Photography Privacy Policy Template (Free Sample)
Updated October 23, 2026
A photography privacy policy template is a ready-made policy you edit with your own business details. The free sample below covers what photographers actually handle: client and booking data, model releases, EXIF and geotag metadata, gallery and proofing platforms, print labs, payment processors, and raw-file retention. Copy it, replace the bracketed text, and delete anything that doesn't match how you work.
Sample Photography Privacy Policy Template
Fill in or choose between the bracketed options, and delete sections that don't apply, such as print labs or second shooters.
Privacy Policy for [Your Photography Business Name]
Last updated: [Date]
1. Who We Are
[Your Photography Business Name] ("we," "us," or "our") is a photography business based in [City, Country] that operates [yourwebsite.com]. This policy explains what personal data we collect when you visit our website, book a session, or appear in our photographs, and how we use, share, and keep it.
2. Information We Collect
Contact and booking details. When you send an inquiry or book a session, we collect your name, email address, phone number, and details of your shoot, such as the date, location, session type, and any notes you share. For weddings and events, this can include venue addresses, timelines, and the names of family members or guests you give us.
Model release and consent records. If you sign a model release, we keep your name, signature, the date, and the uses you agreed to. For minors, a parent or guardian signs the release, and we keep their details too.
Photographs and image metadata. Photographs of identifiable people are personal data. Image files also contain EXIF metadata, which can include the date, camera details, and GPS coordinates of where a photo was taken. We remove location data from images we publish online. Files delivered to your private gallery [keep / do not keep] their original metadata.
Gallery and proofing activity. When you use your online gallery, [gallery platform] records your email address, the images you view, favorite, download, or order, and technical details such as your IP address and device.
Payment information. Deposits, invoices, and print orders are paid through [payment processor]. We receive payment confirmations and billing details, but we do not see or store your full card number.
Website usage data. Our website uses [essential cookies only / analytics cookies from [analytics provider]] to understand how visitors use the site. [If applicable: We also use [Meta Pixel / Google Ads tag] to measure our advertising.]
3. How We Use Your Information
- To answer inquiries, schedule sessions, and manage our contract with you
- To take payments and keep accounting records
- To edit and deliver your photographs and fulfil print and album orders
- To keep proof of the consent given in model releases
- To show images in our portfolio, website, or social media only where you have agreed to this
- To send newsletters or offers, only if you opted in
Where the GDPR or UK GDPR applies, our legal bases are: performing our contract with you (bookings, delivery, payment), legal obligation (tax records), consent (marketing emails, non-essential cookies, portfolio use where consent is required), and legitimate interests (running and securing our business).
4. Who We Share Your Information With
- Gallery and proofing platform: [Pixieset / ShootProof / Pic-Time / SmugMug] hosts your galleries and processes gallery orders.
- Print lab: [Lab name] receives the images you order and the name and shipping address needed to produce and deliver prints and albums.
- Payment processor: [Stripe / PayPal / Square] processes your payments.
- Booking and client management: [HoneyBook / Dubsado / Studio Ninja] stores inquiries, contracts, and invoices.
- Cloud storage and backup: [Google Drive / Dropbox / Backblaze] stores raw and edited files.
- Email and analytics: [Mailchimp / Flodesk] and [Google Analytics].
- Second shooters and editors: [If used] contractors who receive only the files and details needed for their work.
We do not sell your personal information. We may disclose information if the law requires it.
5. How Long We Keep Your Information
- Inquiries that do not lead to a booking: [12 months]
- Contracts, invoices, and booking records: [6 years], for tax and accounting purposes
- Raw (unedited) files: [12 months] after delivery, then deleted
- Edited images: in your online gallery for [12 months], and in our archive for [X years] so we can help with lost files or reprints
- Model releases: for as long as we use the images, plus [3 years]
- Marketing list: until you unsubscribe
You can ask us to delete your files and data sooner, unless the law requires us to keep them.
6. Children
Our website is not directed at children under 13, and we do not knowingly collect their personal information online. We photograph minors only with a parent or guardian's consent, and the parent or guardian may contact us at any time to access or delete their child's images and data.
7. Your Privacy Rights
Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data, to object to or restrict how we use it, and to withdraw consent at any time, including consent to portfolio or social media use of your images. Withdrawing consent does not undo uses already made, such as printed materials. If you are in the EU or UK, you can also complain to your local data protection authority. To make a request, email [your-email@example.com]. We respond within one month.
8. Security and International Transfers
We protect your data with password-protected galleries, secured accounts, and encrypted backups. Where providers store data outside your country, they use legally required safeguards such as standard contractual clauses.
9. Changes to This Policy
We may update this policy from time to time. The "Last updated" date above shows when it last changed.
10. Contact Us
[Your Photography Business Name]
[your-email@example.com]
[Business address]
If you'd rather answer questions than edit placeholders, you can build one for free with the privacy policy generator.
How to Customize the Template
- List every tool that touches client data. Replace the bracketed service names and delete lines you don't use. A privacy policy checker can flag integrations you missed.
- Check what really happens to EXIF data. In Lightroom Classic, the export dialog's Metadata section has a Remove Location Info option. Check your export presets and gallery settings, then make the template say what actually happens.
- Set retention periods you will actually follow. Check how long your tax authority requires you to keep invoices, then pick a raw-file period that fits your workflow.
- Match your model release. Section 3's portfolio wording should match what your release grants.
- Publish it on its own page and link it from the places listed below.
Clauses Generic Templates Miss
Model releases are data records too. A release covers using someone's image, not how you store their name, signature, and address. The privacy policy covers that.
Geotags in delivered files. GPS coordinates from a newborn or family session can show a client's home address. Say whether you strip location data, and where.
Wedding and event guests. Guests appear in your images and on guest lists without ever visiting your website. Say that you receive their details from the booking client and how a guest can contact you.
Print labs and subcontractors. Print labs, album makers, second shooters, and outsourced editors all receive client files. Name them as recipients.
Raw-file retention. Raw files hold every frame and full metadata. Give them their own retention period, not a vague "as long as necessary."
Which Privacy Laws Apply to Photographers
- GDPR and UK GDPR. These apply if your business is based in the EU or UK, or if you offer your services to people there.
- CalOPPA (California). Any commercial website that collects personally identifiable information from California residents must post a privacy policy. In practice, this covers most US photographers with a contact form.
- CCPA/CPRA (California). This applies only to businesses that meet its thresholds, such as annual revenue above roughly $26.6 million or handling the data of 100,000+ consumers. Most solo photographers fall below them.
- COPPA (US). This applies if your website collects personal information directly from children under 13.
- PIPEDA (Canada). This requires meaningful consent and limits collection to what you need.
Unsure whether your website needs a privacy policy at all? A site with a contact form, analytics, or online payments almost always does.
Where to Display Your Privacy Policy
Link your policy in your website footer, next to the submit button on inquiry and booking forms, on gallery access pages, in email footers, and in your cookie banner if you use non-essential cookies.
When your tools or workflow change, a free privacy policy generator makes it quick to produce an updated version.
Frequently Asked Questions
Is it a legal requirement to have a privacy policy on a website?
Often, yes. CalOPPA requires commercial websites that collect personal information from California residents to post one, and the GDPR and UK GDPR require privacy information whenever you collect personal data. Google Analytics' terms also require disclosure. A photography site with a contact form, gallery logins, or analytics should have one.
What privacy policy is required for a website?
It should explain what personal data you collect, why, who receives it, how long you keep it, what rights people have, and how to contact you. GDPR-covered businesses must also state their legal bases. Photographers should cover bookings, model releases, image metadata, galleries, print labs, and payments.
Can you provide an example of a privacy policy for a website?
Yes. The sample photography privacy policy on this page is a complete ten-section example covering data collected, uses, recipients, retention, children, rights, security, changes, and contact details. Copy it and replace the bracketed placeholders.
How do you write a simple privacy policy?
List the personal data you collect, explain why you use it, name the services that receive it, set a retention period for each type, describe people's rights, and give a contact email. Use plain language and describe what you actually do.
Can I make my own privacy policy?
Yes. No law requires a lawyer to write it; it just has to describe your data practices accurately. Adapt a template like the one above or use a generator, and consider a lawyer's review if you handle unusual or sensitive data.
Can a photographer use my photos without consent?
It depends on the use and location. In the US, photographers usually own the copyright and can often use images in a portfolio, but using your likeness in advertising generally requires a model release. In the EU and UK, photos of identifiable people are personal data, so publishing them needs a lawful basis such as consent. Your contract usually sets the agreed uses.
Is it legal to use photos on a website without permission?
Generally, no. Photos are copyrighted from the moment they are taken, so you need a license unless fair use applies or the image is in the public domain. Commercial use of photos showing identifiable people may also need their consent or a model release.