5.5Law, GDPR & ethics
The essentials in 30 seconds
- Image = writing before posting: identifiable face → written permission (who, what, where, how long); minors: legal guardians; remove without arguing.
- GDPR: 5 reflexes: minimize, inform, secure, keep briefly, delete on request — prior opt-in for prospecting.
- Ethics: visible #ad / #collaboration, no fake reviews, no stoked bad buzz, fair competition.
Threaded mini-case — Nour publishes by the rules
Nour also runs compliance: before each face, written permission; for her contest, rules (prize, draw, dates, data) and visible notices; for influence, systematic #ad. When a minor customer appears in a photo with no written consent from parents, she unpublishes at once. End of the 5.1-5.4 thread — Nour measures, listens, reports, strategizes and publishes by the rules.
End of cases 5.1-5.4 — Nour closes measurement, listening, reporting and strategy with compliance.
1. Image and consent: writing before posting
Identifiable face = written permission (who, what, where, how long); minors: legal guardians; possible withdrawal (unpublish without arguing). No writing: no publication. Nour gets signatures before each shoot.
The framework is illustrated under French law: check your local law (principles are close almost everywhere) — colleagues, customers and participants: belonging never equals automatic permission.
2. GDPR: the 5 social media reflexes
Minimize (no unnecessary data in DMs), inform (contests: rules + data use), secure (role access, no shared passwords), keep briefly (limited retention), delete on request. Prospecting: prior consent (opt-in) for electronic messages.
Nour's watertight contest: rules, visible notices, export of the winner only, other data deleted after the announced period.
3. Ethics: what the law does not say
Disclosures (#collaboration, #ad: transparency), no fake reviews (neither bought nor homemade), no stoked bad buzz, fair competition (no disparagement). Reputation takes years to build, one post to lose.
Transparent, sincere partnership: well accepted. Hidden advertising once exposed: destroyed credibility (influencer AND brand).
🔎 Concrete example — A watertight contest
The rules that protect Nour.
Rules: prize, draw, dates, data (use + retention announced).
Notices: visible rules in bio/link, fair participation.
Data: only winner kept for sending, others deleted after the period.
-> many entrants, zero complaints, clean opt-in list.Takeaway: rules protect the organizer as much as the players.
Lesson: fake reviews get detected and punished (platforms + law).
Section vocabulary
- Image rights
- Identifiable face: permission (ideally written) before publication.
Simple example: Nour gets each featured customer to sign, parents for minors.
What it is not: publishing because “they agreed orally”.
Reflex: do I have the writing (who, what, where, how long)? Otherwise blur.
- Copyright
- Protected images, music, texts: royalty-free or rights obtained.
Simple example: Nour uses only free libraries and authorized music.
What it is not: taking a web photo “because it is beautiful”.
Reflex: where does this content come from and which right comes with it?
- Disclosed partnership
- Paid content clearly indicated (#ad, partnership).
Simple example: Visible #ad from the first lines of Nour's post.
What it is not: a paid review presented as spontaneous.
Reflex: would a hurried reader understand it is paid?
- Personal data
- Minimal, informed, secured, limited, erasable collection.
Simple example: Contest: rules + use, restricted access, deletion after period.
What it is not: exporting all entrants and keeping them “just in case”.
Reflex: which data do I really need, and for how long?
- Ethics
- Honesty, respect, transparency beyond the legal minimum.
Simple example: Zero fake reviews, zero competitor disparagement at Nour's.
What it is not: buying reviews and followers to inflate.
Reflex: would I own this post in front of customer and competitor?
In practice — Respect law, GDPR and ethics
- Respect image (permission before any identifiable face) and copyright (royalty-free or rights obtained).
- Disclose sponsored content and partnerships (“advertising”, “partnership”); no misleading claims.
- Apply data rules: consent, information, security — contests, targeted ads, contacts.
- When in doubt, check local rules or consult an expert.
Ready-to-say script — asking permission (30 s)
“We would like to publish this photo where you appear, on our networks (named pages) for the agreed period. Do you agree? We will have you sign a small paper stating where and for how long — and if you change your mind, we remove it at once.”
Say before each shoot; minors: have legal guardians sign.
Copy-paste template — image permission + mini data log
IMAGE PERMISSION: person ___, what ___ (photo/video), where ___ (pages), period ___, signature + date ___.
MINOR: signing legal guardian ___.
CONTEST/DATA: use ___, announced period ___, access ___ (roles), deletion on ___.
PARTNERSHIP: mention ___ (visible #ad).
WITHDRAWAL: request received on ___ -> unpublished on ___.Small business / tight budget
Nour keeps a paper permission book: 1 line per face, photo of the paper in the file.
Public event
Inform upstream (signage + announcement), plan for opt-outs, feature only signatories.
Contest
Rules + visible notices + minimal data: watertight protects against complaints.
Influence / UGC
Simple contract: #ad mention required, post review, written usage rights.
✓ Best practices
- Require writing before any face.
- Apply the 5 data reflexes systematically.
- Display #ad and #collab visibly.
✗ Common pitfalls
- Publishing without consent (“they agreed”).
- Buying reviews and followers.
- Disparaging a competitor.
Key takeaways
- Networks = legal and ethical responsibilities, varying by country.
- Image (permission), copyright (rights), partnerships (disclosed).
- Data: collection and use framed (consent, information, security).
- Ethics: honesty and transparency; check locally when in doubt.
48h challenge — apply tomorrow
Check your last 10 published photos: do you have writing for each face? Add #ad to any forgotten partnership and note 1 piece of data to delete.
- I can name the 3 pillars (image, data, transparency).
- I can ask for writing and unpublish on request.
- I audited 10 posts + fixed 1 gap.
Frequently asked questions
Can I publish customers, participants or colleagues?
Not without permission as a rule: identifiable person = consent (ideally written). Plan info and signatures at events, get colleagues' agreement, blur when in doubt. Nuances by country and context — check locally.
Must I disclose a paid partnership?
Yes: generally a legal obligation AND a trust requirement. Visible mentions (#ad, paid partnership). Hidden advertising once exposed destroys credibility and exposes you to sanctions — check your country's rules.
Nour wants to post a smiling minor customer, with no writing from parents. Reflex?