Every website project eventually reaches the team page. Someone suggests using the photos from the last office party, someone else wants a customer's face next to their testimonial, and the question "did they agree?" gets the same answer almost every time: "yes, I mentioned it to them." On the websites we build, it's one of the few content decisions with a direct legal consequence.
Two regimes apply at once, and they answer different questions. Civil law asks whether you may publish the image. Law 25 asks how you handle that personal information afterwards: for what purpose, for how long, and what happens when the person changes their mind. A good written release settles both. A verbal one settles neither, because you can't prove it.
The short answer, for the busy
Publishing an employee's or customer's photo on your business website requires their consent, for two reasons that stack. The first is civil law: the Civil Code of Québec (articles 35 and 36) and the Charter of Human Rights and Freedoms (section 5) protect the right to one's image, and in Aubry (1998) the Supreme Court of Canada held that there is a fault as soon as an image is published without consent and enables the person to be identified. The second is Law 25: a photo of an identifiable person is personal information, used only for the stated purposes, for a limited time, and with consent that can be withdrawn. Under 14, a parent or tutor consents. For employees, the power imbalance calls for a pressure-free request, kept separate from the employment contract. The written release should name the purpose, the channels, the duration and how to withdraw.
Two laws, two questions
The first layer is the right to one's image. Article 35 of the Civil Code sets the principle: "The privacy of a person may not be invaded without the consent of the person or without the invasion being authorized by law." Article 36 lists, among invasions of privacy, "using his name, image, likeness or voice for a purpose other than the legitimate information of the public." A team page or a testimonial exists to sell, which puts it outside the legitimate information of the public.
The second layer is Law 25, whose section 2 defines personal information as any information that relates to a natural person and allows that person to be identified, directly or indirectly. The Commission d'accès à l'information (CAI) lists a photograph among its examples in its Guidelines 2023-1 on consent. Once you hold a photo of a recognizable person, the usual obligations apply: set the purpose before collecting, announce it, don't use the photo for anything else without fresh consent, and destroy the file when the purpose is achieved.
What Aubry decided
The Quebec reference is Aubry v. Éditions Vice-Versa, decided by the Supreme Court of Canada on 9 April 1998. A photographer took a picture, in a public place, of a 17-year-old sitting on the steps of a building. An arts magazine published it without her consent, in an issue that sold 722 copies. The trial court awarded her $2,000, and the Supreme Court upheld the decision, five judges to two.
For the majority, the right to one's image is part of the right to privacy protected by section 5 of the Charter, and includes the ability to control the use made of one's image. So there is a fault "as soon as the image is published without consent and enables the person to be identified." The public setting made no difference.
The exceptions are where businesses tend to reassure themselves wrongly. The public interest can prevail for a public figure, and someone who appears incidentally in a photo of a public place, or in a crowd at a sporting event, cannot complain. But, the Court wrote, "the public nature of the place where a photograph was taken is irrelevant if the place was simply used as background for one or more persons who constitute the true subject of the photograph." On a team page, every face is the true subject.
Your employees: consent under a power imbalance
The employee whose boss asks "mind if we put your photo on the site?" isn't answering entirely freely. The CAI's guidelines give employer-employee relationships as the typical example of a power imbalance, and concede that the law offers no ready-made solution. Meanwhile section 14 of Law 25 requires consent that is "clear, free and informed" and given for specific purposes, failing which it is "without effect."
In an example drawn from the public sector that applies just as well to a business, a manager wants to send a newspaper a photo of their staff at work. According to the CAI, the request must not hint at any negative consequence for refusing, should be as neutral as possible, and each employee should answer separately to avoid group pressure. In other words, no show of hands at the team meeting.
So the release gets signed as its own document, outside the employment contract: section 14 requires a written request for consent to be presented separately from any other information. And refusing has to be a real option. The CAI suggests offering other ways to reach the purpose: a name and title without a photo, an illustration, a team shot the person isn't in. If a refusal leaves a visible hole in the page, the consent isn't free.
The day the employee leaves
Law 25 says consent is valid only for the time necessary to achieve the purposes for which it was requested, and the CAI gives an employee leaving their job as an example of an event that ends that period. Section 23 adds that once the purposes are achieved, the business must destroy or anonymize the information.
The answer, then, is written into the release. For the team page, the natural end is departure: the photo comes off the site within a timeframe you set. For an event photo in a news post, a longer period is defensible, as long as you write it down. What doesn't hold is the "in perpetuity, for all uses" release signed on the first day: it is neither specific nor temporary. To set these periods, see our article on how long to keep business records.
Withdrawal remains possible at any time. Section 8 requires you to inform the person of their right to withdraw consent, and the CAI recommends a simple, accessible mechanism: an email address in the release is enough.
Customers, testimonials and project photos
For customers, section 12 of Law 25 decides it: information may be used only for the purposes for which it was collected, and commercial prospecting can never count as a compatible purpose. A photo taken to document a job site or a delivery doesn't become an advertising photo by default. It needs its own release, as our article on the Law 25 consent form explains.
Project photos catch contractors and renovators most often. Article 36 of the Civil Code also covers "appropriating or using his image or voice while he is in private premises," and the inside of a home is exactly that. A face in a mirror, a family portrait on the wall or a house number on the facade is enough to make the customer identifiable. The practical rule: crop or blur before publishing, or get a signature.
Events, group photos and minors
Aubry recognizes that a person in a group photographed in a public place cannot object to publication if they aren't its principal subject. Your holiday dinner isn't a public place, and the photo of eight people around the table has eight principal subjects. Announce on arrival that photos will be taken, for what purpose and where they'll appear, with an easy way not to be photographed. For a photo where someone is the main subject, ask before publishing it. Taking a photo is already collecting, the same reasoning as in our article on security cameras and Law 25.
For children, section 14 of Law 25 provides that the consent of a minor under 14 is given by the person having parental authority or the tutor, and that of a minor 14 or over by the minor, the parent or the tutor. Discussing portraits of pupils (another public-sector example) shared with hundreds of parents, the CAI notes that widely circulated photos of children could be considered sensitive, and that express consent would have been the better choice. For a public website, go express, in writing, every time.
What the release should say
A good release fits on one page, and each clause meets a requirement.
1. Who and what. The person's name and the photos covered, such as a dated shoot or attached files. Specific consent doesn't cover "any future image."
2. The purpose. Why you're publishing: introducing the team, illustrating a testimonial, promoting a service.
3. The channels, one by one. Website, social media, print, paid advertising. Consent has to be granular: the person can say yes to the website and no to the ads.
4. The duration. A period or an event: two years, or leaving the company for an employee.
5. Withdrawal. Who to write to, how quickly the photo comes down, and what can't be recalled, such as a brochure already printed.
6. The signature. The person's, or a parent's for a child. Between 14 and 17, having both sign is the cautious choice.
Keep the signed release for as long as the photo is online: it's your only proof. And mention these uses in your privacy policy, one of the pages your site has to show according to our article on website legal pages in Quebec.
Where to start
Inventory the faces on your current site and look for the written release behind each one. Photos of former employees get fixed by taking them down. It's a question we ask at the start of a website project, well before the first request to remove a photo.
→ Let's talk about your site or see how we handle these questions in our web services.
This article explains legal obligations to help a business ask the right questions; it is not legal advice. The Civil Code of Québec, the Charter of Human Rights and Freedoms, the Act respecting the protection of personal information in the private sector and the positions of the Commission d'accès à l'information are authoritative: for a specific situation, consult a lawyer.
Written byXavier Peich