Event Photography and Consent for Commercial Use in Kenya. Why a Ticket Is Not a Model Release
31 July 2026
Does buying a ticket give an organiser the right to use your face in its next advertisement? The Data Commissioner has said no. This is the 4 minute version, and the full edition is available to download at the end.
A ticket is a contract to attend an event. It is not permission to put your face in the next advertisement. That is the effect of a decision of the Data Commissioner on 8 April 2026 against the company behind Blankets and Wine, and it applies to every organiser, venue, brand and agency in Kenya that turns pictures of real people into marketing.
| THE DECISION IN 60 SECONDS An attendee found her photograph in promotional material for the Blankets and Wine Tupatane OnjaOnja Summer Events 2025, and complained to the Office of the Data Protection Commissioner. The organiser, Goodtimes Africa, said she had consented through the event terms and conditions. The Data Commissioner held that promoting a paid event is a commercial purpose, and that the organiser had not shown consent specific to advertising or that she was told her image would be used that way. The use was unlawful, and the organiser was ordered to pay her KES 300,000.1 |
Why a ticket is not a model release
Section 37 of the Data Protection Act forbids the use of personal data for commercial purposes without express consent, unless a written law authorises it.2 A photography clause in ticket terms fails that test in 6 ways.
(i) It is not express. Buying a ticket is an act directed at attending, not at appearing in an advertisement.3
(ii) It is not free. The General Regulations state that consent presented as a non negotiable part of the terms and conditions is not freely given.4
(iii) It is not specific. One clause that covers coverage, archive and advertising merges purposes the law requires to be kept apart.5
(iv) It is not informed. The attendee is rarely told who will use the image, how, and that consent can be withdrawn.6
(v) It cannot be proved. The burden of proving consent lies on the business, not the attendee.7
(vi) It does not last forever. Consent may be withdrawn at any time, and consent given in one context does not carry over to another.8
How the Data Commissioner tests a claim of consent to commercial use of an image
Not the first time
The decision follows a settled line, and the High Court has so far upheld the awards it has reviewed.
Selected decisions on the commercial use of images
| Decision | Use | Outcome |
|---|---|---|
| Casa Vera Lounge (2023) | Image of a patron on social media | Penalty of KES 1,850,000 |
| Mbuvu v Grain Industries (2024) | Billboard of a mother, submitted by her daughter | KES 1,000,000. Appeal dismissed |
| Muthoni v Solpia (2024 and 2025) | Repost of a public Instagram photograph | KES 500,000. Upheld on appeal |
| Ndung’u v Moja Expressway (2024 and 2025) | Promotional videos of a former employee | KES 500,000. Appeal dismissed |
| Aiko v Goodtimes Africa (2026) | Event photograph in promotional material | KES 300,000 |
The lesson from these cases is that terms accepted by one person cannot supply consent for another, a public post is not a licence to advertise, and consent ends when its context ends.9
What to do before your next event
(i) Stop relying on ticket terms for marketing use of attendee images.
(ii) Ask the people you want to feature, through a signed release, an opt in or a written reply, and record who agreed, to what and when.
(iii) Mark consent zones or offer wristbands, and brief every photographer on them.
(iv) Use images in which no one can be identified wherever you can, as the Act requires where possible.10
(v) Take an image down at once when asked, and never publish an image of a child without the consent of a parent or guardian.11
3 quick questions
Can a business use a photograph I posted publicly? Not for advertising without your express consent. The High Court upheld an award of KES 500,000 against a company that reposted a public Instagram photograph.12
Can an organiser rely on legitimate interest instead? The Data Commissioner did not decide the point. Section 37 permits commercial use only with express consent or under a written law, so legitimate interest is a weak foundation for advertising.13
What can I do if my image is used? Ask the organiser in writing to remove it, keep a copy of the post, and complain to the Office of the Data Protection Commissioner before going to court.14
| READ THE FULL EDITION This is the short version. The full 20 page edition of The BOLD sets out the determination paragraph by paragraph, the Constitution, the Act and the regulations, the full line of image decisions since 2017, open questions on crowd shots, agencies and children, detailed guidance and 8 FAQs, with 67 footnotes. Download the full edition (PDF). |
About the author
Benson Odiwuor is an Advocate of the High Court of Kenya based in Nairobi, whose practice focuses on dispute resolution in the regulated industries, including mining, oil and gas, banking and project finance. He is the editor of The BOLD, Benson Odiwuor’s Legal Digests, a legal newsletter on dispute strategies and legal developments in the regulated industries of Kenya. Subscribe to The BOLD here.
References
- Antonate Aiko v Goodtimes Africa Limited t/a Blankets and Wine (ODPC Complaint No 2175 of 2025, Determination of 8 April 2026) paras 24 to 32 and 36 <https://www.odpc.go.ke/wp-content/uploads/2026/04/ANTONATE-AIKO-VS-GOOD-TIMES.pdf>. ↩
- Data Protection Act 2019 (No 24 of 2019), now Cap 411C of the Laws of Kenya s 37(1) <https://www.odpc.go.ke/wp-content/uploads/2024/02/TheDataProtectionAct__No24of2019.pdf>. ↩
- Data Protection Act s 2. ↩
- Data Protection (General) Regulations 2021 (Legal Notice 263 of 2021) reg 4(4)(b) <https://www.odpc.go.ke/wp-content/uploads/2024/03/THE-DATA-PROTECTION-GENERAL-REGULATIONS-2021-1.pdf>. ↩
- General Regulations reg 4(4)(d). ↩
- General Regulations reg 4(1). ↩
- Data Protection Act s 32(1). ↩
- Data Protection Act s 32(2); Business Daily, ‘Moja Expressway loses appeal in use of former employee’s image’ (Business Daily) <https://www.businessdailyafrica.com/bd/corporate/companies/moja-expressway-loses-appeal-in-use-of-former-employee-s-image-5271794>. ↩
- Capital FM, ‘Data Commissioner fines 3 firms Sh9.4mn over data infringements’ (Capital FM, September 2023) <https://capitalfm.africa/data-commissioner-fines-3-firms-sh9-4mn-over-data-infringements/>; Nation, ‘Using woman’s image in Mother’s Day promotion costs firm Sh1 million’ (Nation, Nation Media Group) <https://mwananchi.co.tz/kenya/counties/mombasa/using-woman-s-image-in-mother-s-day-promotion-costs-firm-sh1-million-4824828>; Muthoni v Solpia Kenya Limited t/a Sista Kenya (Civil Appeal E164 and E178 of 2024 (Consolidated)) [2025] KEHC 34 (KLR) <https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/34>; Business Daily, ‘Moja Expressway loses appeal’ (n 8). ↩
- Data Protection Act s 37(2). ↩
- Data Protection Act s 33. ↩
- Muthoni v Solpia (n 9). ↩
- Data Protection Act s 37(1). ↩
- Data Protection Act s 56; Muthoni v Solpia Kenya Limited t/a Sista Kenya (Constitutional Petition E457 of 2021) [2023] KEHC 22373 (KLR) <https://new.kenyalaw.org/akn/ke/judgment/kehc/2023/22373>. ↩