GDPR and face recognition at events: what organisers and photographers need to know

Selfie search is now something participants expect at races, sportives and festivals. It's also a form of face recognition, which means processing biometric data about everyone in the photos, including people who never search. In the UK and the EU that brings duties under the GDPR that a gallery of thumbnails never did. This article sets out the main points for organisers and photographers in plain words, and explains how Photohawk handles face data.

Why face data is special

When a gallery is made searchable by face, each face in each photo is turned into a face template: a set of numbers describing the face. A template made to identify people is biometric data. Under the GDPR and the UK GDPR, biometric data used to identify someone is one of the special categories of personal data in Article 9.

Processing special-category data is prohibited unless an Article 9 condition applies, such as the person's explicit consent. You also need an ordinary lawful basis under Article 6. And the usual principles apply: tell people clearly, use the data only for its purpose, and keep it no longer than necessary.

Two groups of people

A selfie search involves two groups, and it helps to think about them separately.

The person searching chooses to take a selfie and search. On Photohawk, face search runs only with the consent of the person searching, they can withdraw it at any time, and the selfie is discarded after the search.

Everyone in the photos didn't choose anything. When a gallery is indexed, templates are created for every face in it, including spectators and marshals. This is the group that needs the most thought, because they often don't know it's happening.

What to tell participants, and when

Good notices are short, plain and repeated:

1. Before the event, in the entry terms, registration page and pre-event email: that photos will be taken, that galleries can be searched by face, who provides the service, how long face data is kept and how to opt out.
2. Where the photos are, in the results email that links to the gallery and in the gallery itself, with a link to the full policy.
3. An opt-out that works. One clear route, honoured quickly.

A useful test for any notice: could a participant, reading it on a phone in a minute, say what happens to their face and how to say no?

Retention: how long is too long?

The GDPR's storage-limitation principle says personal data must be kept no longer than necessary. Face data for an event is only needed while people are looking for their photos, which mostly happens in the days and weeks after the event.

From 1 November 2026, Photohawk deletes face data automatically:

• 12 months after each photo is uploaded, at the latest. The clock is per photo.
• 30 days after a gallery is closed or its selfie search is switched off.
• Within 30 days of a request from the person.

Deleting face data never deletes a photo. Photos, sales, downloads, bib search and time search carry on. Once a whole gallery is past 12 months, selfie search ends for it and people are pointed to bib search and browsing. The full rules are in our face data policy, and what changed on 1 November 2026 explains why the limit is 12 months.

Beyond Europe

Several US states have their own biometric privacy laws, including Illinois (the Biometric Information Privacy Act), Texas, Colorado and Washington, each with rules on notice, consent, retention and destruction. Photohawk's 12-month limit was chosen to fall within the deadlines those laws set. If you run events in those states, get advice on your own obligations too.

Children and sensitive events

School sports days, junior races and family fun runs put children in the photos. Think carefully about whether face search is appropriate at all, what parents are told in advance, and whether the gallery should run with bib search and browsing only. On Photohawk, selfie search can be switched off for any gallery.

Who does what

The organiser, the photographer and the photo platform each play a part. Your contracts and privacy information should say who decides how face data is used and who processes it on another's behalf. Agree it in writing before the event, not after a complaint.

Handling a deletion request

When someone asks for their face data to be deleted:

1. Point them to the gallery (selfie search, then Make a request) or to support@photohawk.com, saying which gallery or event it's about.
2. Photohawk deletes the matching face data within 30 days and stops those photos from being indexed for face search again.
3. Their photos stay in the gallery. If they want a photo taken down, that's a separate request to the gallery's owner.

A checklist before you switch face search on

• You've decided, per gallery, whether face search is appropriate.
• Entry terms, registration and the pre-event email mention photos and face search in plain words.
• The results email and the gallery link to the policy and explain how to opt out.
• You know how deletion requests are handled and how fast.
• Your contracts say who decides and who processes.
• Your notice has been checked by someone qualified where you operate.

On Photohawk, selfie search is on every plan and can be switched off for any gallery; the plans are on the pricing page. For more on how selfie search works from the participant's side, read selfie search for event photos. For how Photohawk handles personal data generally, see our privacy policy and the biometric data retention policy.