Photographing weddings, trade fairs & events: when do you need a release?

You’re booked for a wedding, documenting a trade fair, or covering a corporate event — and almost every frame contains people who never hired you. May you photograph them? May you publish the images? And how do you realistically collect releases from 200 guests? This article walks through the legal situation in Germany and shows pragmatic ways to handle releases on site. As always: this is not legal advice but a practical orientation — for a concrete dispute, talk to a lawyer.

The key distinction: taking vs. publishing

Two questions often get mixed up that run on separate legal tracks:

May I take the photo? That’s a question of the GDPR (and the venue owner’s house rules).
May I publish the photo? Here Germany’s Art Copyright Act (KUG) and general personality rights come in on top.

In practice this means: permission to photograph is not automatically permission to publish. Someone smiling into your camera at a wedding has not consented to appearing on your Instagram feed or your website later.

A quick orientation, because the question comes up constantly: the KUG of 1907 governs the right to one’s own image — likenesses may generally only be distributed with the depicted person’s consent (§ 22), with exceptions in § 23. Since 2018 the GDPR applies in addition, because photos of identifiable people are personal data — and that’s true from the moment of capture, not just publication.

How the two laws interact is not conclusively settled. As a commercial photographer, the practical takeaway is: the GDPR applies to you in every case. The KUG’s value judgments (such as the exceptions for assemblies or incidental persons) still feed into the balancing test of whether processing is lawful. So for every photo with identifiable people you need a legal basis — and that doesn’t always have to be consent.

The three legal bases that carry you

Contract: Your client — the couple, the company, the organizer — booked you. Photos of the client themselves are covered by the contract.
Consent: The depicted person agrees. Strong, but with a catch: consent is revocable at any time and you must be able to prove it.
Legitimate interest: The most important basis for event photography. Your interest (documenting the event as commissioned) is weighed against the interests of those depicted. That works — but only with transparency: attendees must know that photography is happening and have a way to object.

When you (usually) don’t need an individual release

There are constellations in which neither individual consent is required nor publication fails under § 22 KUG:

Assemblies and events as such: Anyone attending a public event, parade or gathering must expect to appear as part of the scene — as long as the event is the subject, not the individual person. The wide shot of the packed hall: generally fine. The zoomed-in portrait of a single guest: a different story.
People as incidental elements: People who happen to be next to your actual subject (venue, decoration, stage) and could be removed without changing the picture.
Events of contemporary history: Relevant for press photography; rarely applicable to wedding and event photographers working on commission.

Important: these exceptions mainly concern publication. The GDPR duties — especially informing those affected — remain. And they collapse as soon as an image exposes someone or shows them in a particularly sensitive situation.

When you definitely need a release

Individual portraits and clearly focused persons — especially if you want to use them for your own marketing (portfolio, website, social media). Self-promotion is a different purpose than documenting the commission and needs its own basis.
Children: Maximum restraint required. Consent must come from the legal guardians — with separated parents, when in doubt, both. For publishing photos of children without an explicit release there is practically no defensible basis.
Sensitive contexts: Photos allowing conclusions about health, religion, political views and the like (the guest in a wheelchair as the focal point, a religious ceremony with focused individuals) are held to stricter standards.
Employee photos at corporate events: Employees are in a dependent relationship with their employer — the bar for voluntary consent is correspondingly higher. The employer cannot simply “order” consent.

The classic case: the wedding

A wedding is legally a hybrid: a private, closed event with a clear commission — but dozens of third parties in the frame.

The couple: covered by the contract. Regulate right there whether and how you may use images for your portfolio — as a separate, voluntary clause, not buried in the fine print.
The guests: Your basis is your legitimate interest in fulfilling the commission — the couple wants pictures of their celebration including guests, after all. For that to hold, guests must be informed. In practice: the couple announces the photographer in the invitation or at the reception, you’re recognizable as the photographer, and anyone who doesn’t want to be photographed can tell you — and you respect that consistently.
Delivering the images: Here the difference between an access-protected gallery for the couple and a public post is decisive. The password-protected gallery for your client is part of fulfilling the contract. The same images publicly on social media are a new processing purpose that needs its own basis.

Trade fairs, conferences, corporate events

Here the organizer is typically your client — and also the party best positioned to fulfil the information duties towards visitors:

Notice at ticket purchase/registration: “Photography and filming will take place at the event” plus a link to the privacy notice with purpose, controller and how to object.
Signs at all entrances, clearly visible, with the same information. A QR code linking to the full privacy notice keeps the sign lean.
A clear agreement with you: What will the images be used for (recap article, website, social media, press)? Every purpose should appear in the notice — what’s not listed isn’t covered.

Note that a sign alone is not consent (“by entering you agree” does not work under the GDPR) — it’s the transparency that makes legitimate interest viable in the first place.

Handling releases on site, pragmatically

For individual portraits it’s simple: a short model release — name, date, usage purposes, signature — conveniently digital these days via tablet or a form app so nothing gets lost. For events with many people, these patterns have proven themselves:

Before rather than on site: The cleanest solution is the notice in the invitation or registration. Anyone informed in advance can arrive relaxed — or let you know at the start.
The announcement moment: At weddings and company parties it works well when the host or MC briefly introduces the photographer: “If you’d rather not be photographed, just give X a quick heads-up.” That creates transparency and a clear objection channel.
Making opt-out visible: At larger events, colored wristbands, stickers or lanyards in a signal color work for guests who don’t want to be in pictures. This pragmatically flips the logic: instead of collecting 500 consents, you respect a handful of objections.
Photo zones: A designated photo corner (or the reverse: a camera-free zone at the bar) gives everyone clarity about where the camera is active.
The tip that saves the most trouble: For focused individual or couple shots, just ask briefly. A quick “may I?” costs two seconds, produces better pictures — and is transparency in action.

Document your measures (a photo of the entrance sign, a copy of the invitation text, a note about the announcement). If anyone ever asks, you can show you took your duties seriously.

When someone objects or requests deletion

An objection or deletion request isn’t an attack — it’s a normal data subject right. Your workflow should be prepared:

A person marks themselves or approaches you at the event → you don’t photograph them deliberately and cull images featuring them during editing.
A request comes later → you must remove the image from your published channels and generally be able to pull it from delivery too. That’s why a gallery solution pays off in which you can delete individual images completely — including all preview and web versions.

Quick checklist for your next event

Contract with the client: image purposes clearly named, portfolio use regulated separately.
Attendee information organized (invitation, registration, entrance sign with QR code).
Objection channel on site sorted (announcement, wristbands, approachability).
Children and sensitive subjects: only with an explicit release — or not at all.
Delivery via an access-protected gallery instead of public links.
Deletion workflow for objections in place and tested.

Conclusion

Event photography is legally workable without collecting a signature from every guest — if you rely on transparency instead of mountains of forms: inform, enable objection, actively ask in sensitive cases, and strictly separate publication from commissioned documentation.

Lumio takes the technical side off your plate: password-protected galleries instead of open links, hosting in Germany, DPA included — and if a guest objects, you delete the image with all its renditions in one step, traceably documented in the audit log. The releases themselves remain your craft. But everything after that, we make as easy as possible.