Think of the last photograph taken of you in a public place and ask yourself whether you truly knew where it would end up. Nowadays, restaurants post customer photographs on social media, gyms record and post promotional videos during peak hours, while concerts, malls, sporting events and entertainment venues routinely capture patrons who later appear in advertisements they never expected to feature in. Most people barely glance at the disclaimers mounted on walls or printed on tickets. Fewer still stop to consider that a casual photograph could become part of a marketing campaign viewed by thousands, if not millions.
This practice has become so commonplace that many businesses appear to assume consent where none may truly exist. A smile for a camera is often treated as permission for publication. Entry into a venue is taken as acceptance of terms hidden in fine print. Yet as our lives become increasingly documented and commercialized, one uncomfortable truth emerges: many establishments simply do not care whether they have valid consent, because they assume no one will challenge them. When the law is clear but compliance is optional, what incentive do businesses have to change?
The question recently came before the High Court in Kimutai Jinaro Kipchirchir v Hornbill Rongai Limited (Civil Case No. E017 of 2022) [2026] KEHC 5928 (KLR) (30 April 2026). Kimutai, an advocate of the High Court of Kenya, attended a birthday celebration at a nightclub only to later discover his photograph on the club’s Instagram page accompanied by a caption encouraging followers to embrace “midweek madness”. Believing that his image had been used without his consent to promote the club’s business, he brought a suit alleging violations of his privacy, dignity and personality rights.
The nightclub argued that patrons were notified through notices displayed at the premises and that Kimutai had voluntarily posed for the photograph. The Court, however, drew an important distinction. A person may agree to have their photograph taken without agreeing to the commercial use of that photograph. Consent under the Data Protection Act CAP 411C must be express, unequivocal, specific, informed and freely given. A generic disclaimer or an informal exchange in a crowded social setting is unlikely to meet that threshold.
What makes the High Court decision significant is that it goes beyond data protection compliance. The Court recognized that an individual’s image is an aspect of their identity and dignity. By using the plaintiff’s likeness for commercial promotion without valid consent, the nightclub infringed not only his privacy rights but also his right to control the commercial use of his own image. The Court consequently awarded damages and issued a permanent injunction restraining further use of the photograph without consent.
For businesses that are increasingly reliant on social media marketing, the judgment sends a clear message: customer photographs are not free advertising material simply because they were taken in a public or social environment. The burden rests on businesses to demonstrate that meaningful consent was obtained.
As cameras become ubiquitous and personal images increasingly fuel commercial content, the law continues to demand informed consent while everyday practice often relies on assumption and convenience. The High Court’s decision is therefore a timely reminder that consent is not a formality to be implied; it is the foundation upon which privacy, dignity and personality rights are built. However, if the law is clear and compliance remains optional, what incentive do businesses have to change? The answer lies in judgments like this one, where the High Court and the ODPC award damages, issue injunctions and make exploitation costly. The line between participation and exploitation will remain dangerously thin until businesses recognize that non-compliance carries real financial and reputational consequences, and that privacy compliance is not an afterthought but a non-negotiable cost of doing business in the digital age.
This publication is meant for general information only and does not constitute legal advice, nor does it create an advocate-client relationship between any reader and Mboya Wangong’u & Waiyaki Advocates. For particular expert advice on any matter dealt with above, please contact us at advocate@lexgroupafrica.com for tailored legal support.
Authored:
Mary Ndung’u and Serah Kamau
