A photo of you online without permission can be removed under Dutch law by two independent routes: the portrait right in Articles 19 to 21 of the Dutch Copyright Act (Auteurswet) and the right to erasure in Article 17 of the GDPR. The portrait right applies to any image in which you are recognisable and lets you oppose publication where you have a reasonable interest in doing so. The GDPR applies because a photograph of an identifiable person is personal data. Neither route requires you to own the photograph.
In short: you have a portrait right (portretrecht) over images in which you are recognisable. If a photo of you is published and you have a reasonable interest in stopping it, whether that is your privacy, your reputation or the commercial value of your image, you can demand that it is taken down. Personal photographs are also personal data, so the GDPR gives you a separate route. Copyright in the photograph, however, belongs to whoever took it.
What follows sets out what each route requires when you find a photo of you online without permission, in what order to use them, and where the common assumptions about photography in public go wrong.
What the portrait right protects
The portrait right is not a right to control every image of you. It is a right to oppose publication in defined circumstances, and it sits in the Copyright Act rather than in privacy legislation because it was written as a limit on what the maker of a portrait may do with it. A portrait, for these purposes, is any depiction in which a person is recognisable, and recognisability can come from the face but also from posture, a tattoo, clothing or the context. You do not have to be the main subject: someone clearly identifiable in a group photograph is portrayed just as much as the person in the centre.
Portraits made on commission and portraits made without one
The Copyright Act draws a line that decides which rule applies. Where a portrait was made on your commission, Article 20 Auteurswet prohibits the maker from publishing it without your consent, and after your death that consent must come from your relatives for a period of ten years. This covers wedding and family photographers, business portraits you commissioned and similar work. The rule is simple: no consent, no publication.
Where the portrait was not commissioned by you, which covers street photography, event photography, press images and almost everything taken without your involvement, Article 21 Auteurswet applies instead. Publication is then permitted unless a reasonable interest of the person portrayed opposes it. That is a balancing test, not a consent requirement, and it is where most disputes are decided. Our separate article on the portrait right goes through the case law in more detail.
What counts as a reasonable interest
Two kinds of interest are recognised. The first is a privacy interest: publication that exposes your private life, places you in a damaging or misleading context, associates you with something you have nothing to do with, or exposes you to harassment. The second is a commercial interest, which applies to people whose image has marketable value, such as athletes and performers; where their image is used to promote a product, they are entitled to a share of that value even where no privacy concern arises.
The assessment is a balance between your right to respect for private life under Article 8 of the European Convention on Human Rights and the publisher's freedom of expression under Article 10. Neither takes precedence in the abstract. What matters is the nature of the image, the context of publication, whether the subject is a public figure, whether the publication contributes to a debate of public interest, and how the image was obtained. This is why there is no simple answer to whether a particular photograph may be published, and why an outright ban on photographing people in public does not exist.
The GDPR route: a photograph is personal data
A photograph showing an identifiable person is personal data, so anyone publishing it is processing your data and needs a lawful basis under Article 6 of the GDPR. In practice that basis is either your consent or a legitimate interest that outweighs your rights, and the second requires a genuine assessment rather than an assumption. Where consent is relied on, it must be freely given, specific and informed, and it can be withdrawn.
The GDPR gives you concrete rights against the publisher. Article 17 gives a right to erasure, which applies among other things where the data is no longer necessary, where you withdraw consent, or where you successfully object. Article 21 gives a right to object to processing based on a legitimate interest, and once you object the publisher must stop unless it can demonstrate compelling legitimate grounds that override your interests. Article 15 lets you ask what is being processed and where it came from. These requests must in principle be answered within one month.
There is an important exception. Article 2(2)(c) of the GDPR excludes processing by a natural person in the course of a purely personal or household activity. Photographs kept for yourself, or shared within a genuinely closed circle, fall outside the Regulation. Publishing them to an unrestricted audience does not: the Court of Justice has consistently held that making personal data accessible to an indefinite number of people takes the activity outside the household exemption. Posting to an open social media profile is therefore not a private act in GDPR terms, although the portrait right still applies either way.
Where the publisher is a company or an organisation the position is stricter, because it will also have to satisfy the accountability and transparency requirements and, for employees and customers, will normally need a documented basis. Complaints against organisations can be made to the Autoriteit Persoonsgegevens, the Dutch data protection authority, which can investigate and enforce. It does not, however, award compensation to individuals; that is a matter for the civil courts.
Copyright belongs to the photographer, not to you
This is the point most often misunderstood, and it works against the subject rather than for them. Copyright in a photograph vests in the person who took it, under Article 1 of the Auteurswet, and lasts until seventy years after the maker's death. Being the person in the picture gives you no copyright at all. It follows that you cannot lawfully copy, repost or use a photograph of yourself taken by someone else without the photographer's permission, even to complain about it.
The two rights run in parallel and can block each other. A photographer holds the copyright but may not publish an image if your reasonable interest opposes it; you hold the portrait right but may not reproduce the image without the photographer's consent. Where a photograph you commissioned is concerned, Article 19 Auteurswet does allow you to reproduce it for your own use. Our article on copyright on photos deals with the photographer's side of the relationship.
One practical consequence: when you send a takedown request, do not attach a copy of the disputed photograph to a public post. Describe it and give the URL. Screenshots taken for evidence and for your lawyer are a different matter and are not a publication.
How to get the photo removed, in order
Start by securing the evidence, because content disappears and reappears. Take dated screenshots showing the image, the surrounding page, the account that posted it and the URL, and note when you first saw it. Do this before you contact anyone, since a request often results in immediate deletion and you will then have nothing to show a court.
Report it to the platform under the Digital Services Act
For anything hosted by an online platform, the fastest route is the platform's own reporting mechanism, and since the Digital Services Act (Regulation (EU) 2022/2065) that mechanism is regulated rather than voluntary. Article 16 obliges hosting services to operate a notice mechanism that any person can use to flag content they consider illegal, to confirm receipt, to decide in a timely, diligent and non-arbitrary way, and to give reasons for the decision. Article 20 requires an internal complaints procedure if your notice is rejected, and Article 21 allows you to take the dispute to a certified out-of-court dispute settlement body.
Write the notice so that it can be acted on. Give the exact URL, explain in a sentence why the publication is unlawful under Dutch law, referring to the portrait right and to the GDPR rather than to copyright, which is not your right here, state that you are the person depicted and that you did not consent, and ask for removal. Vague reports are the ones that get closed without action. Supervision of the DSA in the Netherlands sits with the Autoriteit Consument en Markt, which has acted as the Dutch digital services coordinator since Dutch implementing supervision began in February 2025, and to which you can report a platform that ignores a valid notice.
The poster, the website owner and the hosting provider
If the content sits on an ordinary website rather than a platform, approach the site owner directly. Look for contact details in the imprint or privacy statement, and if there are none, the domain registration and the hosting provider are the next step. A hosting provider that is made aware of manifestly unlawful content and does nothing can lose the liability exemption it would otherwise enjoy, which is why a well-documented notice to a host is often effective even when the site owner does not answer.
Where you approach the poster, a written demand works better than a conversation. Set out when you discovered the publication, where it is, that no consent was given, what you require, and a deadline. Seven to fourteen days is a reasonable period for a private individual. Keep the tone businesslike and keep every message: if the matter goes to court, the correspondence establishes both the infringement and the refusal to remedy it.
Search engines and cached copies
Removal at the source does not clear the search results. A separate request to the search engine, based on the right to erasure, has the URL delisted for searches on your name. Whether it is granted depends on the same balancing exercise: the nature of the information, your role in public life and the public interest in access. If the search engine refuses, the Autoriteit Persoonsgegevens can be asked to assess the refusal, and the civil courts remain available. Note that delisting removes the result, not the page.
Court proceedings and compensation
Where voluntary removal fails, the standard route is summary proceedings (kort geding) before the preliminary relief judge. These are designed for exactly this situation: they are relatively quick, they can order removal, an order to stop republishing and a rectification, and the order can be backed by a penalty payment for each day of non-compliance. Representation by an advocaat is required. Publication that breaches the portrait right or the GDPR is also an unlawful act under Article 6:162 of the Dutch Civil Code, which is the basis for a claim in damages.
Be realistic about compensation. Material loss, such as the licence fee that should have been paid for commercial use of your image, is recoverable where you can evidence it. Compensation for non-material loss under Article 6:106 of the Civil Code is available where your person has been affected, but Dutch courts set a high threshold: you generally need concrete evidence of mental harm, or a breach serious enough in its nature and gravity for the harm to be self-evident. Awards in Dutch privacy cases are modest by international standards, and the real value of proceedings is usually the removal order rather than the money.
Costs matter to the decision. Court fees, bailiff service and legal representation add up quickly, and in most private disputes the cost of proceedings exceeds any damages realistically obtainable. Check whether you hold legal expenses insurance covering privacy disputes, and whether you qualify for subsidised legal aid through the Raad voor Rechtsbijstand. Dutch professional rules do not permit an advocaat to take this kind of case on a no cure, no pay basis.
When it becomes a criminal matter
Not every unwanted photograph is a criminal offence, and reporting one to the police rarely helps with an ordinary holiday snapshot posted by an acquaintance. Some situations are different. Publishing a portrait in breach of the portrait right is a minor offence under the Copyright Act. Distributing sexual images of someone without their consent, and secretly making such images, are serious offences under the Dutch Criminal Code, and the chapter on sexual offences was rewritten by the Wet seksuele misdrijven, which has been in force since 1 July 2024. Repeated unwanted attention can amount to stalking, and publication accompanied by threats or extortion is punishable in its own right.
Where the images are sexual in nature, report the matter to the police and contact Helpwanted, the helpline run by the Offlimits foundation, which supports victims of unwanted online sexual images and can help with removal across platforms. Do not pay anyone who threatens publication. Our article on cyberbullying and online reputation damage sets out the civil and criminal options where publication forms part of a broader campaign, and where the account posting the images is impersonating you, the guidance in our piece on phishing and internet fraud is relevant to preserving evidence.
Common misconceptions
Three assumptions cause most of the trouble. The first is that photography in public is unrestricted. Taking the photograph is generally lawful, and there is no general right not to be photographed in a public place; what is regulated is publication, and the portrait right applies on the street exactly as it applies anywhere else. The place matters only in so far as it affects what you could reasonably expect: a picture taken through your window is a different matter from one taken at a public demonstration you chose to attend.
The second is that non-commercial use is free. It is not. Article 21 Auteurswet asks whether a reasonable interest opposes publication, and that question is not answered by whether anyone made money. Commercial use does raise the stakes, because it adds the exploitation interest and increases what can be claimed, but a private social media post can breach the portrait right just as effectively.
The third is that attending an event amounts to consent. Attending a festival or a demonstration makes it harder to object to a general crowd image used to report on the event, because the publication then serves a genuine informational purpose and you are one of many. It does not license a close-up of you used to illustrate an unrelated story, or a crowd image sold as advertising.
Reducing the risk in advance
Finding a photo of you online without permission is usually a matter of looking, so periodic checking is the practical measure that works. Search your own name, previous names and usernames on more than one search engine, use image search to find where a photograph you know about has spread, and check the major stock photo libraries if you have ever modelled or attended a photographed event. Reverse image search on a photograph you already have is the fastest way to find copies.
On social media, restrict who can see your posts, limit who can tag you and review tags before they appear, and remove connected applications you no longer use, since they may retain access to your images. Where a photograph of you has been uploaded to a stock library, the relevant question is whether a model release exists; without one the library cannot license your image for commercial use, and stock platforms generally act quickly on a well-substantiated request because their own licensees depend on the release.
For organisations the discipline is different and more demanding. If you photograph staff, customers or visitors, decide in advance on the lawful basis, tell people what the images will be used for, record consent where you rely on it, make withdrawal genuinely possible, and do not carry photographs of former employees on your website indefinitely. Our guidance on privacy statements under Dutch law covers how these choices should be documented.
Frequently asked questions
How can I have a photo of myself that has been posted online without my consent removed?
The first step is to contact the website owner or administrator. You can send a removal request explaining why the photo was posted without consent.Social media platforms such as Facebook or Instagram have built-in reporting systems that can be used for this purpose. These platforms have specific procedures for this type of complaint.If the owner does not respond, you can contact the website’s hosting provider. Hosting companies often take action on valid complaints about privacy violations.In persistent cases, legal assistance may be necessary. A lawyer can send a formal letter or take further legal action.
What steps should I take if I notice a violation of my privacy on the internet?
Taking screenshots is the first important step. You should gather evidence of where and when the photos were posted.Next, you should document all relevant information. This means writing down websites, dates and the context in which the photos were used.It may be necessary to file a complaint with the Autoriteit Persoonsgegevens. This is especially true when companies or organisations have posted the photos.You can also report the matter to the police if there is stalking or intimidation involved. This is often the right step to take in the case of sexual images.
What are my rights regarding the publication of personal images on social media platforms?
Under the GDPR, people have the right to object to the use of their photos. This also applies to social media platforms that are active in the Netherlands.People have the right to have their personal images removed. This is known as the ‘right to be forgotten’ under privacy law.For a portrait not made on commission, Article 21 of the Dutch Copyright Act allows publication unless a reasonable interest of the person portrayed opposes it, so consent is the safe course rather than a strict requirement in every case.Copyright may also apply if someone else took the photo. In that case, both the photographer and the person depicted have rights.
Who can I report the unwanted distribution of my personal photos on the internet to?
The Autoriteit Persoonsgegevens handles complaints about privacy violations. You can submit a report online via their official website.On social media platforms, you can report directly via their reporting systems. Facebook, Instagram and other platforms have specific procedures for this.The police accept reports of criminal offences such as stalking or intimidation. This applies in particular to repeated unwanted behaviour.Helpwanted, the helpline run by the Offlimits foundation, supports victims of unwanted online sexual images and can advise on the appropriate steps to take.
What legal support can I count on if my photos are used without my permission?
A lawyer specialising in privacy or copyright law can take legal action. They can send formal letters and initiate proceedings.Het Juridisch Loket offers free initial legal advice, and subsidised legal aid is available through the Raad voor Rechtsbijstand for people on lower incomes.Legal expenses insurance often covers the costs of these types of cases. You should check the terms and conditions of your insurance policy.Dutch professional rules prohibit an advocaat from working on a no cure, no pay basis, apart from a limited scheme for personal injury claims, so fees are normally charged by the hour.
Is there a difference in approach between removing photos on social media and other websites?
Social media platforms have faster procedures for removing content. They usually respond to valid reports within a few days.Other websites often require direct contact with the owner. This process can take longer because there is no standardised procedure.Social media platforms allow you to use built-in reporting tools. Other websites often require email contact or contact forms.Hosting providers are an alternative route for regular websites. This does not work for social media because they use their own hosting.
How Law & More can help
Our privacy and IT lawyers act for people whose image has been published without permission and for organisations that need to publish photographs lawfully. That includes takedown demands, notices to platforms and hosting providers, erasure and objection requests under the GDPR, summary proceedings for removal and rectification, and claims for damages where publication has caused loss. If you have found a photograph of yourself online and want to know what can realistically be achieved, please contact us.
Looking for something else? Our index of Dutch IT and privacy law guides lists everything we have written on this subject, ordered by topic.
