Commercial Use Of Individuals’ Images In Advertising: Managing Legal Risk For Businesses In Nigeria

Introduction

In today's digital economy, an individual's image goes beyond being a personal identifier; it is an increasingly valuable commercial asset. Thus, it is no surprise that businesses, brands, event promoters (collectively “businesses”) now rely heavily on photographs and videos to market products and services, personalise customer experiences, train artificial intelligence (“AI”) systems, and drive engagement across social media and other digital platforms.¹ At the same time, advances in facial recognition, generative AI and digital advertising have made it easier than ever to capture, reproduce and monetise an individual’s likeness, often without that individual's knowledge or consent.²

Although Nigerian law still does not recognise a standalone statutory right of image or personality right,³ an individual's image may be protected through a combination of the constitutional right to privacy,⁴ data protection law⁵ and common law.⁶ The Supreme Court’s decision in Ubom v. Globacom^7is the clearest judicial statement of that position to date, distinguishing a copyright claim in a photograph from an image rights claim by the person depicted in it, and affirming that an individual may independently seek redress for the unauthorised commercial use of their likeness. This evolving framework reflects a broader shift away from viewing photographs solely as copyright works towards recognising that the identifiable individuals depicted in them may themselves possess legally protectable interests in how their likeness is collected, processed and commercially exploited.

Consider, for example, a large-scale sporting or entertainment event attended by thousands of people. An event of that scale typically attracts national and multinational sponsors who, in exchange for their sponsorship, seek to maximise commercial value through advertising campaigns, social media promotions and other marketing initiatives. Equally inevitable is that photographs and videos captured throughout the event will feature members of the audience, many of whom become incidental subjects of the promotional content.

For years, businesses have generally regarded this as an ordinary and commercially acceptable consequence of event coverage. However, the decision of the High Court of Lagos State (the “Court”) in Larry Nwabueze v. Nigerian Breweries Plc⁸ (“Nwabueze’s Case”) suggests that it can no longer be the norm. Specifically, the Court held that the unauthorised commercial use of an individual's photograph in an advertising campaign, without a lawful basis,⁹ (i.e. valid consent), infringes on the person’s constitutional right to privacy¹⁰ and amounts to unlawful processing of personal data under the Nigeria Data Protection Act, 2023 (the “NDPA”). While the decision does not create an independent image right under Nigerian law, it firmly reiterates the position that the commercial exploitation of an individual's likeness, without a lawful basis may attract both constitutional and statutory liability.

Against this backdrop, this article reviews the Court’s decision in Nwabueze’s Case, examines how photographs, videos and other biometric identifiers are increasingly treated as regulated personal data requiring a lawful basis for processing, and offers practical guidance to help businesses reassess how they collect, process and commercialise individuals' images with a view to minimising exposure to legal and regulatory liability.

Brief Analysis of Nwabueze’s Case

The dispute arose after Mr. Larry Nwabueze (the “Applicant”) attended a Goldberg Beer-sponsored El Clásico watch party at Johnny Rockets on 26 October 2024. The Applicant alleged that, although he expressly refused to be recorded when an event manager first attempted to film him, his image later appeared in Goldberg advertisements aired on SuperSport and published on Instagram and other social media platforms, thereby creating the impression that he endorsed the Goldberg brand. Consequently, he commenced a fundamental rights action at the High Court of Lagos State, contending that the unauthorised commercial use of his image violated his constitutional right to privacy and the NDPA.

The Applicant further argued that his image constituted personal data, and that its commercial use required valid consent under the NDPA. In its defence, Nigerian Breweries (the “Respondent”) relied on a Crowd Release Notice displayed at the venue, arguing that all attendees consented to being photographed and recorded simply by attending and remaining at the event. On that basis, it maintained that the Applicant had impliedly consented to the use of his image; had no reasonable expectation of privacy in the circumstances; and that the processing of his image in the promotional content was lawful on the grounds of implied consent and legitimate interest. Specifically, the Respondent sought to rely on the General Application and Implementation Directive, 2025 (the “GAID”),¹¹ which allows for implied consent where a data subject participates in a public event and images taken may be used for a report of that event. However, the Court rejected the reliance on the GAID, given that at the time the cause of action arose, the GAID was not yet applicable.¹²

The Court agreed with the Applicant, holding that:

1. an identifiable photograph constitutes personal data under the NDPA;¹³
2. its commercial use amounts to the processing of personal data; and
3. such processing must accordingly be supported by a lawful basis under the NDPA, including valid consent.¹⁴

The Court also found that the Crowd Release Notice did not meet the NDPA's statutory requirements for consent, and that the Respondent had failed to establish any other lawful basis for processing the Applicant's image. Consequently, the Respondent was held liable for the commercial use of the Applicant's photograph, as the use was deemed unlawful. The Court thereafter awarded the sum of

₦10,000,000 (Ten Million Naira) as general damages against the Respondent, together with ₦500,000 (Five Hundred Thousand Naira) in costs. The Court also ordered that the Applicant’s images be permanently removed from all platforms and outlets where they had been displayed, and granted a perpetual injunction restraining any further use.

The Court’s decision also sits comfortably alongside the Nigerian Code of Advertising, 2023 (the “Code”), which already requires advertisers to obtain prior consent before using an individual’s image in a manner that suggests personal endorsement. The Code prohibits the use of an individual's picture, name or identity to imply endorsement without prior consent,¹⁵ and requires that express consent for the use of personal data in advertising endorsements be obtained beforehand.¹⁶ Taken together, these statutory frameworks provide the legal backdrop and elevate what might have been treated as a regulatory expectation into an obligation capable of founding civil liability and financial penalties.

Although the judgment does not amount to judicial recognition of a standalone image right comparable to the right of publicity in the United States or personality rights jurisprudence in South Africa,¹⁷ it does meaningfully strengthen the protection available to individuals whose images are commercially exploited without consent. More importantly for businesses, it sends an unambiguous message: businesses can no longer regard photographs merely as creative content.

Where an image identifies an individual, it is also regulated personal data, and its commercial use may carry constitutional, statutory and financial consequences if it is not handled lawfully.

Commercial Implications and Implementable Measures for Businesses

Nwabueze’s Case is an important milestone in the development of image rights in Nigeria, confirming that the commercial use of an identifiable person's image may engage both constitutional privacy protections and the obligations imposed by the NDPA. In light of the Court’s decision and its implications for image-based marketing, businesses should consider the following practical measures:

a. Obtain Clear, Specific and Documented Consent Before Using an Individual's Image for Commercial Purposes

The Court’s decision demonstrates that a generic photography notice or crowd release may not, without more, be sufficient to authorise the commercial use of attendees' images. Businesses that organise sponsored events should distinguish between capturing images to document an event and using those images in advertising campaigns, promotional materials or endorsements. As a matter of best practice, the primary mechanism should be to include a photography and filming clause in event registration terms, ticket conditions or other contractual documentation. Attendees should be informed, before registering, that photography and filming will take place, the purposes for which their images may be used (such as marketing, social media, future promotional campaigns or internal communications), who will use the images, the applicable lawful basis for processing, how long the images will be retained, and the rights available to them under the NDPA. These disclosures should also be reinforced through a clear and accessible privacy notice.

Where individuals are likely to feature prominently in commercial advertising or promotional materials, businesses should also consider obtaining express consent through model release forms or other clearly documented mechanisms defining the intended scope of use. Although express consent may be given orally, in writing or by electronic means,¹⁸ the meticulous handling and retention of such evidence is material to provide the strongest evidential basis in the event of a dispute.

b. Distinguish Copyright Ownership from the Right to Commercialise an Individual's Image

Copyright ownership does not, by itself, confer the right to commercialise an individual's image. A business may own or license the copyright in a photograph and still lack the legal right to use the identifiable individual's image for commercial purposes. Businesses must therefore consider not only who owns the underlying intellectual property, but also whether they have a lawful basis under the NDPA and the broader legal framework to process and commercially exploit the image of the person depicted.

c. Treat Image-Based Marketing as a Data Protection Exercise

The Court's recognition of an identifiable photograph as personal data means that advertising campaigns involving individuals' images should now be subject to the same governance and compliance processes as other forms of personal data processing. Before launching image- based campaigns, businesses should ensure that they have an appropriate lawful basis under the NDPA and verify that the proposed use is consistent with the purpose for which the images were originally collected.

These considerations become even more important where images are deployed across multiple platforms, shared with third-party agencies, or incorporated into AI systems, facial recognition technologies or other data-driven marketing initiatives. Marketing teams can therefore no longer regard the use of individuals' images as a purely creative exercise; it should also be approached as a data protection and compliance issue.

d. Embed Image Governance into Compliance Frameworks

The practical response to this decision is for businesses to strengthen their internal governance around the collection, processing and commercial use of individuals' images. In effect, businesses should review event registration processes, photography and filming policies, contracts with photographers and marketing agencies, template consent and model release forms, image retention practices, and internal approval procedures for advertising campaigns. Businesses should also establish clear procedures for responding to individuals who object to the use of their images or subsequently withdraw consent.

Conclusion

Nwabueze’s Case is another significant step in the steadily maturing sphere of image rights in Nigeria. By recognising an individual's image as personal data and subjecting its commercial use to the requirements of the NDPA, the Court has reinforced the legal framework governing the commercial exploitation of likenesses.

Although this is a decision of the High Court and may ultimately be subject to an appeal, it nonetheless represents the prevailing judicial position on the commercial use of individuals' images in Nigeria. Thus, until an appellate court decides otherwise, businesses would be well advised to take heed of the principles articulated by the Court and ensure that their practices align with them.

Accordingly, businesses should take advice to ensure that their image collection and commercialisation practices comply with applicable legal and regulatory requirements. Although the practical realities of large-scale events may present operational challenges, there are practical and legally compliant mechanisms for obtaining and managing consent. Businesses should therefore treat the commercial use of individuals' images as both a privacy and compliance issue, embedding robust consent processes and image governance into their broader compliance frameworks to minimise legal and regulatory risk.

Footnotes

1 World Intellectual Property Organization, WIPO Conversation on Intellectual Property (IP) and Artificial Intelligence (Revised Issue Paper, 21 May 2020) https://www.wipo.int/meetings/en/doc_details.jsp?doc_id=499504 accessed 22 July 2026.

2 Organisation for Economic Co-operation and Development, OECD Digital Economy Outlook 2024 (Volume 1): Embracing the Technology Frontier (OECD Publishing 2024) https://www.oecd.org/en/publications/oecd-digital-economy-outlook-2024-volume-1_a1689dc5-en.html accessed 22 July 2026.

3 Image rights refer to a person's proprietary and commercial control over their own persona, name, likeness, and voice. Also known as the right of publicity or personality rights, they grant individuals the exclusive power to authorize or prevent the unauthorized commercial exploitation of their identity.

4 Section 37 of the Constitution of the Federal Republic of Nigeria 1999 (as amended).

5 Sections 24–30 and 65 of the NDPA (a photograph may be considered sensitive/personal data where it identifies the likeness of a natural person or uniquely identifies a natural person).

6 Common law causes of action may include passing off (particularly in cases of false endorsement), breach of confidence, and, where applicable, defamation.

7 (2025) 6 NWLR (Pt. 1985) 157. To access Templars publication on this subject: https://www.templars-law.com/knowledge-centre/beyond- the-lens-re-imagining-copyrights-and-image-rights-in-photographs-under-nigerian-law/

8 Suit No: ID/19573MFHR/2025, Judgment of the High Court of Lagos State, Ikeja Judicial Division, delivered 26 May 2026.

9 Personal data may be lawfully processed where: (a) the data subject has given and not withdrawn consent for the specific purpose(s) of processing; (b) processing is necessary for the performance of a contract with the data subject or to take steps at the data subject's request prior to entering into a contract; (c) processing is necessary for compliance with a legal obligation to which the data controller or processor is subject; (d) processing is necessary to protect the vital interests of the data subject or another person; (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller or processor; or (f) processing is necessary for the purposes of the legitimate interests pursued by the data controller, processor or a third party, provided such interests are not overridden by the fundamental rights and freedoms of the data subject—Section 25 of the NDPA.

10 Section 37 of the Constitution of the Federal Republic of Nigeria 1999 (as amended).

11 Article 17(8)(a) of the GAID.

12 The GAID became enforceable on 19 September 2025. It is however important to note that notwithstanding the inapplicability of the GAID at the time, if similar circumstances were to arise now (Given that the GAID is now applicable), the implied consent of the GAID does not extend to using such images for commercial purposes; it is permitted for reportage and nothing more.

13 Section 65 of the NDPA defines personal data as any information relating to an identified or identifiable natural person.

14 Section 24 of the NDPA defines processing broadly to include the collection, recording, storage, use, disclosure and dissemination of personal data.

15 Article 12 of the Code.

16 Article 13 of the Code. Additionally, Article 148(f) prescribes ₦500,000 (Five Hundred Thousand Naira) as a minimum fine for breach of these obligations.

17 See Grütter v Lombard and Another 2007 (4) SA 89 (SCA) and Wells v Atoll Media (Pty) Ltd and Another (11961/2006) [2009] ZAWCHC 173, where South African courts protect identity and likeness through personality rights.

18 Section 26(7)(b) of the NDPA.