Keep photo consent current after publication.
A subject withdraws. Consent expires. A data subject asks where their images are used. Ansikt gives you a working view of the affected images, the decisions behind them, and the audit trail for what changed.
What is already in place before something changes.
This workflow assumes the archive review or new-images workflow has already run: sources are connected, known people are matched, consent records are linked, and publish decisions are recorded. If none of that is in place yet, start with Workflow A: Clean up or migrate or Workflow B: Add new images.
For Article 15 and 17 requests, the 30-day clock starts when the request reaches your organisation, not when it reaches Ansikt. The faster your DPO can find the affected images, the more headroom there is to validate identity, redact third parties, decide the response, and reply.
Eight steps from change to recorded action.
-
Something changes. Open Ansikt.
An access request, an erasure request, a withdrawal, a takedown, or a consent term that has just expired. Different trigger, same first job: find the affected images before the work spreads across inboxes and asset folders.
-
Expired consent is flagged.
When a Campaign reaches its end date, Ansikt marks the related decisions as inactive and records the transition. Images using that Purpose move into review instead of quietly staying approved.
If the engagement continues, you review what consent is needed for the longer use. Ansikt keeps the old expiry visible, so an extension does not become an invisible paperwork shortcut.
-
Find the affected images.
Your DPO searches by reference photo or by an existing person record. Ansikt returns the appearances it knows about across connected sources, with source path, crawl date and confidence label.
The point is not to make a legal decision automatically. It is to avoid asking three teams to search five systems by hand and wait for an uncertain answer.
-
Confirm uncertain matches.
You review the results. Clear matches move quickly; uncertain matches need a yes or no decision. Ansikt records what you confirmed and what you rejected.
If an export is needed, third parties in the same image still need normal review before anything leaves your organisation.
-
Decide what changes.
Your DPO or editor chooses the action. Access request: prepare the export. Erasure, withdrawal or expiry: remove, blur, expire or replace the affected use.
If the subject withdraws one Purpose but keeps another, only that Purpose changes. The same image may remain usable in one context and blocked in another.
-
URL Proxy handles proxied images.
For images served through the Ansikt URL Proxy, the change is applied on the next request: the affected face is blurred in the served image.
For images served directly from your origin, or hosted somewhere the proxy does not sit in front of, Ansikt records the decision and surfaces the source URL. Your editor still has to remove or replace the file manually.
-
Export the answer or proof of action.
For Article 15, your DPO exports the appearances, source paths and decisions needed for the response.
For Article 17, withdrawals and expiries, the export is the action record: what changed, where it changed, when it changed, and who approved it.
-
The audit trail is updated.
Every search, match decision, takedown action and export is written to the audit log with operator, timestamp and reason.
If removed material appears again in a connected source, Ansikt can surface it on a later pass so the same decision is not lost after a restore, reupload or manual mistake.
Images stay where they are. The action is logged.
Original images stay where they always were — in your DAM, your CMS, your drives. The operate lane does not change custody.
The request itself — the email, the form submission, the identity proof — stays in your case-management system or your DPO's inbox. Ansikt does not store request metadata.
The audit rows created during operation sit with Ansikt, in the same audit log the other workflows write to. See Security for hosting, access control and retention details.
The places that need a human.
Three things stay in human hands: confirming uncertain matches, deciding the action, and removing images served outside the URL Proxy.
Ansikt narrows the work and records the result. Your DPO or editor still owns the judgement.