Guest and staff photos on hotel social media: consent, children and events

A photo of an identifiable guest or staff member is personal data under Law No. 6698, and publishing it is also an attack on personality rights under Civil Code Article 24 unless the person consented or another justification applies. So a hotel needs documented, specific consent, a separate rule for children, and a take-down route.

The animator films the mini disco, the wedding photographer delivers a gallery, and the hotel posts a happy guest at breakfast. Nobody wrote down who agreed to any of it. This article gives you the two legal tests every photo must pass, a consent form you can use on the next shoot, house rules for children and staff, and a take-down routine that works when someone asks for a photo to come down.

When is a photo of a guest personal data?#

A photo is personal data as soon as a person in it can be identified, and publishing it is a second act that needs its own justification. Law No. 6698 (opens in a new tab) covers information relating to an identified or identifiable person, per the consolidated text on mevzuat.gov.tr (2024). A face is the obvious identifier, but so is a first name with a room number, a distinctive tattoo, or a caption that names the party.

Two legal layers apply to the same post. Data protection under Law No. 6698 is one; personality rights under Articles 24 and 25 of the Civil Code are the other. A hotel that clears one and ignores the other is still exposed.

Explicit consent, as defined in Article 3 of Law No. 6698, means consent on a specific subject, based on information and given of free will. Processing without it is allowed only where an Article 5 condition applies, such as a duty set out in law. Marketing is not one of those conditions.

Article 24 of the Civil Code lists three justifications for an otherwise unlawful attack on personality rights: the person's consent, an overriding private or public interest, or the use of a power given by law. A hotel should be able to name which one it relies on for each post. Under Article 25 (opens in a new tab), a person can ask a judge to stop an ongoing attack, to declare an ended one unlawful, and to claim damages (mevzuat.gov.tr, consolidated text, 2026).

The practical test: would the person recognise themselves in this image, and can the hotel produce the document that shows what they agreed to? If the answer to the first is yes and the second is no, do not post.

A guest who asks what the hotel holds about them is asking a data protection question, not a marketing one. The photo, its consent record and its caption belong in the same answer, and they fit inside a wider hotel privacy notice under KVKK.

What consent should a hotel ask for, and is a crowd shot different?#

Ask for consent that names the channel, the purpose and the time span, and treat a crowd shot as a separate judgment rather than a loophole.

A usable consent names the person, the date and the place; says whether the material is photo or video; lists the channels (the hotel's own website, named social accounts, print, paid ads); states the purpose; states how long it lasts; and explains how to withdraw. Scope matters more than the signature. A permission for the hotel's own account does not cover a paid campaign, a partner agency's feed or a billboard.

Consent can be withdrawn, so the hotel must be able to find every place a photo ran. A log with the shoot date, the file names and the channels is what makes withdrawal workable.

A wide frame in which nobody is identifiable is a different case from a portrait, but identifiability is a judgment, not a camera setting. A sharp face in the foreground of a wide shot is still a face. Do not assume a crowd shot is always fine or always forbidden; this is a question for your legal adviser on your own images.

Practical controls reduce the judgment calls: shoot wide, avoid faces and name badges, put a notice at event entrances explaining that photography is taking place, and give people a way to step out of frame. A notice informs; it is not consent by itself. Someone who walked past a sign has not agreed to become the face of next season's campaign.

Decide what staff may do with personal phones at events. If the answer is nothing, say so in the animation and guest relations briefings, not only in the handbook. The same discipline applies to questions about who may be told about a guest: a photo caption can leak more than a phone call.

Children: parents, kids club and mini disco#

A child's photo needs permission from the parent or guardian for that specific use, and a hotel should plan on not getting it for close-ups.

A child's image is personal data like anyone else's, but the person who can give permission is the parent or guardian, not the child and not the animator holding the camera. Put a photo permission line on the kids club registration form, separate from the service consent, with a clear yes or no and the named channels. A blank line is a no.

For the mini disco and group games, set a house rule: wide shots of the group, no close-ups, no first names, no room numbers, and no post that tells a stranger where a particular child is at a particular hour. This belongs in the running of hotel animation programs, not only in a policy folder.

Make the opt-out visible to the person holding the camera, not buried in a file. A coloured wristband or a printed list checked before the shoot is worth more than a paragraph in a policy. Animation teams should film on a hotel device that stays at the hotel; personal phones at a kids club create copies nobody can find later.

If a parent asks for a photo to be removed, remove it first and check the log afterwards. Arguing about whether the permission covered it can wait; the image cannot.

Does an employment contract let a hotel post staff photos?#

No. Employment explains why the hotel may hold a photo for an internal purpose; it does not make an employee the face of the hotel's marketing.

Separate two uses in writing: internal (name badge, shift board, training material, internal directory) and external (website, social accounts, advertising, trade fair stands). They need different permissions. Ask for a separate written permission for external use that names the channels and the duration, and say plainly that refusing will not affect the person's work. A permission given under pressure is not free will.

An employee can withdraw. When that happens, the hotel stops new use and works through the log to find where the image already ran. When someone leaves, agree at the exit conversation what happens to existing posts. A named employee in a service-quality post is still an identifiable person after the contract ends.

Group staff photos at a season opening or a training day follow the same test: is anyone identifiable, and did they agree to this use? Some staff want the exposure and some do not. Ask each time rather than assuming, and never use a staff image to illustrate a claim the person has not agreed to be associated with.

Weddings and events: who owns what#

At an event there are three separate questions: who took the photo, who is in it, and who was told what. The hotel usually controls only the third.

The photographer holds the rights in the images by default, and the hotel's right to use a gallery comes from a contract, not from the fact that the event happened in its ballroom. Leave the copyright analysis to your lawyer and to the contract. Ask the couple or the host, in the event contract, for permission to use images of the venue, and state clearly whether guests may appear in them.

Wedding guests agreed to the couple's photographer. They did not agree to the hotel's marketing, and the couple cannot give that permission on their behalf. The cleanest route is to photograph the venue set up and empty, or with people who have signed a release, and to treat the couple's gallery as their property rather than a hotel asset. Third-party organizers do not pass permissions along; if an agency supplies images, the hotel still needs to know what the agency was allowed to license.

Put a short notice at the entrance and a matching line in the event contract, so the question is answered before the first guest arrives rather than after the first complaint.

Influencers and paid stays: what must the post say?#

Since 1 August 2026 the advertising regulation itself covers influencer posts, and the hotel as advertiser carries its own duty that it cannot hand to the influencer.

Article 23/A of the Commercial Advertising and Unfair Commercial Practices Regulation (opens in a new tab), added by the amendment in Resmî Gazete 1 July 2026, No. 33297, defines a social media influencer as a real or legal person who shares content promoting goods or services and turns that communication into a benefit. A free or discounted stay is a benefit.

The post must carry the word "Reklam" or "Tanıtım" together with the advertiser's name or trade name, or a statement such as "@[advertiser] tarafından sağlandı". The label must be readable against the post's colours, visible at first sight without scrolling, placed before other tags and separate from them, and repeated in every post when the content runs across several posts or formats. Covert advertising is banned in all media under Article 22.

The advertiser cannot escape these duties by pointing to the influencer's own responsibility. The hotel should therefore check the label before the post goes live, not after. Write into the collaboration contract who checks the label, when, and what happens if it is missing at publication.

Keep this separate from the data protection question. The label is an advertising duty; the influencer's or a bystander's permission to appear is a separate matter, and a labelled post can still be an unauthorised use of someone's image. The same separation applies to Türkiye's online review rules for hotels: different rules, different duties.

What does a take-down routine look like?#

A take-down routine is one published address, one named owner, a first action that happens the same day, and a log that shows what was done.

First action is removal or hiding, not investigation. Removing a post is the cheap step and it is not an admission of fault; the review can follow. Then search the log for other uses: the website, print material, the agency's feed, a metasearch listing, a trade fair brochure. One complaint usually means more than one placement.

Record the date, who asked, what was removed, where else it appeared and who did it. That record is also the evidence that the hotel acted. Reply to the person in writing and say what was done. Silence after a removal request is what turns a small request into a formal complaint.

If a dispute continues, Civil Code Articles 24 and 25 let a person ask a judge to stop an attack, to declare an unlawful one, and to claim damages. The hotel's best position is a consent record, so confirm your own case with a legal adviser before deciding how to respond.

What to do next#

Write the consent form and the photo log this week, then use them on the next shoot before you touch the policy document. The parts fit together as one record: the two legal tests decide whether a photo may be published, the form and the log prove the decision, and the take-down routine is what happens when the record turns out to be missing. Confirm your own case, and any dates or penalties that may apply, with a legal adviser.