Get permission in writing, make it specific about where the photo will appear and for how long, keep it attached to that client's record, and be able to take the post down within a working day if they change their mind. Under India's Digital Personal Data Protection Act, 2023 a photograph of an identifiable person is personal data, and consent has to be free, specific, informed, unconditional and unambiguous — with withdrawal as easy as giving it was. A nod at the mirror does not survive being asked about later.
This is how careful businesses run it, not legal advice. If you are doing anything unusual — minors, medical-adjacent claims, paid usage — ask somebody qualified.
What “specific” means in practice
Most client-photo consent fails on specificity rather than on the absence of a yes. The client agreed to “a photo”. You then used it on Instagram, on a printed poster in the window, in a WhatsApp broadcast and on your Google Business Profile, for two years. Each of those is a separate use, and the second year was not something anyone had in mind.
A line that holds up says four things: which photo, where it may appear, for how long, and how to change their mind. Something like:
I agree that the photographs taken today (before and after) may be used by <business name> on its Instagram, Facebook and Google Business Profile, and in messages to the business's own contacts, for up to 12 months. I can withdraw this at any time by telling the business or writing to <email>, and the photographs will be removed within one working day.
Tick boxes beat a signature block, because a client who is happy for the “after” but not the “before” can say so in two seconds. Separate lines for before, after, and face visible. A client who ticks only after and not face visible has just told you exactly how to frame the shot.
The four mistakes
- Treating one yes as a standing yes. The client who was delighted in March did not consent to the September post. Ask each time, or make the timeframe explicit in the line itself.
- Posting the “before” when they only pictured the “after”. This is the one that generates complaints. People imagine the flattering photo. The unflattering one, captioned as a problem you fixed, reads very differently to the person in it.
- Minors. A child's haircut photo needs the parent's consent, and the DPDP Act is notably strict about processing children's data. Many businesses simply decide not to post children at all, which is a defensible policy and much less work than the alternative.
- Photos nobody knew were being taken. A staff member shooting over a shoulder for the business account is the most common source of the awkward conversation. If the camera is out, the client knows.
Withdrawal is an operations problem, not a policy problem
Anyone can write “you may withdraw consent at any time”. The question is whether, when somebody messages you on a Friday evening, you can find every post that used their photograph. If the answer involves scrolling back through a year of your own Instagram grid, you cannot honour the promise you made.
What makes it workable is boring: the consent lives on the contact record, and the posts that used that person's photo are tagged with the same record. Then a withdrawal is a lookup rather than an archaeology project. Contacts in Audience & CRM carry consent state with a date, and the same module has export-and-erase tooling for when a client asks what you hold on them.
Framing that reduces how much consent you need
The quiet trick: a lot of before-and-afters do not need a face at all. Crop to the hair from behind. Shoot the nails, the brows, the colour melt. A back-of-head colour transformation is often the better photo — nothing competes with the work — and it takes the hardest consent question off the table. Save the full-face shots for the clients who are genuinely pleased to be seen.
Two practical notes that improve the photograph regardless: same spot, same light, every time, so the “after” is not just better lighting; and no filter on either frame, because a client who arrives expecting the filtered result is a complaint waiting to be written.
Say when an image has been edited
If you retouch, or if a tool generated part of the image, label it. Beyond the obvious fairness argument there is a practical one: an “after” that a client cannot reproduce in the mirror is the most expensive kind of content you can make. Images produced in Content Studio can carry C2PA Content Credentials, which travel with the file and record that it was edited — so the claim is in the image rather than in your memory of what you did to it.
Where consent and approval meet
Everything the engine drafts waits for a human by default. That matters more here than anywhere else on this site: the person who knows whether this particular client agreed to this particular photograph is you, standing in the room, and no automation should be allowed to guess. Named approvers, an approval queue and a tamper-evident record of who approved what are in governance.
What the engine does today, without hedging
Everything on this page that is about deciding, writing, designing, timing and recording works right now. The engine drafts the offer in your voice, sizes the image, picks the hour from your own past results, holds it in an approval queue, gives it a tracked link, and files the person who replies as a contact with a consent record.
Instagram, LinkedIn and YouTube publish the moment you approve. Everything else arrives in your post kit finished — the image, the caption and the hour to post — one tap from your phone. The plan, the calendar, the lead page, the contact list and the reporting run either way.
This page is one of six moves. The pillar it belongs to — how an appointment business fills weekday afternoons — explains how they fit together, and links the other five.