later disputes.

Businesses often call this document a photo consent form, customer image release, model release or media release. The name matters less than the content. In New Zealand, a photo consent form for marketing should be written in plain English and match your actual marketing practices.

A practical customer image release in New Zealand often includes:

• Customer details: The name and contact details of the person giving consent, and parent or guardian details where a minor is involved.
• Description of the content: Photos, videos, audio, written feedback, social media posts, screenshots, name, handle, likeness, story or other identifying details.
• Purpose: Marketing, advertising, portfolio, website, social media, case studies, education, internal training or media communications, as applicable.
• Channels: Your website, email, social platforms, paid ads, printed flyers, signage, presentations, franchise materials or partner marketing.
• Editing rights: Permission to crop, edit, caption, combine with text or use the image in designed materials, while avoiding misleading alterations.
• Duration: Whether the consent is ongoing, limited to a campaign, limited to a period, or able to be withdrawn for future uses.
• Payment or incentives: Whether the customer is unpaid, receives a discount, free product, voucher or other benefit, and whether this affects testimonial disclosure.
• Withdrawal process: How the customer can contact you to request that future use stop or online content be removed from channels you control.
• No approval right unless agreed: Whether the customer can approve final edits before publication, or whether consent allows you to publish without further approval.

Your release should also deal with copyright. Copyright ownership can depend on who created the content, whether the creator is an employee, whether the work was commissioned, and what the relevant contract says. If a customer sends you a photo they took, your customer contract or release may need a licence from them to use it in your marketing. If a photographer, contractor, influencer or agency creates the images, your contract should say who owns the copyright and what your business can do with the content.

For employee-created content, make sure your employment agreements and internal policies deal with work-created materials, privacy and social media use. For contractor, influencer or agency-created content, check the contract carefully. In New Zealand, commissioned photographs and some other commissioned works may be first owned by the person who commissions and pays for them, unless the parties agree otherwise. Your agreement should still confirm ownership or licence rights, permitted channels, territories, duration, editing rights, attribution or moral rights issues, and any limits on reuse.

Keep the consent process proportionate. A cafe asking to repost a customer photo may use a short message that clearly asks for permission to share the image on the cafe's social pages. A cosmetic clinic using before-and-after photos in paid advertising should use a more detailed written release because the content is more personal, more persuasive and more likely to attract complaints if misused.

Digital consent can be effective if it is clear and stored properly. Examples include a tick-box in an online booking form, a signed tablet form, an email confirmation, or a direct message that says the customer agrees to your specified use. The record should show what the customer agreed to at the time, not just that a box was ticked.

Testimonials, Before-And-After Images and Social Media Reposts

Customer photos become higher risk when they are paired with claims about results, satisfaction or personal experience. In those situations, your consent process needs to align with the Fair Trading Act 1986 as well as privacy and copyright considerations.

The Fair Trading Act prohibits misleading or deceptive conduct in trade and false or misleading representations. For marketing using real customers, that means the overall impression of the testimonial, caption, image and surrounding claims must be accurate. You should not edit a testimonial so it sounds stronger than what the customer said, imply a typical result when the outcome is unusual, or use an old image to promote a changed service.

Before-and-after content can be especially persuasive. A dental practice, hairdresser, gym, building business, skincare clinic or home organiser may want to show visible transformation. The risk is that viewers may treat the image as proof of expected results. Your marketing should not overstate what your product or service can achieve, hide relevant conditions, or create unrealistic expectations.

Practical rules for before-and-after images include:

• use genuine images of the same customer, product or project;
• avoid lighting, angles, filters or editing that materially exaggerate the result;
• do not imply every customer will get the same outcome;
• keep records showing when the photos were taken and what service was provided;
• get consent for both the image and the accompanying claims or story;
• avoid using health, weight loss, cosmetic or financial outcomes without careful review.

If a customer receives a free product, discount or payment in exchange for a testimonial, the commercial connection may need to be disclosed so customers are not misled. This is particularly relevant for influencer-style content, gifted products, ambassadors and paid customer stories. The Commerce Commission expects advertising to be identifiable and not misleading, regardless of whether it appears in a polished ad or a casual social post.

Social media consent for business use in New Zealand should not rely on platform habits alone. A customer tagging your store, using your branded hashtag or commenting on your post may be happy to interact with you online. That does not automatically give your business a broad licence to use their image across all marketing channels.

For low-risk reposts, you can send a direct message that clearly asks for permission. For example, ask whether you can repost the customer's photo on your business Instagram and Facebook pages, with credit to their handle. If you later want to use that same image in a paid ad, email campaign or website banner, ask again unless the original consent covered that use.

Be careful with screenshots. A screenshot may capture the customer's image, username, comments, friends' comments, location, children in the background or other personal details. Crop out unnecessary information and avoid publishing private messages unless the customer has agreed to that specific use.

Minors need extra care. If a person under 18 appears in a promotional photo, obtain parental consent from a parent or guardian and consider whether the young person should also be asked in an age-appropriate way. Businesses working with children, such as tutoring centres, sports programmes, childcare services, dance studios and family attractions, should have a strict photo policy that covers collection, storage, platforms, group photos, uniforms, names and withdrawal requests.

Avoid publishing a child's full name, school, regular location or schedule unless there is a strong reason and express guardian approval. Group event photos can still identify a child, so event signage alone is rarely the best consent process for close-up promotional use. For public events, signs and ticket terms may help set expectations, but featured customer images should still be handled more carefully.

Some industries should add a review step before posting. Health, beauty, wellness, disability support, aged care, finance and professional services can involve personal circumstances that customers may not want public. A customer may consent at the point of service but later feel exposed when the image is shared widely. Clear choices and a respectful withdrawal pathway reduce that risk.

A useful internal rule is simple: if the image relies on the customer's identity, story or body to sell the service, get specific consent before publishing it.

FAQs

Do I Need Consent to Use a Customer Photo in Marketing?

Yes, if the customer is identifiable or the photo was provided for a different purpose, you should get clear consent before using it in marketing. Consent is especially important for websites, social media, paid ads, testimonials and before-and-after images.

Can I Repost a Customer's Social Media Photo?

You should ask first, even if the customer tagged your business or used your hashtag. A short written message can work for a simple repost, but broader uses such as paid ads, email campaigns or website banners should be covered by a clearer release.

What Should a Photo Consent Form in New Zealand Include?

A photo consent form should identify the customer, describe the photos or videos, state the marketing purposes and channels, explain editing and reposting rights, cover any payment or incentive, and say how the customer can request that future use stop.

Can a Customer Withdraw Consent After Publication?

A customer can ask you to stop using their image, and you should have a process for removing content from channels you control. Your release can explain any limits, such as printed materials already produced or content shared by third parties.

Do I Need Parent or Guardian Consent for Photos of Children?

Yes, businesses should obtain parent or guardian consent before using a minor's image in marketing. It is also good practice to consider the child's comfort, avoid unnecessary identifying details and use stricter rules for schools, activities and care settings.

Key Takeaways

• Customer photos can be personal information under the Privacy Act 2020 when a person is identifiable.
• A tagged post, casual conversation or customer review does not automatically give your business broad marketing rights.
• A customer image release should cover the content, purpose, channels, duration, editing rights, incentives and withdrawal process.
• Testimonials and before-and-after photos must not mislead customers under the Fair Trading Act 1986.
• Photos of minors, health-related outcomes and personal transformations need a more careful consent process.
• Keep consent records with the image files so your team can check permissions before reusing content.

If your business uses real customer images, testimonials or social media content in promotions, Sprintlaw can help with your photo consent form, customer image release, privacy policy and marketing terms. Contact us on 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.