Consent in the field — a commissioned campaign shoot

Before anyone is photographed, Sofie sets the Campaign up in Ansikt. She names it ("Dementia outreach — Plejehjem Bispebjerg, March 2026"), picks the legal basis (consent), defines the Purposes (campaign website, social, printed poster), lists the Channels, and sets an end date: when the Campaign closes, the photos go inactive on their own.

Then she generates a consent card for the shoot, branded as her campaign rather than as Ansikt. It carries the exact Purposes above, in plain language. It will be printed on cards and loaded on a tablet at the venue. The card on the right is a mockup of what a resident or relative will see.

Shoot day at the care home. A staff member runs a consent station — a tablet on a table, not "scan this with your own phone", because that does not fit the people in the room.

Each resident goes through it, or a relative does it on their behalf where the resident cannot consent themselves — the same guardian path the school story uses. They read the Purposes, decide each one, and take a selfie. The selfie is the reference that lets the photographer's later shots be matched to the right person.

Consent and selfie are captured in the same step. Ansikt holds the selfie on Sofie's behalf, as her processor — Sofie remains the controller. The selfie is encrypted, EU-hosted, retained for the lifetime of the consent, and deleted when the consent expires or is withdrawn. Because consent and the selfie arrive together, Ansikt still never holds a face reference for anyone who has not said yes.

The photographer shoots the campaign and uploads the take into the Campaign's image scope. Ansikt detects the faces and matches them against the selfies from the consent station — confident matches link automatically, borderline ones queue for a quick check. A resident who consented is recognised and carries their own per-Purpose decisions. A face with no consent on file — a visitor in the background, someone who declined — stays unattributed and blurs by default.

This part is not new. It is the same detect-match-preview beat the club already runs live; the only difference is where the consent came from.

Sofie previews the gallery as the public will see it: consented faces sharp, everyone else blurred. When she publishes, Ansikt records each use as Image × Purpose × Channel — dated, attributed, in the audit log.

And the end date she set in Step 1 does its job: when the Campaign closes, the images go inactive without anyone remembering to pull them. Consent given for a Campaign does not outlive the Campaign.

Months later, a relative changes their mind. They open the portal, find the photo, and withdraw. The Campaign has thirty days to clear its channels — the proxy-served website blurs the face within minutes; a printed poster is a manual takedown someone logs by hand.

Same withdrawal machinery the other stories use. Field-collected consent is not a separate world — it is the front of the same pipe.