Authored By: Sindy CHES
Jean Moulin Lyon 3 University (Université Jean Moulin Lyon 3)
Imagine waking up to find your photo featured in a breaking news headline or appearing across your social media feed without your permission. Would you be able to sue the publisher, even if you had posted that same photo on your own social media account three months earlier?
This situation has become increasingly common in today’s digital society, where content shared online can be copied, redistributed, and reused within seconds, often beyond the original user’s control. Many people assume that once a photo is posted publicly on social media, it is free for anyone to use. However, the law is far more nuanced.
This article examines whether content shared on social media remains legally protected after publication. It explores the legal principles governing the protection of online content (I), as well as the exceptions that may permit third parties to use such content without the owner’s authorization (II).
The continuing legal protection of individual content as a means of protecting personal privacy and intellectual creation
Various legal frameworks protect the content that individuals create or that relates to them. Depending on the nature of the content, protection may arise under data protection law, copyright law, or both. This article analyzes how personal images or information can be protected under the EU framework.
One of the most comprehensive legal frameworks governing the protection of personal information is the European Union’s General Data Protection Regulation[1] (GDPR). The GDPR protects personal data and regulates how such data may be collected, processed, used, and disclosed.
Article 4(1) of the GDPR defines personal data as “any information relating to an identified or identifiable natural person (‘data subject’) […].[2]” This definition is intentionally broad. Personal data therefore includes not only traditional identifying information, such as a person’s name or identification number, but also photographs, videos, voice recordings, and other information that can identify or relate to an individual. As a result, individuals enjoy legal protection over their personal data regardless of the medium in which it exists.
In addition to data protection law, certain types of content are protected by copyright law. Under Article 6 of Directive 2006/116/EC on the term of protection of copyright and certain related rights, photographs are protected by copyright as an original intellectual creation. The Court of Justice of the European Union confirmed this principle in Case C-145/10, Eva-Maria Painer v Standard VerlagsGmbH and Others[3], holding that a portrait photograph is entitled to copyright protection in the same way as any other work, provided that it reflects the author’s creative choices and intellectual creation[4], such as in the selection of the background, the subject’s pose, and the lighting[5]. Accordingly, photographs, videos, written works, and other original creative expressions may benefit from copyright protection. Copyright grants authors exclusive rights over the use, reproduction, distribution, and communication of their works[6], unless an exception or limitation applies.
These legal regimes demonstrate that both personal data and creative works, including photographs, videos, and written texts, are protected by law. However, an important question remains as to whether these protections continue to apply once such content is made publicly accessible on the internet.
A common misconception is that, once content is posted online, particularly on social media, it automatically enters the public domain and may therefore be freely used by anyone. This assumption is incorrect. The mere publication of content on the internet does not transfer ownership[7], nor does it render the content ownerless or unprotected. Rather, it simply reflects the owner’s decision to make the content available to a broader audience.
The original owner retains ownership of the content and, in many cases, continues to exercise control over who may access it. Most social media platforms provide users with privacy settings that allow them to determine the intended audience for their content, such as limiting access to friends, making posts publicly available, or restricting visibility through a private account. These settings demonstrate that users do not relinquish control over their content merely by uploading it online.
Nevertheless, the principal challenge is not whether the law continues to protect online content, but whether individuals can effectively exercise control over it once it has been published. Although users may determine the initial audience through privacy settings, the practical ability to control the subsequent dissemination of their content is significantly reduced. Given the scale and interconnected nature of social media, users are often unaware of where their photographs, videos, or other content may subsequently appear or how they may be reused without their knowledge. As a result, while legal rights remain intact, individuals frequently lose effective control over the circulation and use of their content in the online environment. This reflects the broader observation that, although “We believe that we can control our own privacy but the fact is we are no longer in full control of our privacy.[8]”
However, the existence of legal protection does not mean that every piece of content published online automatically benefits from the same level of protection. The scope of protection depends on the nature of the content and the legal regime concerned.
Exceptions to the protection of individual content: balancing users’ rights and the public interest
The first point to be aware of when publishing photos or videos on social media is that, although users generally retain their rights over the content they create, the exercise of those rights is subject to the terms of service accepted when joining the platform. By agreeing to these contractual terms, users authorize the platform to moderate and, where necessary, remove or restrict access to content that violates its policies. For example, Instagram’s Terms of Use provide that: “We can remove or restrict any content or information you share on the Service if we believe that it violates these Terms of Use.[9]” Consequently, while users remain the owners of their content, they no longer enjoy absolute control over its availability on the platform, as its continued publication depends on compliance with the platform’s contractual rules.
Furthermore, content may be displayed by third parties without the user’s express authorization through the use of an embedding function. This issue arose in Sinclair v. Ziff Davis, LLC[10], in which a media website (mashable.com) embedded a photographer’s Instagram post after she refused to license her photograph. Because the image remained hosted on Instagram’s servers rather than being copied onto Mashable’s own servers, the website argued that it had not reproduced the work in the traditional sense. The Court held that, by agreeing to Instagram’s Terms of Use, the plaintiff had authorized Instagram to grant API users, such as Mashable, a sublicense to embed her public Instagram content pursuant to Instagram’s Platform Policy. The case illustrates how social media’s technical functionalities can significantly expand the circulation of user-generated content, even where the creator has expressly declined to authorize its direct use.
Another exception arises where the use of content is justified by the public interest. In the context of personal data, Article 6(1)(e) of the GDPR provides that the processing of personal data is lawful where it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. This provision recognizes that, in certain circumstances, the protection of personal data may give way to overriding public interests.
Similarly, copyright protection may also be limited where the public interest requires the dissemination of protected content. This principle was illustrated by the Court of Justice of the European Union in Eva-Maria Painer v Standard VerlagsGmbH and Others[11]. The Court held that a portrait photograph may be reproduced and communicated to the public without the author’s authorization where such use is justified by the objective of reporting current events or assisting a criminal investigation, such as locating a missing child or identifying a suspect. The decision demonstrates that exclusive rights over creative works are not absolute and may be restricted where their exercise would undermine a legitimate public interest.
In conclusion, photographs, videos, and written texts of individuals are protected under both data protection and copyright frameworks. This protection does not cease merely because the content has been published online, as publication does not, in itself, transfer or extinguish the user’s rights over the content. As a general rule, third parties may not use an individual’s content published on social media without the user’s authorization. However, this principle is subject to certain exceptions. Such use may be permitted where it is justified by an overriding public interest, falls within a statutory exception, or is authorized under the contractual terms of service governing the user’s relationship with the social media platform. Accordingly, although users retain significant legal protection over the content they publish online, that protection is not absolute and must be balanced against competing legal and public interests.
Reference(S):
Legislation
Regulation (EU) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) 2016
Directive 2001/29/EC on the harmonization of certain aspects of copyright and related rights in the information society 2001
Cases
Eva-Maria Painer V Standard VerlagsGmbH And Others, C-145/10 (CJEU, 2011)
Sinclair v Ziff Davis, LLC, No 1:18-cv-00790 (SDNY, 24 June 2020)
Journal
Ripsi Arora, Nishu Yadav, ‘PRIVACY AND PERSONAL SPACE IN CONTEXT OF SOCIAL MEDIA INTERACTION’ (2025) INTERNATIONAL JOURNAL OF ADVANCED RESEARCH (IJAR)
Websites
Instagram terms of use https://help.instagram.com/581066165581870/
‘Judgment In Case C-145/10 Eva-Maria Painer V Standard VerlagsGmbH And Others’ (International Federation of Reproduction Rights Organisations, 2011) https://ifrro.org/page/article-detail/judgment-in-case-c-145-10-eva-maria-painer-v-standard-verlagsgmbh-and-others-1799/
Laura Bojart, ‘Do I own the content I post on my website and social media?’ (ROCKETLAWYER, 2026) Who owns content posted on social media? | Rocket Lawyer
[1] Regulation (EU) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) 2016
[2] ibid art 4 (1)
[3] Eva-Maria Painer V Standard VerlagsGmbH And Others (CJEU, 2011)
[4] ‘Judgment In Case C-145/10 Eva-Maria Painer V Standard VerlagsGmbH And Others’ (International Federation of Reproduction Rights Organisations, 2011) https://ifrro.org/page/article-detail/judgment-in-case-c-145-10-eva-maria-painer-v-standard-verlagsgmbh-and-others-1799/
[5] Eva-Maria Painer V Standard VerlagsGmbH And Others (CJEU, 2011) para. 91
[6] Directive 2001/29/EC on the harmonization of certain aspects of copyright and related rights in the information society 2001, art 2, 3, 4
[7] Laura Bojart, ‘Do I own the content I post on my website and social media?’ (ROCKETLAWYER, 2026), Who owns content posted on social media? | Rocket Lawyer
[8] Ripsi Arora, Nishu Yadav, ‘PRIVACY AND PERSONAL SPACE IN CONTEXT OF SOCIAL MEDIA INTERACTION’ (2025) INTERNATIONAL JOURNAL OF ADVANCED RESEARCH (IJAR) 137
[9] Instagram terms of use, 7 https://help.instagram.com/581066165581870/
[10] Sinclair v Ziff Davis, LLC, No 1:18-cv-00790 (SDNY, 24 June 2020)
[11] Eva-Maria Painer V Standard VerlagsGmbH And Others, C-145/10 (CJEU, 2011)
