Summer special: Do you share photos of children at summer camps? Watch out for these mistakes

A recent sanctioned case shows why separating consents is key to avoiding fines and protecting children's privacy.

Using images of minors in summer activities: how to stay compliant with the law

As the school year ends and the holidays begin, many children take part in summer activities: sports camps, sleepaway camps, outdoor trips, or day programs. Just 15 years ago, no one imagined filling hard drives with thousands of childhood photos. But today, it's common to share images almost daily with families to show what kids are doing.

While this habit is usually well-intentioned, it also involves certain legal risks that we’re still not fully aware of.

A real case: sanction for mixing consent purposes

A recent case highlights this issue: the City Council of Móstoles reported a summer activity academy to the Spanish Data Protection Agency (AEPD).

Why?
Because the registration form required parents to sign a consent clause that did not distinguish between the permission needed to enroll the child in the activity and the permission to take and use their photos for promotional purposes.

This is a direct violation of data protection regulations. The law requires that consent must be collected separately for each specific purpose. The following type of clause is not valid:

“I authorize Vacaciones en el Mar Camp to process my data and that of my son Juan Ramiro, age 10, based on the contractual relationship, to take photographs for the newsletter and publish them on social media.”

Why is this illegal?

Because consent must be granular—separated and specific for each purpose and each legal basis. In this case:

• Enrolling the child in the activity
• Taking photographs
• Using those photos for promotional purposes

These should be clearly separated.

According to the AEPD, taking and publishing images of minors requires separate consent for each purpose.

How to do it right: example of proper consent collection

At a minimum, the contract should include three separate consent requests:

1. Processing personal data for registration and service management (contractual basis):
   ☐ I authorize
   ☐ I do not authorize
2. Capturing images (photos or videos) of the minors during the stay, without public distribution:
   ☐ I authorize
   ☐ I do not authorize
3. Publishing those images for promotional purposes on own media (website, social media, brochures, etc.):
   ☐ I authorize
   ☐ I do not authorize

This guarantees:

• Granular consent (one purpose per checkbox)
• Mandatory legal information
• Easy revocation at any time

Additionally, these consents must appear separately from the general contract acceptance, and must always include:

• Identification of the data controller
• The rights users can exercise (access, rectification, erasure, objection, etc.)
• A contact channel

What happens if you don't do it correctly?

In the case of the reported academy, the imposed fine was €500, later reduced to €300 after applying legal discounts. A small amount, but a clear reminder that data protection is mandatory, especially when dealing with children.

Want to avoid sanctions?

At Lawwwing, we automatically generate 100% legal consent checkboxes adapted to each specific purpose. With a simple copy and paste, you can add the right clauses to your website or documents.

And if you need a custom clause or you manage activities with minors and want to make sure your consent forms comply with the law, our legal team can help you review and adapt them to avoid penalties.