Can I post a photo of other people in the EU?

The short answer

Often yes, you can share a photo that shows other people, but the GDPR (called AVG in the Netherlands) can apply. A photo of a person is personal data when that person can be identified from it, for example by their face, or by a name tag, a caption, or a location shown next to it.

For private, personal use the GDPR has a narrow exemption called the household exemption. Once you post publicly, or use the photo for business, the exemption usually no longer covers it.

What the household exemption covers, and what it does not

The GDPR does not apply to processing done by a person in the course of a purely personal or household activity (Article 2(2)(c) and Recital 18). Sending a photo of a birthday party to a small group of friends you know is the kind of activity this is meant for.

The exemption is narrow. The EU Court of Justice has ruled that putting personal data online where anyone can see it generally falls outside it (Lindqvist case, C-101/01). Public posts, open profiles, and photos used for a shop, a brand page, or a company are usually not covered.

Example (fictional): a photo of a garden party with six friends, shared in a private group chat, is in a different position from the same photo posted on an open page for anyone to find.

When it gets riskier

Some situations need more care before you post:

Children. Children's images deserve extra care. The GDPR says children need specific protection (Recital 38). Ask the parents or guardians before you post a child's photo publicly, and think about school or sports settings.

Public or business use. Photos on a public profile, a shop listing, a marketing post, or a company account are a different use from a private share.

Sensitive settings. A photo that shows someone at a clinic, a place of worship, a union meeting, or a protest can reveal sensitive information. The GDPR gives those special categories stronger protection (Article 9).

Three practical steps before you post

You do not need to be a lawyer to reduce the risk. These three checks cover most cases.

1. Ask first. If the people in the photo can be identified, ask whether they are happy for it to be shared, and where. If someone says no, leave it out or crop them out.
2. Blur faces or remove people you do not need. A blurred face is a simple way to make a photo less identifying. See the blur guide for how to do it.
3. Remove location and time data. Photos can carry GPS coordinates and timestamps in their metadata. Check the file with the EXIF Viewer and strip what you do not want to share.

Check the official sources

This page is general information written by Tokenworks, not legal advice. Tokenworks is not a law firm, and the rules depend on your situation and country. For the full text, read the GDPR on EUR-Lex. For guidance from data protection authorities, see the European Data Protection Board and the Dutch Autoriteit Persoonsgegevens, or the authority in your own country.

Our tools do the checking in your browser. Nothing is uploaded. Tokenworks made this guide, and the tools linked here run on your own device.