Photo sharing apps and GDPR: what to check, and what providers say in 2026

An event photo app with face recognition processes biometric data: under the GDPR it requires explicit consent, limited retention and clear information. Among the providers surveyed, CéSAR Photo states it deletes the selfie after the search, runs its own model (no third-party service) and hosts its database in the EU; most others do not detail these points on their pricing page.

“GDPR compliant” has become a sales argument, but it means little without details. Five questions help sort: what happens to the selfie, what is kept (a template?), who runs the face recognition, where is data hosted, and for how long. The table below lists what each provider publicly states; “not stated” means the information wasn't on the page consulted on October 5, 2026, not that the practice is bad. This article is not legal advice.

The comparison at a glance

CéSAR Photo: most detailed about its practices

Explicit consent before analysis; selfie deleted a few seconds after the search; only a 512-number template is kept, comparable only with faces from the same event; InsightFace model run by CéSAR Photo; full erasure at gallery expiry or deletion. Database in the EU (Neon), photos on Cloudflare R2, application on Vercel: the privacy policy lists the subprocessors.

Evokly: explicit consent stated

Its page states consent is explicitly requested before the selfie is compared; hosting and selfie retention are not stated on the page consulted.

Keep Pics: GDPR claimed, third-party provider

States GDPR compliance and says it uses AWS Rekognition, an Amazon service: images therefore pass through a third-party provider. Information from its own site.

Gathmo: hosting: conflicting information

No face recognition mentioned, so no biometric data at stake. On hosting, its pricing page mentions servers in Phoenix (Arizona) with media on Cloudflare, while its blog speaks of Frankfurt: ask which applies before using it for photos of people in Europe.

Waldo Photos: practices not detailed on the pricing page

Face recognition by selfie, but the pricing page consulted details neither hosting nor selfie retention: read its privacy policy before using it for European guests.

Google Photos: Google account and personal settings

No selfie search for guests; data depends on the organizer's Google account and sharing settings. Simple, but without an event-dedicated framework.

The five questions to ask the provider

• Is consent explicitly requested before any face analysis?
• What happens to the selfie: deleted immediately, or kept? For how long?
• What is kept to find the photos (a mathematical template) and can it be deleted?
• Who runs the recognition: the service's own model or a third-party provider? Where are the servers?
• What happens when the gallery ends: complete erasure of photos and templates?

Frequently asked questions