Before and After Rules in Ireland: Clinics Need More Than Consent

In Ireland, before-and-after photos are advertising, so they must not mislead, and the HPRA expects them to show typical results. Label every post as marketing under the ASAI Code, and collect written, informed consent that states where the images will appear and how long you will keep them. Keep the paperwork, and never imply the HPRA endorses your treatments.

TL;DR:

Get written consent before treatment, naming each permitted channel, retention period, withdrawal contact, and specific image use; obtain renewed permission if plans change.

Match lighting, angle, pose, distance, and camera settings; caption the treatment timeframe and contributing aftercare, and identify exceptional outcomes rather than presenting them as typical.

Place the clinic name and advertising disclosure in the image or first caption line; platform labels alone may not stop promotional posts from resembling reviews.

Link every image to its consent record and publication locations, restrict access, set an expiry date, and remove device copies after secure filing.

Before posting injectables or other medical procedures, confirm applicable rules with your regulator or indemnity provider, because cosmetics guidance may not cover them.

Growthreachmarketing

Make Clinic Marketing Clearer

Growth Reach Marketing helps aesthetic clinics build visibility and attract qualified leads through search optimization and content marketing.

Visit Growth Reach Marketing

What the before and after rules in Ireland require
How do you get consent that stands up to an audit?
How should you shoot and caption before-and-after photos?
How do you make marketing clearly identifiable under the ASAI Code?
How should you store images and keep them secure?
What does a practical clinic workflow look like?
How do the rules differ by treatment type?
What mistakes cause the most trouble?
How do you handle clients under 18 and vulnerable groups?
What should you do when a client withdraws consent?
Why does a compliance-first approach make better marketing?
How we help clinics publish compliant before-and-after content
FAQ
Sources

What the before and after rules in Ireland require

Three bodies shape how you can use client photos. The checklist below is the baseline we work from with every clinic.

HPRA: claims about cosmetics must be supportable, and visual evidence such as before-and-after photos must reflect typical results. This covers leaflets, websites and social media alike.
ASAI: marketing must be clearly identifiable. Content you control or pay for cannot pose as an independent review or as user-generated content, a point the ASAI makes in its Code.
DPC and GDPR: consent must be informed, specific and documented, and it should cover retention and withdrawal. The Data Protection Commission treats written consent and a clear retention policy as the safe route for promotional photos.
No implied endorsement: the HPRA does not approve cosmetic brands, and claims suggesting otherwise are misleading.
Records: keep signed consent forms, an image log and the privacy text that was live when you published.

For wider context on why clinic ads attract scrutiny, see our piece on why aesthetic clinic ads need compliance.

GDPR consent has to be freely given, specific, informed and unambiguous. For marketing photos, written consent is the clearest way to prove it. The DPC’s guidance indicates that verbal permission may be insufficient for long-term marketing use, and a DPC case against a state agency turned on unclear verbal permission and weak information about use and retention.

Build your form in this order:

Name the client, the treatment and the date the photos were taken.
List every permitted use separately: website, Instagram, Facebook ads, print.
State the retention period in plain words, using a clear period appropriate to your policy.
Explain how to withdraw consent and who to contact, with a phone number or email.
Add a signature and date, plus a tick box per use so clients can say yes to one channel and no to another.
Link to your full privacy notice.

Timing matters. Present the form at the pre-treatment consultation, when the client is calm and has time to read. If the intended use changes, or the client seemed unsure, reconfirm after treatment and before anything goes live.

Whether legitimate interest is an appropriate basis for publishing identifiable treatment results depends on the circumstances; seek qualified advice before relying on it. If you rely on it, consider documenting your assessment and the reasons for your decision.

Pro Tip: Give clients a concise consent summary to sign, and keep the full privacy notice on your website. A concise form may be easier for clients to read, while the full privacy notice can provide further detail.

Our guide to GDPR email consent for salons and clinics covers the same consent logic for your mailing list.

How should you shoot and caption before-and-after photos?

A photo can mislead without a single false word. If the “after” shot has better lighting, a flattering angle or a quiet filter, the HPRA test of typical results is in doubt. Treat photography as part of your claim.

Keep conditions identical: same lighting, distance, pose, angle and camera settings. A tripod and a marked spot on the floor solve most problems.
Caption the timeframe: “12 weeks after the second session” tells viewers what the result actually took.
Disclose edits: crop for privacy if you must, but never retouch skin, contour or color. If you adjust anything for file size or framing, say so.
Flag outliers: an exceptional result should be labeled as exceptional, not posted as the norm, because the HPRA’s standard is about what most clients can expect.
Add context: name the treatment and any aftercare or adjunct products that contributed, such as a home-care routine or a follow-up session.
Avoid makeup and styling gaps: a “before” with no makeup and an “after” fully styled exaggerates the effect.

Our YMYL content playbook for aesthetics has a visual checklist you can adapt for your team.

How do you make marketing clearly identifiable under the ASAI Code?

The ASAI’s recognisability guidance says marketing communications should be identifiable as such, should not misrepresent their purpose and should name the advertiser where appropriate. Disclosures should be visible before the viewer interacts with the content, not tucked away afterward.

Lead with identity: make the advertiser and the promotional nature obvious in the first line or on the image itself.
Use platform labels: turn on paid-partnership and ad labels, but do not rely on them alone if the caption reads like a personal story.
Never dress ads as reviews: a post you wrote, paid for or edited is marketing, even if a client’s words appear in it.
Disclose influencer arrangements: if you pay, gift or control the content, say so plainly. Our partners at Vain have a useful note on influencer whitelisting and sponsored content.
Keep disclosures readable: small grey text at the bottom of a long caption will not pass.

Pro Tip: Put a short visible tag, such as “Ad: [Clinic name]”, on the image or in the first caption line. It costs nothing and removes most recognisability complaints before they start.

Platform setup details are in our Instagram lead ads templates for clinics.

How should you store images and keep them secure?

Consent only protects you if you can prove it and control the files afterward. The DPC’s casework shows that businesses acting as data controllers should keep audit-ready records linking images to permission.

Keep an image register: each file links to a consent record and every place it has been published.
Restrict access: store photos in a password-protected, encrypted system, not on personal phones or a shared camera roll. Give access only to staff who need it.
Set a retention date: state the period in the consent form and the privacy notice, then schedule regular reviews to delete expired images.
Separate working files from published ones: raw consultation photos need tighter controls than approved marketing versions.
Document any legitimate interest reliance: if you capture wider images on that basis, write down the balancing test and why clients would reasonably expect it. The DPC’s photography guidance stresses transparency and common sense.
Remove device copies: once a photo is logged and stored securely, delete it from the phone that took it.

What does a practical clinic workflow look like?

Compliance sticks when it becomes routine. This is the sequence we set up for clinics.

At booking and consultation: tell the client you may photograph their results, hand over the consent form and answer questions before treatment.
After treatment: confirm the client is still happy before any image is published, and reconfirm if the planned use has grown.
On filing: log each image with its file name, an internal client ID, the consent reference, publication locations and an expiry date.
On your website and social profiles: host the privacy note on one page and link it from your bio, your booking page and your footer.

The consent form itself needs a few fixed fields: client name, treatment, permitted uses, retention period, withdrawal method, signature and date. Copy those headings straight into your template.

How do the rules differ by treatment type?

The same general principles may apply across treatments, but the relevant considerations can vary with the service. Think about what a viewer could reasonably conclude from your image.

Skin treatments such as facials, peels and skincare programs are the most common cosmetic claims. Show results after a realistic course, name the number of sessions and avoid language suggesting medical outcomes like curing acne or scarring. Check the HPRA’s cosmetics rules when making claims about a cosmetic product, and ensure those claims are supportable and not misleading.

Hair, lash and brow services are easier to document, but lighting and styling can still distort the comparison. Match brushing, parting and product use in both shots.

Body contouring and cellulite treatments attract the most skepticism, so be strict about timeframe, lifestyle factors and typical response. If diet, exercise or a course of sessions contributed, say so.

The cosmetics guidance may not cover injectables and other medical procedures. Confirm which rules apply to your service with your regulator or indemnity provider before posting. We can only speak to the cosmetics, recognisability and data protection rules covered here.

Across every category, ask one question before posting: would an average client who books this treatment expect to look like this? If not, add context or choose a more representative case.

What mistakes cause the most trouble?

Most problems come from habit rather than bad intent. These are the patterns we see most often.

Verbal consent only: a quick “is it okay if I post this?” leaves no record and, as the DPC’s casework shows, can fail the informed consent test.
Cherry-picked results: posting only your best-ever outcome implies an average the HPRA’s typical results standard does not support.
Uneven photography: different lighting, tan, makeup or posture between the two frames.
Hidden or missing labels: boosted posts and ads that read like personal updates, contrary to the ASAI’s recognisability expectations.
Implied HPRA approval: phrases like “HPRA approved” or “regulator tested”, which the HPRA has warned against.
No retention date: photos that live forever on a feed with no review.
Reusing old images: consent given for a website gallery does not automatically cover a paid Facebook campaign.
Ignoring withdrawal requests: deleting the original post but leaving copies in ads, stories or highlights.

Each of these is fixable with the forms and logs described above. If you also run paid campaigns, our guide to common salon social media mistakes goes deeper on the channel side.

How do you handle clients under 18 and vulnerable groups?

Photos of children and vulnerable adults need extra care, and for aesthetic marketing the safest default is not to use them at all. Many cosmetic services are not appropriate for minors in the first place, and publicity featuring them invites scrutiny.

Where a young person appears in a non-clinical context, such as a hair or nail service, check the applicable consent requirements and take particular care to ensure the young person and their parent or guardian understand the proposed use. The form should be signed by the adult with parental responsibility, explain the use in terms a young person can follow, and be revisited as they get older. The DPC’s case on a child’s photograph used in promotional material shows what happens when permission is vague and the person was not properly informed about use and retention.

For vulnerable adults, including clients who may struggle to understand the request or feel pressure to agree, take more time. Explain the purpose in plain language, offer a chance to take the form home, and never make photography a condition of treatment or a discount. If you have doubts about someone’s ability to give free and informed consent, do not publish.

Whatever the situation, avoid showing faces where a cropped or anonymized image makes your point, keep these files in a restricted folder, and set shorter retention periods than you would for adult clients.

Explain clearly in your form how a client can withdraw consent. Treat every request as urgent, because delay turns a simple fix into a complaint.

Acknowledge in writing: confirm receipt promptly and tell the client when the work will be done.
Check the image log: find every location listed for that file, including ads, stories, highlights, email and print.
Remove or archive: take the image down from each platform, pause or replace any ad creative using it, and delete the stored copies unless you have a documented reason to keep them.
Update the register: record the date of the request, what was removed and who completed it.
Confirm completion: tell the client it is done, and ask them to flag anything you missed.

Be honest about limits. You cannot control screenshots or copies others have shared, but you can remove what you control and say so. This is why a complete image register matters: without it, you are guessing where a photo lives.

Review live content regularly, too. If a retention date has passed or a treatment protocol has changed so the result is no longer representative, retire the image before anyone asks. A client who feels respected rarely escalates.

Why does a compliance-first approach make better marketing?

In our view, publishing transparently can help clinics build trust and avoid misleading impressions. We run compliance checks and template-driven workflows on every clinic campaign we manage, and they save time rather than cost it. Spend an afternoon building consent templates and an image register now, and you avoid the far bigger problem of explaining a takedown or a complaint later.

— Gerard

How we help clinics publish compliant before-and-after content

We manage Facebook and Instagram ads and social media for salons and aesthetic clinics, and every creative goes through a compliance-first review before it launches: labeling, caption claims, image conditions and consent records. If you want a faster start, get in touch for a clinic-specific plan. We will map your next campaign to the rules above.

FAQ

Are before-and-after photos allowed in Ireland?

Yes, but they count as advertising, so they must not be misleading and must reflect typical results under the HPRA’s guidance. You also need informed client consent and clear marketing labels.

The DPC says consent must be specific, informed and documented, and written consent is the safest way to prove it. Verbal permission rarely holds up for long-term marketing use.

Do I have to label before-and-after posts as ads?

Yes, if you control or pay for the content. The ASAI says marketing must be clearly identifiable and not presented as an independent review, and disclosures should be visible before the viewer interacts with the post.

Can I say my treatment is HPRA approved?

No. The HPRA does not endorse cosmetic products or brands, and claims implying approval are considered misleading.

How long can I keep and use a client’s photos?

There is no single fixed period. State a retention period in your consent form and privacy notice, review images regularly, and delete them when that period ends or when the client withdraws consent.