Photography Consent Laws in NZ: Marketing, Events and Privacy

If your business uses photos or video (on your website, social media, ads, brochures, in-store signage, or even internal training), you’ve probably asked yourself: “Do we actually need consent for this?”

It’s a fair question. New Zealand doesn’t have one single “photography consent law” that covers every situation. Instead, the rules come from a mix of privacy law, other relevant laws (depending on context), industry expectations, and general legal risk management.

This guide breaks down photography consent laws in New Zealand in plain English, from a small business perspective. We’ll cover when consent is required (or strongly recommended), what “good consent” looks like, special rules for kids and sensitive situations, and the documents that help you stay protected from day one.

What Do Photography Consent Laws In New Zealand Actually Cover?

In practice, when people search for “photography consent laws in New Zealand”, they’re usually trying to understand how these areas fit together:

• Privacy Act 2020 obligations when you collect, store, use, or share images that identify someone (which is often “personal information”).
• Lawful purpose and fair collection (whether it’s reasonable to collect the image/footage in the circumstances, and whether you’ve been transparent about it).
• Consent and expectations (what people reasonably expect when they’re photographed, and what you told them you’d do with the images).
• Contract and consumer risk (for example, whether a customer could claim they were misled about what the images would be used for).
• Employment and workplace issues if staff are photographed at work or if you use CCTV or similar monitoring.
• Other laws that can apply in the right circumstances (for example, the Harmful Digital Communications Act 2015 if content is posted/used in a harmful way, and criminal/privacy considerations where filming occurs in private or intimate contexts).
• Extra caution around children, health-related information, and other sensitive contexts.

A good rule of thumb is this: if a person is identifiable in a photo or video, you should treat it like personal information and manage it properly (including thinking about whether you should obtain consent, and what you should disclose at the time of collection).

And if you’re using those images for marketing or promotion, consent (or at least clear, recorded permission) becomes even more important (because the stakes are higher if someone objects after the fact).

When Do You Need Consent To Take Or Use Photos For Your Business?

Consent isn’t always the only (or even the main) legal “test” under New Zealand law. Under the Privacy Act 2020, the key questions are often whether you have a lawful purpose, whether collection/use is fair and reasonable in the circumstances, and whether you’ve been transparent about what you’re doing.

That said, consent is often the simplest and safest way to reduce risk - and in many marketing scenarios it’s practically essential.

Here are the most common business scenarios.

1) Customer Photos For Marketing (Social Media, Website, Ads)

If you’re photographing customers (or posting images where they’re clearly identifiable) to promote your business, you should get clear consent before using those images.

This is because:

• the images are likely personal information under the Privacy Act 2020; and
• customers may not reasonably expect their image will be used in marketing unless you clearly tell them (and give them a genuine choice).

Even if you can lawfully take a photo in a public-facing setting, using that photo in an ad (especially paid advertising) is a separate step with higher privacy and reputational risk. The safest approach is to treat “marketing use” as requiring express permission.

2) Photos Taken At Events (Open Days, Launches, Community Events)

Events are a common grey area for businesses. People may expect some photos at events, but they don’t always expect their face will end up in a paid campaign later - or be used indefinitely.

A practical approach is:

• use clear signage at entry that photography/videography is happening and how it will be used;
• give people an easy opt-out option (where practicable); and
• get specific consent for close-ups, interviews, testimonials, or any “hero” content.

If your marketing team is selecting one person’s face as the focal point of a campaign, that’s a strong signal you should get written consent.

3) Staff Photos (Team Pages, Recruitment, Promotional Content)

Using staff images for your website and marketing is very normal - but you should still handle it properly.

Even if the photos were taken at work, employees may not automatically agree to their image being used forever across multiple channels. If someone leaves, you may also need to update content quickly to avoid misleading customers and to manage privacy expectations.

It’s also worth thinking about how consent is obtained in an employment context, because there can be a power imbalance. Any agreement should be voluntary and informed - not something your staff feel pressured into.

Where appropriate, you can document expectations in an Employment Contract and/or workplace policies, but it still helps to get a separate, specific sign-off for marketing usage (particularly for prominent campaigns).

4) CCTV And Workplace Monitoring

CCTV isn’t “photography for marketing”, but it is still image capture of identifiable people. If you use cameras at your premises (in retail, hospitality, warehouses, offices, etc.), you need to think about privacy compliance, what you’ll do with footage, and whether your use is fair and reasonable in the circumstances.

Key steps usually include:

• telling people cameras are operating (often via signage);
• having a clear purpose (e.g. security, theft prevention, staff safety);
• collecting only what you need (including thinking carefully about camera placement, especially near private areas);
• storing footage securely and limiting access; and
• not keeping footage longer than you need.

If your business wants to introduce cameras, or change how footage is used (for example, using footage for performance management), it’s worth getting advice because this can become a workplace relations issue as well as a privacy issue.

5) User-Generated Content (Customers Tagging You, Sending Photos, Reviews)

Many businesses repost customer photos that tag the business. While tags and public posts can reduce privacy risk, reposting is still a “use” of the content - and you should make sure you have the right to do it and that it’s fair in the circumstances.

A common, low-friction approach is to ask for permission in writing (even a DM reply) before reposting. You should also avoid reposting images that include other identifiable people who might not have expected their image to be used by a business.

How The Privacy Act 2020 Applies To Photos And Videos

The Privacy Act 2020 is the main compliance lens for most businesses dealing with photos and videos.

It applies when you collect, use, store, or disclose personal information. An image is “personal information” when it identifies (or could reasonably identify) an individual. That can include:

• faces and clear identifying features;
• name tags or uniforms;
• vehicle registration plates (in some contexts);
• unique tattoos or other markers; and
• metadata that links the image to a person.

Importantly, the Privacy Act focus isn’t only on “did you get consent?” - it’s also on whether you had a legitimate purpose, whether the person was properly informed (where required), whether the use/disclosure matches the purpose, and whether your handling of the information is secure and proportionate.

What You Should Do In Practice

For small businesses, the practical compliance steps usually look like this:

• Be clear about your purpose: why are you taking the photo/video?
• Tell people what will happen: where will it be used (Instagram, website, brochures, ads)?
• Only collect what you need: don’t capture more than necessary, especially in sensitive areas.
• Store it safely: limit who can access the raw files, especially if they include children or private situations.
• Have a retention approach: don’t keep everything forever “just in case”.

It’s also smart to have a Privacy Policy that explains (in plain language) how your business collects and uses personal information, including photos and videos. This is particularly important if you collect content via your website, online bookings, forms, memberships, or competitions.

If you’re collecting images directly (for example, through event registration or customer testimonials), a Privacy Collection Notice can help you spell out what you’re doing at the point of collection.

What Counts As “Valid Consent” For Photography Use?

In a business context, “consent” isn’t just someone smiling at the camera. Strong consent is usually:

• Informed: the person understands what they’re agreeing to.
• Specific: it covers the actual use (not a vague “marketing” statement that could mean anything).
• Freely given: they have a real choice and won’t be penalised if they say no.
• Recorded: you can prove it later if there’s a dispute.

Practical Ways To Get Consent (Without Killing The Customer Experience)

You don’t always need a long-form contract, but you do need something that works.

Common options include:

• Written consent forms for staff shoots, testimonials, brand campaigns, and feature content.
• Event entry terms (paired with signage) for general crowd shots, with a separate opt-in for close-ups.
• Simple email or message confirmation for reposting user-generated content (“Yes, you can repost this on your socials and website”).
• Booking forms that include a clear, optional photo consent tick box.

Where your business is running competitions, giveaways, or campaigns that involve collecting and reposting images, it helps to set expectations in your Competition Terms & Conditions (for example, how entries will be displayed, whether they’ll be used in future promotions, and how withdrawal requests will be handled where appropriate).

Be Careful With “Bundled” Consent

A common mistake is burying photo consent inside unrelated terms, or treating it as mandatory when it doesn’t need to be.

If people feel tricked or pressured, you’re far more likely to end up with complaints, takedown requests, negative publicity, or disputes with staff and customers.

If consent is optional, make it optional in a way that’s clear.

Special Situations: Children, Sensitive Settings, And Third-Party Locations

Some situations carry higher privacy and reputational risk, even if you feel you’ve “technically” complied.

Children And Young People

If your business photographs children (think: childcare, tutoring, kids’ sports, schools, family events, healthcare, retail events), you should treat this as a high-risk area.

In many cases, you should obtain consent from a parent or guardian, and you should be very clear about:

• where the images will be used (and whether they’ll be public);
• how long you’ll keep them;
• who will have access; and
• how consent can be withdrawn (and what withdrawal means in practice, for example, future use vs what’s already been distributed).

If you’re using a specific form to capture consent, a tailored Parental Consent Form can help keep things clear and consistent.

Sensitive Information And High-Risk Contexts

Photos can reveal more than you think. An image might disclose health information, religion, ethnicity, a person’s address, or other details that could be considered sensitive.

If you operate in healthcare, wellbeing, counselling, or disability services, you’ll want to be particularly careful about photo use and storage. Even “feel-good” marketing content can unintentionally expose information a client expected to remain private.

In these contexts, it’s often best practice to use:

• explicit written consent;
• an option to use non-identifying images (e.g. hands, backs of heads, staged photos); and
• tight internal access controls.

Separately, if filming occurs in private places or involves intimate or highly sensitive content, there may be serious legal consequences beyond the Privacy Act - so it’s especially important to get advice before capturing or sharing that material.

Photos Taken On Someone Else’s Premises

If you’re shooting content inside a third-party venue (like a gym, café, retail store, co-working space, or event venue), you may need permission from the venue as well.

This isn’t always a “consent law” issue - it can also be a contract and property rights issue. You don’t want your business investing in content only for the venue owner to demand you take it down later.

A short written venue permission (or a clause in your booking agreement) can prevent confusion about what you’re allowed to film and how content can be used.

What Legal Documents And Processes Help You Stay Compliant?

Once you understand the basics of photography consent laws in New Zealand, the next step is building a process your team can follow consistently.

Here’s a simple compliance framework many small businesses use.

1) Put A Privacy Approach In Place (So You’re Not Making It Up As You Go)

Start with a Privacy Policy that reflects what you actually do. If you change your approach (for example, you start filming more behind-the-scenes content), update it.

If you collect images through forms, registrations, or online sign-ups, consider a Privacy Collection Notice so people understand what you’re agreeing to right when they provide the information.

2) Use Clear Consent Forms For High-Value Content

If you’re doing a brand refresh, professional shoot, testimonials, or paid campaigns, a written consent form (often called a model release) can be the difference between confidently running a campaign and scrambling to pull content down later.

A Model Release Form can set out key points like:

• who is granting permission (and for minors, who is authorised to sign);
• what content is being captured (photos/video/audio);
• where and how your business can use it (channels, territories, time period);
• whether editing is permitted; and
• how withdrawal requests will be handled (where appropriate).

3) Set Expectations With Contractors And Creatives

If you hire photographers, videographers, editors, or marketing contractors, make sure your agreement covers:

• who owns the final content and raw files;
• what licences apply (who can use the footage and for what);
• who is responsible for obtaining permissions/consents from people filmed (and how that will be recorded); and
• how takedown requests will be handled.

This can be covered in a tailored service agreement, but the key is making sure it’s written down. Otherwise, you risk paying for content you can’t confidently use.

4) Add Photo/Video Clauses To Your Website And Promotions Where Needed

If you run an online business, it can be helpful to include photo and content use rules in your Website Terms & Conditions, especially if users upload content, interact with your brand, or participate in promotions.

This won’t replace consent in every scenario, but it can support your overall framework by setting expectations clearly.

5) Train Your Team And Keep Records

Even strong documents don’t help if your team doesn’t follow them.

At a minimum, your internal process should cover:

• who can take photos/videos for the business (and on which devices);
• where files are stored (and who can access them);
• how permission/consent is obtained and recorded; and
• what to do if someone asks for an image to be removed.

This is especially important if multiple staff members manage social media, or if staff use personal phones to capture content.

Key Takeaways

• “Photography consent laws in New Zealand” aren’t found in one single rule - they come from a mix of privacy obligations (including the Privacy Act 2020), other laws that may apply depending on the context, and practical risk management for businesses.
• If a person is identifiable in an image, you should generally treat the photo or video as personal information and handle it carefully, especially if it will be used publicly.
• Consent isn’t the only consideration under the Privacy Act, but it’s often the safest approach for marketing use (social media, ads, website content) - even if the photo was taken in a public or public-facing setting.
• Valid consent should be informed, specific, freely given, and ideally recorded so you can rely on it later if there’s a dispute.
• Children and sensitive settings (health, counselling, disability support, private events) need extra care - written and guardian-based consent is often the safest approach.
• Strong documents and systems help you stay compliant, including a Privacy Policy, a Model Release Form, clear online terms like Website Terms & Conditions, and (where relevant) a Parental Consent Form.

If you’d like help putting the right consent forms, privacy wording, and agreements in place for your business, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.