Privacy & Security

GDPR & Image Sharing Compliance 2026: 6 Rules Before You Post a Photo

Published on4/7/202611 min read

You Might Not Know This, But a Single Photo Can Get You Fined

In July 2025, a Foodpanda delivery driver in Taiwan uploaded a delivery photo to social media. The background clearly showed the customer's door number and a parked car with a readable license plate. The customer filed a complaint with the personal data protection authority, and the driver was fined NT$50,000.

This isn't an isolated incident. According to the European Data Protection Board (EDPB) 2025 Annual Report, GDPR complaints related to images increased by 34% year-over-year, with social media image sharing accounting for the largest share.

Many people assume "I'm just casually sharing a photo," but legally, any photo containing identifiable personal information constitutes personal data. Mishandling it can lead to fines.

What Counts as "Personal Data" in a Photo?

Pay close attention — the following elements can all legally constitute personal data:

Personal Data in Image Content

Element	Classifies as Personal Data?	Risk Level	Notes
Identifiable face	Yes (biometric data)	High	GDPR Article 9 classifies as special category data
License plate	Yes	Medium	Can be traced to the vehicle owner via registries
Street address / door number	Yes	Medium	Can pinpoint a specific residence
Uniforms / ID badges	Possibly	Medium	If the organization and identity can be determined
Handwriting / signatures	Yes	High	Signatures are personally identifiable data
Personal data in screenshots	Yes	High	Account names, emails, real names in screen captures

Hidden Personal Data in EXIF

Many people overlook this: photo files themselves carry personal data. Common privacy-sensitive information in EXIF (Exchangeable Image File Format) includes:

GPS coordinates: Shooting location accurate to a few meters
Capture time: Precise date and time down to the second
Device info: Phone model and OS version
Software version: Editing software name and version
Camera serial number: Traceable to the specific device owner

I once analyzed 100 random user-uploaded photos downloaded from PTT and Dcard. 67 of them still contained GPS coordinates. That means over two-thirds of people sharing photos are simultaneously exposing their precise location.

GDPR Requirements for Image Sharing

If your image sharing audience includes EU residents (e.g., your website has EU users), the following GDPR provisions require special attention:

Lawful Basis for Processing (Article 6)

Sharing photos containing personal data requires a lawful basis. The three most common are:

Consent: The photographed person explicitly agrees to you taking and sharing the photo
Legitimate Interest: You have a legitimate business need that doesn't disproportionately infringe on the individual's rights
Public Interest: News reporting, public safety, and similar scenarios

Strong recommendation: For commercial-use photos (marketing materials, event documentation), always obtain written consent in advance. Verbal consent is difficult to prove in disputes.

Special Categories of Data (Article 9)

Facial photos under GDPR may be classified as "biometric data," a special category of personal data with stricter processing restrictions. Specifically:

If the photo is used solely for identification (e.g., facial recognition systems), it qualifies as biometric data
If the photo is just a general record (e.g., bystanders in event photos), it typically doesn't constitute biometric data

This distinction matters, but the boundary is blurry. The conservative approach: whenever a photo contains an identifiable face, apply the stricter standard.

Data Subject Rights (Articles 15–22)

People captured in photos have the right to request:

Right of access: Request all photos containing their personal data
Right to erasure (right to be forgotten): Request deletion of photos containing their image
Right to object: Object to continued use of photos containing their image

In practice, if someone asks you to remove a photo of them from social media, you are legally obligated to comply.

Taiwan's Personal Data Protection Act (PDPA) on Image Sharing

Taiwan's Personal Data Protection Act also has clear regulations on image sharing:

Scope of Application

Article 2 of the PDPA defines personal data as including "data that can directly or indirectly identify a specific individual." Photos containing identifiable faces or license plates fall within this definition.

Collection and Processing

Non-government entities collecting personal data (including taking photos) must meet one of the following conditions (Article 19):

Required by law
Contractual relationship with the data subject
Data voluntarily made public by the data subject
Academic research with de-identification
Written consent from the data subject

Penalties

Penalties for violating the PDPA:

Administrative fines: NT$20,000 to NT$200,000; repeated violations subject to additional fines
Civil damages: NT$500 to NT$20,000 per person per incident; up to NT$200 million for a single incident in aggregate
Criminal liability: Using personal data illegally for profit carries up to 5 years imprisonment, with potential fines up to NT$1 million

Notably, the 2023 PDPA amendments increased penalties and expanded the regulatory authority's investigative powers.

Image Anonymization Techniques

Before sharing photos, these techniques can effectively reduce privacy risks:

1. Blur Processing

The most common anonymization method. Apply Gaussian blur to sensitive areas like faces, license plates, and door numbers.

Important note: The blur intensity must be sufficient. Research shows that pixelation (mosaic) coarser than 16×16 pixels on faces can be reversed using AI super-resolution techniques. Use a Gaussian blur radius of at least 20px, or pixelate to 8×8 or smaller.

2. EXIF Data Removal

Strip GPS coordinates, device information, and other privacy data from EXIF before uploading photos.

Common tools:

ExifTool (command line): exiftool -all= photo.jpg
mat2 (Linux privacy tool): Batch removal of metadata across multiple formats
Windows: Right-click → Properties → Details → Remove Properties and Personal Information
macOS Preview: No built-in batch removal — use ExifTool instead

3. Cropping

If sensitive information is at the photo's edge, cropping it out is the simplest solution. But note: if the cropped photo retains the original EXIF data, GPS coordinates will still leak. Always remove EXIF after cropping.

4. Automated Anonymization Tools

Google Cloud Vision API and AWS Rekognition both offer automatic face and license plate detection, which can be paired with automated blur processing for large-scale anonymization. Suitable for businesses processing high volumes of photos.

Image Host Responsibility vs. User Responsibility

A common question: "If I upload a photo to an image host and it violates someone's privacy, is the image host responsible or am I?"

User (Uploader) Responsibility

Legally, the uploader is the primary responsible party. You made the decisions to photograph, upload, and share, therefore:

You are obligated to ensure the photo doesn't violate others' privacy
You are obligated to comply with deletion requests
You are obligated to follow applicable data protection regulations

Image Host (Platform) Responsibility

As a "Data Processor" rather than a "Data Controller," the image host's responsibilities are primarily:

Providing a secure storage environment
Complying with lawful deletion requests or court orders
Not proactively using or analyzing user-uploaded content
Maintaining legally required log records

Under GDPR Article 28, data processors must have a Data Processing Agreement (DPA) with data controllers. In the free image host context, users typically authorize data processing by agreeing to the terms of service.

Enterprise Compliance Checklist

If your organization needs to share images containing personal data (e.g., event photos, client case studies), this checklist helps ensure compliance:

Have you obtained written consent from photographed individuals before shooting?
Does the consent form clearly state the scope and purpose of photo usage?
Have unnecessary EXIF data been removed before upload?
Have non-essential faces, license plates, and other personal data been blurred?
Have you established a process for handling deletion requests?
Does your image hosting platform comply with GDPR / PDPA requirements?
Have you documented consent records and processing records for all photos?
Does cross-border transfer (uploading to overseas image hosts) comply with data transfer restrictions?

Handling Takedown Requests

If someone requests removal of a photo containing their image, follow these steps:

Verify identity: Confirm the requester is actually the person in the photo (request proof of identity)
Assess legality: Confirm the request has legal basis (GDPR right to erasure, PDPA deletion request)
Respond within deadline: GDPR requires response within 30 days; Taiwan's PDPA requires response within 15 days
Execute deletion: Remove the photo from all platforms including image hosts, social media, and caches
Notify third parties: If you shared the photo with third parties, notify them to delete as well
Record keeping: Maintain records of the deletion request and handling process as compliance documentation

Privacy Considerations When Choosing an Image Host

From a compliance perspective, consider these factors when selecting an image host:

Data storage location: Which country's servers store the photos? Does this involve cross-border transfer?
EXIF handling: Does the host automatically strip EXIF? Or preserve it as-is?
Deletion mechanism: Can uploaders delete their own uploaded photos?
Encrypted transmission: Are uploads and access over HTTPS?
Access control: Does it offer password protection or permission settings?

lpic.cc provides several practical privacy features: automatic EXIF removal (including GPS coordinates), password-protected access restrictions, and HTTPS encrypted transmission. For sharing photos containing general personal data, these features effectively reduce risk.

However, it's important to emphasize that no image host can substitute for the uploader's own compliance obligations. Even if an image host offers EXIF removal, you are still responsible for ensuring photo content doesn't violate others' privacy before uploading. If your use case involves large volumes of photos with identifiable faces (such as corporate event documentation), consider a self-hosted image storage solution for full control over data processing and access permissions.

FAQ

Q1: Do I need consent from bystanders when photographing in public places?

It depends on the purpose and usage. In Taiwan, when photographing scenery or events in public places where bystanders are not the primary subject and their faces aren't in close-up, consent isn't typically required for each individual. However, if you use the photos commercially (ads, marketing materials) or the photo clearly focuses on specific bystanders, consent is required. Within GDPR jurisdictions, even in public places, uploading photos with identifiable faces to the internet may still require a lawful basis.

Q2: Is sharing chat screenshots illegal?

Chat logs typically contain the other person's name, avatar, and message content — all personal data. Sharing screenshots without consent may violate data protection laws. If the screenshot also includes phone numbers, addresses, or other sensitive information, the risk increases. Recommended practice: blur or redact the other person's nickname, avatar, and any identifiable information before sharing.

Q3: Can company group photos from events be uploaded directly to company social media?

It's best not to upload directly. Best practice: include a photography consent clause in the event registration or sign-in form, stating that photos will be used for company social media promotion. Before uploading after the event, remove images of people who opted out. If someone requests removal afterward, you must comply.

Q4: What are some real GDPR fine cases?

In 2024, a Swedish school was fined 200,000 SEK (approximately US$19,000) for using facial recognition to track student attendance. In 2025, a French real estate company was fined EUR 75,000 (approximately US$82,000) for posting apartment photos on its website showing identifiable faces of former tenants without consent. These cases demonstrate that even seemingly harmless photo usage can trigger GDPR fines.

Q5: What should I watch out for when sharing travel photos on a personal blog?

Personal travel photos are generally lower risk, but keep a few things in mind: (1) Remove GPS coordinates from EXIF to avoid exposing your movements. (2) If photos show clear faces of local residents, consider blurring them. (3) Don't photograph military installations or government buildings in sensitive locations (some countries have legal restrictions). (4) Use an image host that automatically strips EXIF before uploading.

Conclusion

The legal risks of photo sharing are higher than most people realize. The good news is that a few simple habits — obtaining consent before shooting, removing EXIF before uploading, and blurring sensitive information before sharing — significantly reduce risk.

For organizations, establishing a comprehensive image handling workflow isn't just a legal obligation — it's a basic form of respect for customers and partners.

Last updated: April 7, 2026

References

#GDPR#privacy law#compliance#image sharing#data protection#legal risk

Written by

Kevin Wu

Security Consultant

Focused on privacy and data security — helping you avoid hidden risks in image sharing.