Can a hair salon or beauty centre publish before/after photos of its clients on social media?

Yes, provided it has the client's express, specific, informed and withdrawable consent for that particular purpose. Publishing a recognisable image of a natural person on social media simultaneously triggers two legal regimes: the GDPR (the image is personal data and, when recognisable, constitutes data processing) and Organic Law 1/1982 (Spanish law on the right to honour, personal/family privacy and own image). Authorisation by the data subject is required under both. Consent cannot be presumed because the client came to the centre, because the photo was taken at the chair, or because they accepted a generic privacy policy. Consent to publish on social media is independent and specific for each purpose: the centre's website, Instagram, TikTok, shop-front signage. The client may consent to some of these and refuse others, and may withdraw consent at any time.

What if the photo does not show the client's face, only the hairstyle, nails or treatment result?

If the person is not identifiable in the image (hair only, no face; nail detail; result on a body area with no identifying features), the content falls outside the scope of the GDPR and of Organic Law 1/1982 in relation to that specific person, because it no longer constitutes personal data. This must be assessed case by case and realistically: if the photo includes a unique tattoo, a personal mark, recognisable jewellery, the salon background with the client partly visible, or any element that allows someone who knows them to identify them, it remains personal data and consent is needed. As a practical rule, the professional centre always asks for consent, even where the photo looks anonymous, because it makes the team's work easier, avoids grey areas and builds the client relationship. The difference with a client whose face does appear is the scope of the consent.

How should consent to publish before/after photos be drafted?

As a specific tick-box, separated from other acceptances, unticked by default, with concrete wording on what is published, where, and for what purpose. The correct approach is to break it down: 'I consent to the publication of images of the treatment result on the centre's website / I consent to publication on the centre's Instagram and TikTok profiles / I consent to use in in-store signage'. The client ticks what they accept and leaves unticked what they refuse. It must be clear that the images will be publicly visible, that they may be reused by third parties on social media (an inherent limitation of the medium), that withdrawal is possible at any time by contacting the centre, and that withdrawal requires the centre to remove the publications it controls, without any guarantee of total deletion if third parties have redistributed them. The signature or digital acceptance is kept as documentary evidence.

Can the centre use the client's image in paid advertising (Meta ads, campaigns) under the same consent?

Not automatically. Consent for the image to appear on Instagram's organic feed or on the website does not by default cover use in paid advertising, where the purpose and commercial reach are different and far greater. For advertising uses, the AEPD and Organic Law 1/1982 are demanding: consent must be specific to that use and, as good practice, express and in writing. The professional approach is to offer the client an additional, independent tick-box: 'I consent that images of the treatment may be used in the centre's paid advertising campaigns (Meta Ads, Google Ads, printed adverts)'. If the client does not tick it, the images remain limited to organic use. And even if the client does tick it, it is worth reviewing on a case-by-case basis whether the specific advertising use is reasonably compatible with what was consented to.

Before/after photos on social media: client consent in hair and beauty salons

The before-and-after photo is one of the most powerful commercial tools in the sector: it shows the centre's work, attracts new clients and reinforces the existing client's decision to return. On Instagram, TikTok, the salon's website, shop-front signage or flyers, visual content is the currency of the industry.

The operational issue is not publishing: it is publishing properly, with client consent captured as Spanish law requires. Two legal bodies apply simultaneously: the GDPR (Regulation (EU) 2016/679) together with the LOPDGDD (Spain's Organic Law 3/2018), and Organic Law 1/1982 on the civil protection of the right to honour, personal and family privacy, and own image.

Two legal regimes that operate in parallel

When a hair salon or beauty centre publishes a recognisable photo of a client, it acts on two planes at once:

Data protection (GDPR + LOPDGDD): the image of an identifiable natural person is personal data. Its processing (capture, storage, publication) requires a legal basis under art. 6 GDPR. Where the purpose is promotional and the image recognisable, the usual basis is the client's express consent (art. 6(1)(a) GDPR).
Right to own image (Organic Law 1/1982): the capture, reproduction and publication of a person's image in a public or private place, by any means, requires the data subject's consent except in narrow statutory exceptions that do not apply to the commercial context of a salon. Organic Law 1/1982 treats as an unlawful interference the use of a person's name, voice or image for advertising, commercial or analogous purposes without authorisation.

The two requirements are cumulative: the centre needs to be right under both. Compliance with the GDPR is not enough if the image is published for commercial purposes without authorisation under Organic Law 1/1982. And it is not enough to hold an Organic Law 1/1982 signature if the consent does not meet the requirements of art. 7 GDPR (freely given, specific, informed and unambiguous).

The four properties of well-captured consent

The client's consent to publish before/after photos on social media must meet four properties, in line with art. 7 GDPR and the AEPD's settled criteria:

Express: in writing or by traceable digital acceptance. Nothing like "the client didn't say anything when I took the photo".
Specific: one tick-box per purpose. Website, Instagram, TikTok, in-store signage and paid advertising are separated, not bundled.
Informed: the client knows what is published, where, for how long and with what reach. They also know that on social media reach is global and third parties can share content.
Withdrawable: the client can withdraw consent at any time, as easily as it was given.

Summary table: common uses and applicable regime

Use	Consent required	Observations
Centre's website (recognisable client)	Specific client tick-box.	State publication period and withdrawal mechanism.
Instagram / TikTok / Facebook (organic)	Independent tick-box for organic social media.	Notice on global reach and third-party reposts.
Paid advertising (Meta Ads, Google Ads, signage)	Additional separate tick-box, specific to advertising use.	Organic Law 1/1982 reinforced regime: commercial use requires unequivocal authorisation.
Detail-only photo (hair without face, nails)	Not personal data if the client is not identifiable.	Good practice: ask for consent anyway.
Minors under 14 (child clients)	Consent from parents or legal guardians.	Reinforced regime under Organic Law 1/1982 + art. 7 LOPDGDD.

How to capture consent in practice

The centre has two common formats:

Paper authorisation form: a short, specific "image authorisation" document, separated from the client's other acceptances. It includes name, ID number, specific purposes ticked as independent boxes, term or "until withdrawal", withdrawal channel and a specific signature.
Online engine or booking app: a final step in registration or booking with independent tick-boxes per purpose, each unticked by default, with clear text and an expandable link to the detailed information. The system records date, time and tick-box settings to evidence consent.

What does not work: a consent bundled into the privacy policy ("I accept that the centre uses my data for commercial and marketing purposes") as an implicit authorisation to publish photos. Nor does presuming consent because the client let the photo be taken without objecting: taking the photo and publishing it are different processing operations.

Minors: reinforced regime

Where the client is a minor under 14 (typical in children's salons, first haircuts, some children's barber activity), consent is given by the parents or legal guardians. This applies both under the GDPR (art. 7 LOPDGDD sets 14 as the age at which the minor can consent themselves) and under Organic Law 1/1982, which provides a specific regime for minors and requires consent from legal representatives.

In practice, photos of recognisable minors on social media are an especially sensitive area and the centre is well advised to adopt a restrictive policy: only with written authorisation signed by a parent, preferably with the minor not identifiable where possible (haircut, hairstyle or activity without the face), and with immediate removal on first request.

"The before/after photo is an excellent commercial tool when done well. Well means a specific tick-box per purpose, unticked by default, separate from the general policy. Well also means thinking twice before publishing images of minors. A client who signs a clear authorisation receives an implicit message: here we take respect for them seriously."

Mario P. Talamillo · Managing Partner, Certix®

Withdrawal: what to do when the client changes their mind

Consent is withdrawable. When a client asks for their photos to be removed, the centre must:

Delete the publications it directly controls (its own Instagram, TikTok, Facebook, website).
Delete the images from the centre's local galleries and from digital archives used for advertising.
Notify the client that social media operates openly and that third parties may have shared the image; the centre cannot guarantee total removal of copies in third-party accounts but will do what is within its power.
Document the withdrawal with a date, to evidence diligence.
Flag the client in the CRM with a note preventing the reuse of past images in future campaigns.

Common mistakes to avoid

Taking the photo before asking for consent, assuming the client will say yes later.
A single generic tick-box for "social media, website and advertising" bundling distinct purposes.
Pre-ticking the box by default.
Publishing images of minors without written parental authorisation.
Not keeping documented records of authorisations and losing the evidence when a client complains.
Reusing photos taken years ago for new campaigns without verifying the current state of the consent.
Tagging the client on social media without expressly agreeing it.
Uploading content to stock or image banks, which plainly exceeds the original consent.

Minimum checklist for the centre

Image authorisation template with separate tick-boxes per purpose (website, organic social, paid advertising, signage).
Procedure for capturing authorisation before the photo is taken.
Art. 13 GDPR information notice mentioning image handling.
Digital or physical register of authorisations, with date and tick-box settings.
Documented, operational withdrawal procedure (message, app, reception).
Specific protocol for minors with written parental authorisation.
Periodic review of published galleries to remove clients who have withdrawn.
Brief team training: how authorisation is requested before the photo.

Frequently asked questions

Can the centre publish before/after photos of its clients on social media?

Yes, with the client's express, specific, informed and withdrawable consent for that purpose. Two regimes apply: GDPR (image as personal data) and Organic Law 1/1982 (right to own image). Consent cannot be presumed from the mere fact of having taken the photo.

What if the photo does not show the face, only the hairstyle or nails?

If the person is not identifiable, the content falls outside the scope of the GDPR and Organic Law 1/1982. But it must be assessed realistically (tattoos, jewellery, background, unique marks can still identify). As good practice, the professional centre asks for consent anyway.

How is consent drafted correctly?

Specific tick-boxes, separated, unticked by default, broken down purpose by purpose: website, Instagram, TikTok, signage, paid advertising. The client ticks what they accept. The possibility of withdrawal and the inherent limitation of the medium (third parties may redistribute) must be stated.

Does organic consent cover paid advertising?

Not automatically. Paid advertising (Meta Ads, Google Ads, signage) has greater commercial reach and a reinforced regime under Organic Law 1/1982. It requires an additional specific tick-box separate from the consent for organic use.

This content is for general information purposes only and does not constitute specialist legal advice. The application of the rules to each specific case requires individual analysis. Spanish regional sector-specific rules may extend or modify timeframes and requirements.

Want to put your salon's image authorisations in order?

At Certix we assign you an expert in compliance for the beauty sector. No commercial intermediaries, no generic templates.

Talk to an expert

Before/after photos on social media: how to capture client consent in hair and beauty salons