My first career was in data centre construction, where every cable carries a label at both ends. Nobody labels “the cabling from Tuesday.” You label the run, because when something fails at three in the morning, you need to know exactly which one.
Consent in content creation has never worked that way. A model signs a release on the morning of a shoot. A vocalist records a feature and gets a credit line in an email. A podcast guest ticks a box on a booking form. Each of those agreements is attached to an event — a day, a session, a recording — and each of them is perfectly adequate right up until the moment it isn’t.
01The wrong unit
The moment it isn’t is always specific. It is never “I object to Saturday.” It is “I object to that frame — the one where I’m half-turned, the one I asked you not to use, the one that is now on a billboard in a city I have never visited.”
The dispute is about a file. The paperwork is about a day. Almost everything that goes wrong between creators and the people in their work happens inside that gap.
It is not a photography problem alone. A music producer who clears a vocalist for “the session” still has to prove that she agreed to the version that ended up on the streaming release, with the sample that came later. A DJ who drops a guest verse into a recorded mix has the same problem. So does a videographer cutting an ad from twelve hours of footage, and a podcaster whose guest said something on the record that they now wish they hadn’t.
02In defence of the release form
Before I argue against the status quo, it deserves its best case. The release form is not broken. It is cheap, it is familiar to courts and agencies, and for the overwhelming majority of shoots nobody ever looks at it again. A well-drafted release covering everything captured on a given date does, in many jurisdictions, cover the disputed frame. A photographer who has worked for twenty years without a single dispute is reading their own experience correctly when they conclude the system works.
There is also an honest aesthetic objection. Some photography depends on the subject not approving every frame — documentary work, street work, anything where the subject’s vanity would edit the truth out of the picture. A tool that routes every image past the person in it is not for that work, and I don’t think it should be.
So my argument is narrower than “release forms should go.” It is this: there is a category of content — commercial, intimate, reputationally loaded, or simply valuable enough to fight over — where “they signed something that day” is much weaker evidence than it feels like when you file it away.
03Three questions a release can’t answer well
When consent is challenged, the argument almost always turns on one of three factual questions. None of them is really about law. The law can be perfectly clear and you can still lose, because you can’t prove the facts.
- Which file?A blanket release proves agreement to a category of images. It does not prove the person ever saw this one.
- Who signed?A scrawled signature or a typed name proves very little about identity. Someone else can sign; someone underage can sign; someone can plausibly deny signing at all.
- What exactly did they read?Terms get revised, PDFs get re-exported, emails get forwarded with attachments swapped. Which version was agreed?
These are evidence problems. They are also, not coincidentally, identity problems — which is where my own work lives, and why I ended up building something aimed at them.
04What ProntoTag actually does
ProntoTag moves the unit of consent from the shoot to the file. The creator points to one piece of content by link — a private gallery, a streaming preview, a cloud folder — describes it, states where and how it will be used, and names the person in it. Nothing is uploaded to us. The person in the content then sees that exact file and those exact terms before deciding.
Tag the content
Link, description, usage context, and the person in it by ProntoID username or email.
Send the link
A secure approval link. Nothing is sent until the tag is paid for.
They verify and decide
They see the file and terms, verify their identity once on their phone, then approve or decline.
Both hold the record
Approval, terms and both verified identities sealed together. Exportable if anyone ever asks.
Three properties do the real work. The approval is bound to one piece of content, not a session. Both sides are identity-verified through ProntoID, so nobody can tag in someone else’s name and nobody can approve in yours. And the wording is sealed: the description, usage and terms the person saw are stored word for word with their approval, so the record can’t be quietly edited later.
It costs the creator €0,99 per tag, or €29 a month for fifty tags or releases. It is always free for the person being tagged. It sits alongside ProntoRelease, which handles the traditional release for a whole shoot, on the same account — because the honest answer is that most serious productions need both.
Release form vs. ProntoTag
Pick a document, then open a dispute to see what it proves.
Illustrative, not legal advice. What any record is worth in a dispute depends on local law and the facts.
What it is not, and I want to be precise here because I have been guilty of the opposite in conversation: it is not “undisputable.” No evidence is. A ProntoTag records clearly what was agreed, by whom, about which content. Whether those terms are enforceable where you work is a question for your own lawyer, and ProntoTag says so on its own homepage. There is also a practical limit worth naming: the record captures the link and the description of the content. Keeping the file at that link the same as the one that was approved is the creator’s responsibility.
05The right to change your mind
This is the part of the design I care about most, and the part that sits most awkwardly with the business model — so it is worth slowing down.
Once someone has approved a tag, they can withdraw that approval from their own account. ProntoTag then notifies the creator who issued the tag. The person in the frame doesn’t need a lawyer’s letter, a creator’s private email address, or the courage to send a DM to someone who may have more power than them. They need one action, and the other side is told.
What withdrawal means legally is not uniform, and anyone who tells you otherwise is selling something — including, potentially, me. Roughly:
GDPR Article 7(3). Where consent is the legal basis for processing someone’s personal data — and an identifiable image is personal data — that person can withdraw consent at any time. Withdrawal works forward; it does not make earlier use unlawful. But a creator may rely on a different basis, such as a contract, in which case this particular right may not be the one in play.
Italy goes further. The Corte di Cassazione has held that consent to publish one’s image is a unilateral act distinct from any contract that contains it, and is always revocable, whatever term was agreed and whether or not it was paid for (Cass. civ. 3014/2004; 1748/2016). The other party may be entitled to damages for the breach — but not, it seems, to keep publishing.
Elsewhere, a signed release is usually just a contract. In much of the United States, rights of publicity are state law and a valid model release is generally not something the model can unilaterally revoke. There, a withdrawal may be a request rather than an obligation.
ProntoTag doesn’t pretend to settle which of those applies. It doesn’t take an image off the internet, and it doesn’t decide what the withdrawal obliges anyone to do. What it changes is narrower and, I think, more important: from that moment forward the creator cannot say they didn’t know, and the person in the frame no longer needs leverage to say no.
Here is the awkward part. The paying customer is the creator. The feature that most protects the person in the content is one that can cost the creator money. I built it in anyway, because consent that cannot be withdrawn is not really consent. It is a sale. Sales are fine — but they should be called sales, and priced as sales.
06The objections I take seriously
You are asking people to hand their identity to a company — yours. Yes. That is a real ask, and centralising verified identity is a real risk even when it is handled well. I would rather readers put hard questions to us about how that data is held than take my word for it. The counterweight is that the alternative — unverifiable signatures — fails the people with the least power first.
There is also a structural change coming that I think matters more than any promise I can make. Under the EU’s revised eIDAS regulation, every member state is required to offer its citizens a government-issued digital identity wallet by the end of 2026. The wallet is designed for selective disclosure: it can confirm that you are who you say you are, or that you are over eighteen, without handing over the document itself. For a company like mine, that is the better architecture. We would no longer need to read or store your passport; the state-issued wallet does the heavy lifting, and we are left to do the ancillary work — binding a verified yes to a specific file — with far less sensitive data on our side. It is not zero: a ProntoTag still has to record who approved what. And it is not here yet everywhere. Italy and France are ahead; Germany and Sweden are not expected to deliver on time. Until the wallets arrive, document-based verification remains the bridge. But the direction is right, and it is the direction I want us held to.
It bureaucratises something that should be human. A verification step between a photographer and a model changes the texture of the collaboration, and some people will find it cold. I understand that. I also notice that the people most harmed by informal consent have rarely been the ones who enjoyed its warmth.
“This should become the standard” is a vendor’s line. It is. I believe file-level consent will become normal for commercial and intimate content, and I would like ProntoTag to be how it happens. But standards are not declared by the people who sell them. They arrive when platforms require them, insurers price them, and courts start expecting them. None of that has happened yet at scale, and a new category is one thing, a dominant one is another.
07What I don’t know yet
The frame at the centre of every consent dispute was always one specific file. We simply never had a practical way to attach one specific, verified person’s yes to it — or to let them take it back without a fight. Now that exists.
What I can’t tell you is how the people in the frame will experience it. As protection, or as one more checkpoint between them and the work? And I can’t tell you whether this industry will adopt file-level consent before the case that makes it obvious, or only after. I would much rather it were before. I am not confident it will be.
FAQQuestions creators ask
This essay is not legal advice. Case references: Corte di Cassazione, Sez. I civ., n. 3014 of 17 February 2004 and n. 1748 of 29 January 2016; Regulation (EU) 2016/679 (GDPR), Art. 7(3); Regulation (EU) 2024/1183 (eIDAS 2.0, European Digital Identity Wallets). ProntoTag is operated by Brooks & Keitt Sàrl, Sion, Switzerland.
