Guide · Photographers

Your photos,
their faces.

Two separate laws decide what happens to a client's photos. Copyright decides who owns the pictures and who may copy them. Privacy law decides whether you may use a recognisable person's image to promote your business. Owning the copyright does not settle the second question, and Canada's privacy regulator has said so in a case about a wedding video.

Published 2026-11-04 · Formory Marketing Group

Under section 13(1) of the Copyright Act, the author of a work is the first owner of its copyright, and photographs are artistic works under section 2. For a commissioned photo that means the photographer, unless the photographer is an employee taking pictures in the course of employment, in which case section 13(3) gives the copyright to the employer, absent an agreement to the contrary.

This changed in 2012. The old section 13(2), in force until November 6, 2012, made the person who ordered and paid for a photograph or portrait its first owner, absent an agreement to the contrary. It was repealed by a 2012 amending Act (S.C. 2012, c. 20), whose section 60 keeps the old rule for photos commissioned before the repeal, so a client may still own copyright in a portrait ordered in, say, 2010.

Copyright in a photo generally lasts for the photographer's life plus 70 years after the end of the year of death (section 6).

Section 32.2(1)(f) gives clients a limited right. It is not an infringement for an individual to use, or let others use, for private or non-commercial purposes, a photograph or portrait they commissioned for personal purposes and paid for, unless the client and the copyright owner agreed otherwise.

So a couple can print their wedding photos, frame them and post them to their own social accounts without asking. The exception is written for individuals who commission photos for personal purposes. A business that commissions headshots, product shots or photos of its premises is not covered by it, and its rights to use the photos on a website or in ads come from the licence or assignment you give.

Under section 13(4), an assignment of copyright, or a licence granting an interest in it, is valid only in writing, signed by the owner or the owner's authorised agent. An emailed "sure, use them" is weak ground for either side. Put the scope in the contract: which photos, which uses, which media, how long, and whether the licence is exclusive.

The Personal Information Protection and Electronic Documents Act (PIPEDA) defines personal information as information about an identifiable individual, and it applies to organisations that collect, use or disclose it in the course of commercial activities. A recognisable photo of a person is that kind of information. The Office of the Privacy Commissioner lists Alberta, British Columbia and Quebec as the provinces with their own private-sector privacy laws; Ontario's similar law covers only personal health information. For an Ontario photography business, PIPEDA is the rule.

In PIPEDA Findings #2014-020, a videographer posted a client's wedding video on a wedding-vendor listing site and on social media. The client had not agreed. The videographer argued that the video was artistic and that his copyright let him use it as he saw fit. The Commissioner found that showing the video to attract clients was a commercial purpose, that it needed the client's prior and informed consent, and that none of the exceptions applied. The video came down. The Office's takeaway is direct: photographers need their clients' consent before posting photos of them online for promotional purposes, on websites or social media.

PIPEDA's section 4(2)(c) does exclude personal information used for journalistic, artistic or literary purposes, but only where it is not used for any other purpose. A portfolio that markets your business is another purpose.

In the 2014 case the videographer said the client had agreed verbally to portfolio use in exchange for a lower price. There was nothing in writing, the discount was not in the contract, and the Commissioner found there was no consent. The fix the videographer agreed to was consent language in future contracts.

PIPEDA's consent principle requires that people understand how their information will be used (clause 4.3.2 of Schedule 1), and section 6.1 says consent is valid only if the person would understand the nature, purpose and consequences of what they agree to. The OPC's guidelines for obtaining meaningful consent add that express consent is generally needed when information is sensitive or the use is outside what the person would reasonably expect. Clause 4.3.3 says a business cannot require consent beyond what the service needs as a condition of supplying it, and clause 4.3.8 lets people withdraw consent, subject to legal or contractual restrictions and reasonable notice.

For a photographer, the practical version is a written release that is separate from the booking itself: a box or signature for portfolio and social media use, naming the places the photos may appear, with a way to say no and still book.

The OPC's position is that, in all but exceptional circumstances, children under 13 cannot give meaningful consent, so consent must come from a parent or guardian. For older minors, the process has to take their maturity into account.

In PIPEDA Findings #2025-005, published November 25, 2025, a private swimming pool made parents accept a waiver allowing photos and videos of their children to be used for promotion, including on its website and social media, before the children could take lessons. The OPC found that images of children in swim attire are sensitive, that promotional photos were not necessary to deliver lessons, and that the pool should seek express opt-in consent. The pool agreed to change its registration process.

For family, school, sports and dance photography the same logic applies: ask a parent separately and expressly before a child's photo goes on your website or Instagram, and leave the child out if the answer is no.

Moral rights stay with the photographer even after copyright is sold (section 14.1). They include the right to be credited where reasonable and the right to integrity, which is infringed only when a work is distorted, modified or used with a product, service or cause to the prejudice of the author's honour or reputation (section 28.2). Moral rights cannot be assigned but can be waived, and the Canadian Intellectual Property Office notes that a waiver cannot be undone. If a business client will crop or retouch your images, the contract should say so.

A © notice is not required in Canada, but CIPO says it reminds people the work is protected and can count against a claim of innocent infringement. If someone posts your photos for commercial purposes without permission, section 38.1 lets a copyright owner choose statutory damages of $500 to $20,000 per work instead of proving actual losses.

The booking contract: who owns the copyright, what licence the client gets (personal use for individuals, a defined commercial licence for businesses), whether moral rights are waived for edits, and a separate, optional portfolio release with the uses listed. For minors, a parent's signature on that release.

The website: a privacy policy that says how client photos are used and how to ask for removal, and a quick way to take an image down when someone withdraws consent. Our notes on websites for photographers cover the rest of the site.

This is a plain summary of the Copyright Act, PIPEDA and the Privacy Commissioner's guidance as of November 2026, not legal advice.

• Copyright Act, R.S.C. 1985, c. C-42 — sections 2, 6, 13, 14.1, 28.2, 32.2, 38.1; 2012, c. 20, s. 60
• Copyright Act — version of section 13 from 2002-12-31 to 2012-11-06
• A guide to copyright, Canadian Intellectual Property Office
• Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 — sections 2, 4, 6.1 and Schedule 1
• PIPEDA in brief, Office of the Privacy Commissioner of Canada
• PIPEDA Findings #2014-020: Videographer posts client’s wedding video on social media without consent
• PIPEDA Findings #2025-005: Swimming pool’s compliance with consent requirements
• Guidelines for obtaining meaningful consent, Office of the Privacy Commissioner of Canada

Or call (416) 989-3208. One of us answers; there is no sales team.

Does a Small Business Website Need a Privacy Policy in Canada? · Photographs for a Trades Website: What to Shoot and How · Can You Ask for Google Reviews? Yes

All guides · Glossary · The GTA report · Pricing · Free site check

Check my website free Read the full GTA report

Start a project See our work