What to Do About a Photo of You Online You Didn't Consent To

Why a photo of you counts as your personal data

A clear, recognisable photo of you is personal data under UK GDPR, because it identifies a specific living person — you. That matters, because it means the rights you'd associate with text records (like your name or email) can also apply to an image. The organisation or person responsible for publishing it is acting as a data controller, and they have obligations about how they use it.

Consent is only one of several lawful reasons someone might have for using your image, and it isn't automatic just because a photo was taken in a public place. If a photo was posted without your agreement, it's reasonable to ask the controller which lawful basis they're relying on — and, where consent was the basis, to withdraw it. Withdrawing consent should be as easy as giving it.

It helps to separate two questions early: who is showing the photo (a friend, a stranger, a business, a publisher) and where it lives (a social platform, a forum, a news site, a search result). Those two answers shape which route is most likely to work. This article is general information, not legal advice.

• A recognisable image of you is personal data — your data-protection rights can apply to it.
• Consent isn't the only lawful basis, and a public setting doesn't remove your rights.
• Identify both the publisher and the location of the photo before you act.

A calm, ordered way to handle it

You don't have to do everything at once, and you don't have to escalate straight away. Working through it in order tends to be faster and less stressful than firing off complaints in every direction. Keep a simple record as you go — dates, links, and copies of what you sent — so you're never starting from memory later.

OSINTA is a self-only tool: it can help you see where your own footprint appears and draft your own requests, but you decide what to send and to whom. The system suggests; you decide. Nothing here removes anything on your behalf or guarantees a particular result.

• 1. Capture the evidence. Save the URL of each place the photo appears and take a dated screenshot, in case the page changes later.
• 2. Try the direct route. If you know who posted it, a short, polite message asking them to take it down often resolves things fastest.
• 3. Use the platform's own tools. Most social sites and forums have a reporting or image-removal form for content posted without consent — use the category that fits.
• 4. Send a written request to the controller. If direct contact doesn't work, write to the site or organisation, identify the photo, and ask them to stop using it and to erase it, explaining it was published without your consent.
• 5. Escalate if needed. If the controller refuses or ignores you, you can complain to the relevant data-protection regulator — in the UK, the Information Commissioner's Office (ICO).

When the photo also shows up in search

Sometimes the original page is the real problem; sometimes it's the fact that the photo surfaces when someone searches your name. These are handled separately. Getting a page changed or taken down deals with the source, while a search engine can be asked to de-list a result so it no longer appears for searches of your name — even if the original page stays up.

Search engines offer their own removal and de-listing request forms for this. Approaching the source and the search result in parallel is reasonable, because each addresses a different part of how the photo is seen. Remember that de-listing affects whether a result appears in search, not whether the underlying page exists.

It's worth being realistic: outcomes depend on the controller, the platform, and the facts, and no one can promise a specific result. What you can do is make a clear, well-evidenced request through the right channel, and keep a record so you can escalate calmly if you need to. This is general information, not legal advice — for a situation involving safety, harassment, or anything sensitive, consider speaking to a qualified adviser.

• The source page and the search result are two separate things to address.
• De-listing changes what appears in search, not whether the original page exists.
• Keep dated records of every request so escalation is straightforward.

Frequently asked questions

Related terms

• Consent
• Personal data
• Right to erasure
• GDPR (General Data Protection Regulation)