A parent who wants the rule set once
Karen Madsen · 41 · works in Aarhus. Liam, her son, is 8 — Klasse 2A at Skanderborg Skole, the SFO afterwards. She is the parent making the call until he turns 18. Tried emailing the school secretary three times. Nothing happened.
A magic link, not a signup form
Karen gets an email: "Skanderborg Skole wants to use photos of Liam." She clicks. No signup form, no password to invent.
Because her record says she manages Liam, the portal greets her in that role — no role-picker, no menus. Sixty seconds from email to "I am in control of this." That is the whole onboarding.
The actual photos. Decide per Purpose.
She sees the photos of Liam the school holds — Klasse 2A skolestart, sports day, the school musical, the autumn break trip and a couple more. Not stock photos. Not a policy document. The photos.
The school runs four Purposes. Per Purpose: Allow Annual yearbook. Block Public website and prospectus. Decide-per-image on Quarterly newsletter. Allow Staff and parent intranet — internal-facing material only. No legalese.
One portal, every controller
Liam is at the school during the day and the SFO after. The school and the SFO each invited Karen separately — two independent controllers, two magic links. Both run their own Ansikt instance, so both invitations land in the same portal. One pane of glass, every controller that holds his photos in one place.
The grid is asymmetric — the school has four Purposes that need a call, the SFO has two — so she decides per cell, not in bulk across both. Deny Public website and prospectus at the school. Allow the yearbook. Block the SFO website. Five seconds. Saved atomically. She did not have to email anyone.
A second controller will start using photos too — apply the existing rule
A second controller — say the SFO under the same municipal umbrella as the school — will start posting weekly-recap photos. It is its own controller, its own library, its own consent record. Ansikt will pair Liam against the face on file at the school and notify Karen: "Skanderborg SFO has three photos of Liam. Apply your standard preferences?"
One tap. The same rules apply. The SFO will not need to chase her and she will not need to chase the SFO.
Revoke at any controller, any time
The page lists every controller Karen has agreed to — Skanderborg Skole and the SFO — and offers a per-controller Revoke consent here. One tap switches that controller's matching loop off for Liam. No email, no escalation, no waiting on a reply.
Each controller keeps its own face on file for Liam — built when they labelled his face in group photos under her consent. The revoke button is the legal pair of that: the consent she gave to one controller can be taken back at that same controller.
Withdraw — operator notified within seconds, image cascade within minutes
A photo in the yearbook spread is one Karen did not want public. She opens the image and taps Withdraw. The school has 30 days to scrub its channels.
The request lands on her Removal requests page — one row per purpose the photo was used under, the deadline date, and the per-channel state. The proxy-served intranet flips to blurring; the yearbook PDF is a manual takedown the school's communications lead has to do by hand.
That is the parent's side. Want to see the other angles?
The school's customer-side view of the same loop, including the DPO running the audit. Or an adult subject's view of the same mechanics without the guardian wrinkle.