An average home page now carries 66.6 images (WebAIM Million 2026): team shots, product photos, icons, map sections, background motifs. Every single one of them is a small legal relationship. Someone created it, someone permitted its use, and as soon as a person is identifiable in it, a second permission is added. Within one year the number of images per home page grew by 13.6 percent (WebAIM Million 2026); in our experience the care taken over the matching paperwork grows more slowly. This rarely becomes visible on the day of publication but years later: the picture is still on the page, the invoice sits in a mailbox that no longer exists, the photographer turns out to be someone else, and the colleague in the team photo moved on long ago. This article sorts the rules the way they actually surface when a website is built and operated: what copyright protects in a photo, what a licence has to state, when the people shown must agree, and which records you keep for how long. It is professional guidance and does not replace legal advice in an individual case — it makes sure that legal advice finds any documents at all.
Key points at a glance
- Copyright in a photographic work expires 70 years (German Copyright Act) after the author's death; simple photographs are protected for 50 years (German Copyright Act) after publication. A company photo from the eighties is therefore rarely free material.
- A licence permits a specific use, it does not transfer ownership of the file. Where the types of use are not listed individually, the purpose of the contract decides how far the right reaches (German Copyright Act).
- Anyone identifiable in a picture has to agree to its publication. Section 23 of the German Art Copyright Act lists four (German Art Copyright Act) narrowly defined categories, and on a company website none of them usually applies.
- Consent under the General Data Protection Regulation can be withdrawn at any time (GDPR). Every picture showing people therefore needs a way to take it off the page at short notice.
- The controller must be able to demonstrate compliance with the principles (GDPR). Without a filed record, a permission cannot be shown to anyone.
- Accounting vouchers, and therefore licence invoices, must be kept for eight years (German Fiscal Code), and claims usually lapse after three years (German Civil Code). The record has to outlast the project.
Why every image carries two permissions
Two independent sets of rights meet in a website image, and both have to be satisfied. The first concerns the work: whoever took the photo decides whether it may be made available to the public. The right of making a work available to the public is set out separately in the German Copyright Act and describes exactly what a website does — offering a work so that members of the public can access it from places and at times of their own choosing (German Copyright Act). The second set concerns the person shown: anyone identifiable has a say of their own, regardless of who owns the file. Checking only one of the two leaves half the work undone. How to deliver the images cleanly on the technical side is covered in optimising images for the web; this article deals with the question that comes before that.
In practice the gap opens at the same point almost every time: the handover. Images arrive from four directions — from a commissioned photographer, from a licensed archive, from the client themselves, or they come from an old website and nobody remembers the source. The first three routes can be documented; the fourth is the expensive one. Anyone starting a project should therefore record where each picture came from while the content is still being collected. The article on preparing a website project describes that step alongside texts, access credentials and deadlines. A picture without a documented origin is not a small residual risk but the most common reason why, years later, nobody can say who permitted which use and when.
Holding the file is not a permission
What copyright protects in a photo
Photos enjoy protection on two levels in Germany. Images with a recognisable creative contribution are photographic works; copyright in them expires 70 years (German Copyright Act) after the author's death. All other images — the product shot against a white background, the snapshot from the building site — are simple photographs and are protected by applying the same provisions accordingly. That right expires 50 years (German Copyright Act) after the photograph appeared or after its first lawful communication to the public, whichever came earlier. For website images this means there is hardly a case where a picture would be free to use purely because of its age. A view from the post-war years, a company photo from the eighties, an image from a predecessor's archive — all three are very likely still protected.
It is not only copying that is protected but precisely the act of putting something online. The right of making available to the public covers offering a work so that it can be accessed from places and at times of one's own choosing (German Copyright Act) — the legal description of a website. Anyone embedding someone else's image needs a right of use for it. That right can be granted as a non-exclusive or an exclusive right and can be limited in territory, time or content (German Copyright Act). Those limitations hold the difference between a licence that carries your site and one that does not. An image bought for a brochure is therefore not automatically cleared for the home page, and a picture used in the web design of a short campaign is not automatically cleared for permanent use.
Who created it?
Name and contact details of the author or rights holder. For archive images the licence reference belongs with it — without that reference no record can be matched to a file years later.
Which type of use?
Website, social media, print, advertising, passing on to third parties, editing. Each of these is a separate item. Anything not named counts as not granted when in doubt.
For how long and where?
Time-limited licences expire without anyone being notified. Expiry date and territorial scope therefore belong in the same row as the file name.
- Name of the author or rights holder, spelled the way the credit should appear
- Permitted types of use, listed individually rather than as a blanket phrase
- Territorial scope, particularly where the site is served in several languages
- Time limit with a concrete end date if the licence is not perpetual
- Permission to edit: cropping, colour adjustment, cut-outs, text placed on the image
- Form of the author's credit and the place where it appears on the site
Read the rights of use instead of collecting licences
The most important sentence in licensing law sits in the German Copyright Act: if the types of use are not specifically designated when a right of use is granted, the scope of the right is determined by the purpose envisaged by both parties to the contract (German Copyright Act). This purpose-of-transfer rule works in favour of the author when in doubt. Commissioning a photographer for "pictures for the new website" therefore does not, in our experience, buy rights for advertisements, trade fair stands or handing the files to a sales partner. The brief should list what is actually planned — and be more generous than the immediate occasion demands, because licensing something afterwards is considerably more laborious than one extra line in the quotation.
The second rule is often overlooked and concerns the credit. The author has the right to recognition of authorship and may determine whether the work is to carry an author's designation and which one (German Copyright Act). A missing image credit is therefore a breach in its own right, even where the use as such was permitted. On a website the credit has three workable places: directly at the image, collected in the page footer, or on a dedicated image credits page that every caption points to. What matters is that the connection survives rebuilds. During a relaunch image credits tend to disappear together with the old templates.
| Aspect | Commissioned shot | Licensed stock image |
|---|---|---|
| Author | The commissioned photographer, known by name | Named in the licence documents |
| Scope of rights | Freely negotiable in the contract | Set by the provider |
| Exclusivity | Can be agreed as an exclusive right | Usually a non-exclusive right |
| Editing | Negotiable, often at no extra cost | Frequently restricted or excluded |
| Author's credit | Negotiable, form can be chosen | Mostly prescribed and binding |
| People in the shot | Consent to be obtained yourself | Check the release of those depicted |
| Record | Contract, quotation, invoice | Licence record with image reference |
| Cost pattern | Higher at the start, stable afterwards | Lower per image, but recurring |
People in the shot: consent under KUG and GDPR
Portraits may only be disseminated or publicly displayed with the consent of the person depicted (German Art Copyright Act). The provision comes from the German Art Copyright Act and remains in force on this point. Section 23 of the same act lists four (German Art Copyright Act) narrowly defined categories that may be disseminated and displayed without that consent: portraits from the sphere of contemporary history, pictures in which people appear merely as incidental elements beside a landscape or other locality, pictures of assemblies, processions and similar events in which those depicted took part, and portraits not made to order, provided their dissemination serves a higher interest of art. That licence also ends where a legitimate interest of the person depicted is infringed. On company websites none of these usually applies. After the death of the person depicted, the consent of relatives is required until 10 years (German Art Copyright Act) have passed. A breach also carries criminal liability: the statute provides for imprisonment of up to one year (German Art Copyright Act) or a fine.
Alongside this the General Data Protection Regulation applies, because an identifiable photo of a person is personal data. One point brings relief: processing photographs does not as a matter of principle fall under the special categories of personal data, but only where they are processed through specific technical means allowing unique identification (GDPR). Publication still needs a legal basis, in practice consent or an overriding legitimate interest. Consent can be withdrawn at any time (GDPR), and withdrawal has to be as easy as giving consent. Infringements of the principles and of the conditions for consent carry fines of up to 20 million euros or 4 percent of total worldwide annual turnover (GDPR). What that means for forms, records and deletion periods is set out in the GDPR checklist for websites.
Team photos: the case that hits almost every company
- Who takes the picture and who publishes it, with address and a named contact
- Which shots are covered, identified by occasion, date or image reference
- Which channels they appear on: website, printed material, job advertisements
- That giving consent is voluntary and that withdrawing it causes no disadvantage
- How to withdraw, to which address, and within which period the picture comes down
- What happens to printed runs already distributed at the moment of withdrawal
The records folder: what remains when questions arrive
The General Data Protection Regulation requires the controller to be able to demonstrate compliance with the principles (GDPR). This accountability duty is why a verbal assurance is worth little in practice: it may be valid, but it cannot be produced. In copyright the same mechanism works through the burden of proof — whoever relies on a licence has to be able to show it. How long the documents are needed follows from two periods: accounting vouchers, and therefore the invoice for an image licence, must be kept for eight years (German Fiscal Code), and claims usually lapse after three years (German Civil Code). A picture that stays on the site for a decade consequently needs a record that survives that decade.
The record itself is unspectacular. Five entries belong to each image: origin, rights holder, permitted use, licence expiry date and — where people are shown — the consent. A plain table works well, with each row carrying the same file name that sits on the server, and next to it a folder holding the matching documents. The link between file and record is what counts: a folder full of invoices helps nobody if there is no way to say which invoice belongs to which picture. Building the upkeep of that list into ongoing website care keeps it current without setting up a project of its own.
Record the origin
File name, source, date of acquisition and the document itself. The file name in the register has to match the one on the server, otherwise the link falls apart at the first rebuild.
Check the scope
Before each new use, a glance at the row: is the planned use listed? An image from a service page cannot simply move into an advertisement or a printed folder.
Note the deadline
Licence expiry date, date of consent and the point at which both are looked at again. A date in the calendar replaces the hope that somebody will remember in time.
Let the file name carry the record
Alternative text, metadata and the move
An image is more than its licence. 16.2 percent (WebAIM Million 2026) of all images on the home pages studied had no alternative text, not counting deliberately empty values. Alternative text is first of all a question of usability and, for a growing share of digital offerings, a legal requirement as well. The criteria behind it are covered in the article on WCAG in practice, and how we implement them is described under accessible websites. For the legal side of an image the alternative text is useful too: it describes what can be seen and thus makes it traceable afterwards whether a person was identifiable and whether the picture still fits the page at all.
Two kinds of additional information sit inside the image file itself. The camera data names the device, the moment and often the location; the rights fields hold author, source and terms of use. When files are resized and converted for the web, both tend to be stripped out. For location data that is welcome — a photo taken in the owner's home does not need to ship its coordinates — while for the rights fields it is awkward, because the only trace back to the author disappears. The answer is not a technical setting but a separation: rights information belongs in the register, not in the delivered file. And because images carry statements too — a leaf symbol, a seal, an award — it is worth reading the article on environmental claims on websites before publishing.
- Image credits live in the old template and are left behind when the visual design changes
- Old pictures return through a backup even though their licence has expired
- Cropped variants are created afresh without editing being covered by the licence
- People who have left the company reappear on archive pages
- Preview images for social networks pull motifs whose licence only covers your own site
When a warning letter arrives
A warning letter about an image follows a fixed pattern: cease-and-desist declaration, damages, legal fees. The German Copyright Act sets requirements for its form — it has to name the injured party, describe the infringement precisely and break down the payments claimed; if it fails to do so, it is ineffective. Recoverable costs are capped at an object value of 1,000 euros (German Copyright Act). That cap, however, applies only to natural persons who do not use the work for their commercial or self-employed professional activity, so it does not help a company. At the upper end sits the criminal provision: communicating a work to the public without the consent of the entitled party can be punished with imprisonment of up to three years (German Copyright Act) or a fine. That matters are settled through civil law in most cases does not change the legal position. Keeping your legal notice in order means such letters reach you at all, which helps here because the deadlines are short.
What helps in that situation is sequence. First: the disputed image comes off the site immediately, including preview images, archive pages and article thumbnails. Second: your own documents are located before anything is signed — a maintained records folder answers within minutes whether a licence existed and how far it reached. Third: the pre-drafted cease-and-desist declaration is reviewed by a lawyer, because it regularly reaches further than the infringement complained of and provides for a contractual penalty going forward. Fourth: the deadline in the letter is taken seriously, even where the claim looks excessive. And fifth: the matter is documented so that the same file does not travel back onto the site at the next rebuild.
Two reflexes that make it more expensive
How to bring the image stock into order
The route there is manageable and can be completed in one pass. First a complete list of all delivered image files is compiled, including motifs that only sit in templates, backgrounds and open graphic formats. Then an origin is assigned to each picture; everything without an assignment lands on a clarification list. For the cleared images the document goes into the folder and the permitted use into the row; for pictures showing people the consent joins them. Whatever cannot be clarified is replaced: by a shot of your own, a newly licensed image or a design that works without a photograph. Our services around building and running a site cover this process as well.
The effort arises once and lasts a long time afterwards. New images only reach the site together with their record, the register grows along with them, and at the next rebuild the question of origin is answered in minutes rather than days. If you are unsure how many of your pictures are cleared, a review is the fastest route to a reliable answer — talk to us and we will look at the stock and tell you what needs doing and what you can leave alone.
Sources and Studies