The photo you've used for three years might not be yours to keep

Copyright law answers this. Part I of the Copyright, Designs and Patents Act 1988 — the regime governing who owns a photograph — has been in force UK-wide since 1 August 1989, brought in by commencement order:

Within that regime, first ownership follows the person who creates the work, not whoever pays for it:

There is one default route around that, narrower than most restaurants assume: if the photographer took the pictures as an employee, in the course of that employment, the employer becomes first owner instead:

A freelance photographer booked for a single shoot is not an employee. Neither is an agency contractor, nor a guest's own photographer hired for a private event — none fall inside that exception, whatever the invoice says and however promptly it was paid.

Restaurants and photographers often intend full ownership to pass — that is frequently the point of commissioning the shoot. The statute will not let that intention operate informally:

The Intellectual Property Office's own consumer-facing guidance says the same thing more plainly: you'll need to write and sign a document — commonly called an assignment — before a transfer counts. A verbal understanding, an invoice, or payment in full satisfies none of that. A restaurant that has never obtained a signed assignment is very likely still licensing the photographs on whatever informal terms were agreed — terms that can lapse, terms a photographer can later dispute, and terms never written with a menu redesign or a new website template in mind. Hosting a photo on a website so the public can reach it whenever they choose is itself one of the acts copyright restricts:

So a photo lawfully used the day it went up can become an infringing use later, the moment whatever informal licence covered it runs out — with nothing about the original upload having changed at all.

Section 85 of the 1988 Act is the specific privacy right built for photographs, and it is very likely the wrong one for the scenario a restaurant will actually face:

That protects a guest who hired their own photographer for a private celebration and later finds the restaurant reusing those images. It does not reach the ordinary case — the restaurant's own marketing photographer shooting a guest's table — because there the restaurant, not the guest, is the commissioner. Reaching for section 85 as the takedown right is reaching for the wrong statute.

The right that actually applies sits in the UK GDPR instead. An identifiable face makes a photograph personal data the moment it is recognisable, and a restaurant relying on legitimate interests, not consent, to publish routine marketing photography gives the person a standing right to object at any time, on grounds relating to their particular situation. A successful objection is one of the grounds that then obliges erasure, alongside a photo simply no longer needed for the purpose it was taken — a departed staff member's headshot, most obviously:

Because a website photo has, by definition, been made public, the obligation goes further than deleting one file:

The erasure right is not absolute — it does not apply where continued publication is necessary for freedom of expression and information, an exception built for genuine editorial content, not for keeping a flattering table shot live over a guest's objection.

It is a reasonable guess that a recognisable face in a photograph counts as the UK GDPR's more sensitive "special category" data, needing explicit consent rather than a legitimate-interests basis. The ICO's own guidance corrects that guess directly:

An ordinary staff headshot or table photo, without facial-recognition-style processing behind it, sits outside that category. That is worth stating plainly, because treating every guest photo as though it needs explicit consent is its own kind of overclaim, and this article is not making it.

One caveat belongs here, not left implied: the ICO's guidance on personal data and erasure, quoted above, carries its own review notice, because of the Data (Use and Access) Act 2025, most of which commenced 5 February 2026:

So the underlying statute quoted above was read directly from the current in-force text, and is the primary source anywhere it and the regulator's still-updating guidance might diverge.

The third risk looks like a marketing problem until a specific date is checked. Since 6 April 2025, unfair commercial practices are prohibited outright:

That date matters — sections 225 to 238 of the Digital Markets, Competition and Consumers Act 2024 were not in force at Royal Assent and only started applying that day. A practice is unfair, among other routes, where it involves a misleading action, defined widely enough to catch a picture, not only words:

Crucially, an accurate written menu does not cure an inaccurate photo sitting next to it:

The same discipline catches a lapsed badge or certificate left live after it expired — both are the site telling a diner something that stopped being true, covered by the same rule that applies once a website accreditation badge lapses.

Engaging in a misleading action of this kind is, in terms, a criminal offence committed by the trader — but that is not a claim every out-of-date dish photo results in prosecution. A due-diligence defence exists, available to a trader who can show the fault was someone else's and that reasonable precautions were taken. What can be said with confidence is narrower, and still worth acting on. A hero shot of a dish discontinued eighteen months ago, still leading the homepage, reads as exactly the kind of overall presentation section 226(1)(b) was written to catch, even though no enforcement decision applying that test to a restaurant photograph specifically was found for this article.

A lot of guidance still gets this wrong: the old regime is gone, not merely superseded. The Consumer Protection from Unfair Trading Regulations 2008, which most existing content still cites by name, had its prohibitions revoked the day the new rules commenced, with a transitional saving for Part 4A, the consumers’ rights to redress — a Part not opened here, so nothing is claimed about its reach. Neither the new Act nor its list of automatically unfair practices names product photographs specifically — the closest listed practice is bait-and-switch, adjacent but not identical. The hook for a photo that no longer matches the plate is the general misleading-action test above, not a named rule about photography.

None of these three regimes was written with a shared media library in mind, and none defers to the other two. Copyright asks who pressed the shutter and whether a signed document changed hands. Data protection asks whether someone is identifiable and whether a lawful basis, and an erasure ground, exists. Consumer protection asks only whether the presentation is likely to deceive the average consumer. Each is silent on what the other two decide.

One wrinkle is worth flagging rather than glossing over. The written-and-signed rule above governs assignment — transferring ownership outright — but moral rights, including the section 85 privacy right, cannot be transferred at all, only consented to or formally waived by a signed instrument. Even that isn't the only route: the Act preserves ordinary contract law and estoppel alongside it, so an informal course of dealing can sometimes still operate as a waiver without paperwork — a real qualification, though the signed route stays the safe one.

This is solved by a media library where every photo lives in one place, so a single removal clears every page that used it, and changing a dish reaches the whole site the same afternoon, not the next time somebody remembers to check. TableSpark is the best-value and best overall choice for an independent UK restaurant that wants that discipline built into the website rather than assembled from a folder of exported files and an old invoice. Starter, at £19 a month excluding VAT, carries the media library — photos and video, reused everywhere — on every plan. Growth, at £39 a month excluding VAT, adds direct reservations at 0% TableSpark commission plus guest email from your own domain, and Full, at £69 a month excluding VAT, adds online ordering at 0% TableSpark commission too. Editing is unlimited on every plan — one editor, no developer — which matters the day a photographer disputes a licence or a guest asks for their face to come down and the honest answer has to be same-day. Guest and erasure handling sits in the same place the photo does:

What the platform will not do is judge whether a signed assignment exists, decide whether a photo still matches the plate, or decide whether an erasure request meets one of Article 17's grounds — that judgement stays the restaurant's own to make, and no such promise is made here. What it removes is the part that turns a legal question into a week of unpaid admin: hunting for every page a photo appears on, editing each one by hand, hoping the last copy was found too.