A company is using my photo for marketing without consent. Is this legal?

What the Law Says

UK law protects individuals from unauthorised use of their image in ways that affect privacy, reputation, or personal data rights.

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, using your photograph for marketing constitutes 'processing' of personal data. This requires a lawful basis — such as your explicit consent — unless another condition applies (e.g., legitimate interests, which rarely overrides individual rights in marketing contexts).

The Protection of Freedoms Act 2012, s. 1, makes it an offence to take or use a photograph of a person on private premises for purposes likely to cause distress — though this does not cover all public or commercial uses. More broadly, misuse of image may engage Article 8 of the European Convention on Human Rights (right to respect for private life), incorporated into UK law via the Human Rights Act 1998.

If the use falsely suggests you endorse the company or product, it may also amount to passing off or defamation — both requiring proof of damage to reputation or goodwill.

Statutory Text

Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes...

— UK GDPR, Art. 6(1)(a)

Statutory Text

‘Personal data’ means any information relating to an identified or identifiable natural person...

— UK GDPR, Art. 4(1)

Sources