Managing consent
Consent management for media libraries
Consent management shouldn't depend on memory or paperwork. LightRocket links consent to people, not files, helping schools and other organisations stay compliant and audit-ready.
What is a consent management platform?
A consent management platform is a system for collecting, storing, and tracking consent for how someone's photo or video can be used, keeping a clear record of what was agreed, by whom, and for how long.
Digital rights and consent management is evolving. Fast. What was once often viewed as an after-thought, has become a critical component of any secure digital media library. If your media library includes photographs or videos of people, managing consent is more complex than simply doing the paperwork. Done properly, it reflects something more fundamental: safeguarding the people in those photos and respecting their data privacy.
Often, the challenge doesn’t lie in collecting consent (that’s the easy part), it’s staying informed about that consent that is tricky. As digital media libraries grow, students leave, staff members change, consent documents are modified or new ones signed, how does an organisation keep track of who gave consent, and to what exactly? And what happens when consent changes?
Let’s see how a digital asset and consent management platform can help. We’ll cover what consent management actually requires, what the law demands, and what a properly designed system makes possible.
On this page
- What is a consent management platform?
- Who needs consent management?
- Consent has become a governance priority
- The difference between simply collecting consent, and managing it
- Linking the person to their consent
- What happens when consent changes?
- How LightRocket approaches consent management
- Managing different consent obligations
Who needs consent management?
Any organisation or institution that holds a visual media library containing images of people needs a clear consent management framework. These can include:
Schools and educational institutions
Images of minors require parental or guardian consent, and the legal and reputational stakes of mismanagement are significant. Parents are increasingly aware of their rights and more likely to ask data privacy-related questions. Schools that can answer them confidently not only show their commitment to safeguarding their students, but they are in a stronger position to remain legally compliant under growing data privacy laws and regulations.
NGOs and humanitarian organisations
Fieldwork frequently involves photographing people in vulnerable situations. The ethical and legal requirements around consent in these contexts are demanding, and the reputational consequences of mismanagement can be severe and lasting.
Research institutions and GLAM organisations
Media libraries built over decades often contain images from before modern consent frameworks existed. Retroactive consent management is a real challenge for these collections, and a system that makes it tractable rather than overwhelming is genuinely valuable.
Media organisations and broadcasters
Editorial archives are subject to evolving legal frameworks across multiple jurisdictions. The EBU trusts LightRocket to manage thousands of assets in real time during events like Eurovision, a context where both the volume and the sensitivity of content demand robust, reliable infrastructure.
Consent has become a governance priority
For most of the 20th century, photographing people in public required little more than editorial common sense. That has changed. The EU's GDPR, enforced since 2018, treats photographs as personal data, and breaches can result in significant fines. Singapore and Thailand’s PDPA laws take a similar approach, applying heavy penalties for organisations that mishandles personal data, schools included.
An unmanaged media library is a source of legal risk
The direction of travel, wherever you operate, is the same: privacy is being treated as a fundamental and legally enforceable right, not an administrative courtesy. For organisations that hold visual media libraries, or what many still call their archive, protecting privacy is no longer optional, it’s imperative. An unmanaged media library almost certainly means an unmanaged database of real people's faces, which is equivalent to a growing source of legal risk.
The difference between simply collecting consent, and managing it
The gap most institutions don’t see until it’s too late
Most institutions understand that consent needs to be collected but the bigger challenge, and the one that creates real risk, is keeping consent connected to the person it covers. And ensuring connected consent is kept up-to-date across your system is even harder.
The typical approach looks something like this: consent forms are sent out and signed, saved as PDFs (or filed as paper documents), and stored somewhere separate from the photographs they relate to. This feels like a boxed ticked and problem solved… but is it?
When questions around consent arise, whether a legal inquiry, a change in permissions, a regulatory review, or someone asking how their image has been used, the ability to answer quickly, confidently and accurately depends on being able to link consent forms and individuals, and being able to review the details of the consent granted.
Managing consent without a system is ineffective and risky
If the consent form is in a filing system and the image is in a shared drive, the link between them exists only in someone’s memory or in a spreadsheet (which may not have been updated in a while). This ad-hoc approach is ineffective, leaving library managers and organisations vulnerable to legal risks.
This problem compounds over time, too. Many organisations, schools included, hold media libraries built up over decades, often from periods when consent practices were less rigorous. There's no quick fix for that kind of legacy backlog, but the right system stops it from growing while making it steadily easier to resolve.
A school uses a sports day photo in its prospectus. A parent asks for their child to be removed from all future materials, effective immediately. Without a system linking consent to that student and tracking every asset they appear in, the school can't identify every photo, confirm what was originally agreed, or prove to the parent, or a regulator, that the request was carried out.
Linking the person to their consent
There’s an inherent structural limitation in how most systems approach consent management: consent is linked to files and not individuals.
For a simple commercial shoot with one model, one release form, one photograph, this approach works reasonably well.
But for institutions such as schools or international organisations, it breaks down as soon as an image contains more than one person, which is the reality for majority of photos produced by schools or in the field.
Many pictures will show multiple individuals, each with their own consent status.
Linking a single consent form to the file treats them as a collective when the law (and basic ethical practice) treats them as individuals; your consent management system needs to do the same.
A photograph from a school play might contain forty children, a field photograph from a community health programme might show a dozen individuals, an event photograph might include staff, guests, and members of the public. Each face belongs to a person with their own consent status, their own right to withdraw, and in the case of minors, their own legal guardian whose permission is required.
What happens when consent changes?
Consent is a fluid process; it can be withdrawn, it expires, and circumstances change. An efficient system will manage these changes in real time.
For example:
- A student photographed for a school newsletter becomes an adult who may have very different views about how their image is used.
- A research subject who consented to their photograph being used in internal reports may not have anticipated or consented to it appearing in a public-facing publication years later.
- A member of staff who agreed to appear in marketing materials leaves and wants their image removed from the organisation’s library.
The right to erasure, enshrined in GDPR and increasingly reflected in other privacy frameworks, means that organisations are not just responsible for collecting consent, they are responsible for promptly acting on its withdrawal, and for being able to demonstrate that they have done so.
This requires a system that can quickly answer and reliably act on the following three questions:
- Who has consented?
- Which assets are concerned?
- What happens to those assets if consent is withdrawn?
Without clear answers to these, compliance is merely a promise rather than a practice.
How LightRocket approaches consent management
LightRocket’s consent management system was designed from the ground up by people with decades of hands-on experience in media, archives, and the specific challenges of managing visual content at scale.
Consent linked to people, not files
Every person in your media library is identified, by hand or by AI, and tied to their own consent record. AI's job stops at identification, it never touches, generates, or alters the image itself. Withdraw consent, and the system finds every asset that person appears in, automatically.
Send consent requests
Send consent requests by email, linked to each person's record in your media library, no more manual follow-up or paper trails. Already have a student directory, beneficiary register, or staff system? LightRocket connects to it, so you're not building a parallel record-keeping structure from scratch.
Build consent forms
Build and edit consent forms, or model releases, within the platform, with custom fields and jurisdiction-specific language. Once published, a form is fixed and uneditable, giving it stronger legal standing than a document that could quietly be changed later.
Searchable, traceable, and secure
One click takes you from any asset to its consent form, or from a form to every asset it covers, ready to stand up to scrutiny from a regulator or legal team. Consent data lives on AWS infrastructure built for eleven-nines durability, governed and auditable by default.
Managing different consent obligations
Consent management across jurisdictions
Consent requirements vary by country, and organisations working across borders, schools with international families, NGOs, broadcasters, often navigate several legal frameworks at once. LightRocket doesn't offer legal advice, but it gives you the flexibility to create different consent forms per jurisdiction, apply them to the right assets, and keep a clear record of what was agreed and under which framework.
This matters just as much for schools as for international NGOs. For example, a school in Singapore and a school in Thailand sit under different consent obligations, and an international school serving both local and overseas families may need to satisfy several frameworks at once.
Essential parental and guardian consent
Photographing minors introduces a distinct set of requirements: consent must come from a parent or legal guardian, the legal standards are higher, and the consequences of mismanagement are more serious.
LightRocket’s system handles parental and guardian consent as a specific workflow.
Consent requests can be directed to the appropriate party, forms can be configured to reflect the specific legal requirements around consent for minors, and the system keeps every child’s likeness connected to a valid consent form at all times. Students and parents can see exactly what they have agreed to and withdraw easily, because consent that is hard to understand or hard to reverse is not really consent at all.
For schools in particular, this is not a peripheral feature but rather a core part of safeguarding students through a secure, data privacy process.
Parents have reasonable expectations about how photographs of their children are collected, stored, and used, and increasingly they are asking questions. A school that can answer those questions clearly and confidently, and one that can prove compliance to data protection laws, shows a commitment to protecting their students and is in a far less vulnerable, legal position.
We’d love to explain more…
Still got questions?
Curious to see LightRocket in action? Want to know more about pricing? We’re always happy to show off our system and, yes, we’ll even help out with discounts and pricing.