Photographers14 min readBy PhotoView.ioPublished October 21, 2026

Gallery Permissions for Clients: A Photographer's Guide

Decide who can view, download and share each client gallery. A practical guide to access levels, downloads, expiry and copyright for working photographers.

Gallery Permissions for Clients: A Photographer’s Guide

Photographer setting access for a client gallery

Gallery permissions decide who can open a client gallery, what they can do once inside, and for how long. Set them by role, not by habit. Give the person who hired you full access, give guests and vendors less, and keep every link private by default. Do that and delivery stays fast, your files stay yours, and your clients’ photos stay out of places they never agreed to.

This guide walks through each permission you control, how to match it to the person on the other end, and a simple setup you can repeat for every shoot.

PhotoViewKeep Client Galleries OrganizedPhotoView helps photographers store and curate finished photos, then share them privately through mobile-ready presentations and galleries.Explore PhotoView

TL;DR

Treat every client gallery as a private business portal. Start closed, then open only what each person needs.
Split access by role: the client gets full-resolution downloads, guests and vendors get less, and public viewers get nothing.
Avoid open “anyone with the link” sharing for client work. Use a password, a named invite, or an expiry date.
Downloading a file is not owning it. Spell out usage rights in your contract, because copyright stays with you unless you sign it away in writing.
Review old galleries on a schedule, and remove access when a project is finished.

What “gallery permissions” actually cover
Why client galleries deserve real access control
The problem with open links
Build access by role
The permission dials, one at a time
Downloading is not owning: copyright and usage rights
Be transparent about how images are used
Our perspective
A repeatable setup for every shoot
Where PhotoView fits
Common mistakes to avoid
FAQ
Sources

What “gallery permissions” actually cover

The phrase sounds like one switch. It is really five separate decisions, and mixing them up is how photos end up where they should not be.

Visibility: can the gallery be found, or only opened by someone who has the link?
Authentication: does the viewer need a password, a PIN or an invitation?
Actions: can they favorite, comment, download, or order prints?
File quality: do they get full-resolution originals, web-size files, or watermarked proofs?
Duration: when does access end?

Each decision can be tuned per gallery, and ideally per person. The more you treat them as independent dials, the less you rely on one blunt “private/public” toggle.

Why client galleries deserve real access control

Client photos are personal data. Faces, homes, children, wedding guest lists and event locations all sit in your gallery. The Federal Trade Commission’s guide to protecting personal information asks businesses to consider who has, or could have, access to the information they hold, and whether those people need it. That question maps directly to a gallery: who can open this, and do they need to?

The same guide warns that careless handling of collected information can damage customer trust and create legal exposure. You are a small business, but a family portrait set is still information you collected and are responsible for.

A cautious note on scope: laws about image privacy and data protection vary by state and country. If you shoot for clients in more than one place, or you photograph minors, ask a local attorney what applies to you. The guidance below is about good practice, not legal advice.

The problem with open links

The easiest way to deliver a gallery is to send a public URL. It is also the weakest. Anyone who receives that link can forward it, post it, or paste it into a group chat, and you never find out.

Cybersecurity guidance for business cloud apps makes the same point about file sharing in general. A federal CISA baseline for OneDrive for Business recommends disabling or tightly limiting “Anyone” links, because files can reach people the owner never intended. It is written for office files, but the logic carries over to a gallery of family photos.

We cover the practical side of this in protecting photos online and the public link risk and in our guide to password protected galleries. The short version: a link alone is not a lock.

Build access by role

The cleanest way to think about permissions is the principle of least privilege: each person gets the minimum access that lets them do their job or enjoy their photos. One comparison of client gallery tools gives a useful example. A bride can receive all files at full resolution, while guest accounts are limited to a small number of low-resolution, watermarked files.

Here is a starting framework you can adapt.

Role	View	Download	Quality	Suggested duration
Primary client	Full gallery	Yes	Full resolution	Through delivery, then archive
Partner or family member	Full gallery	Optional	Web size or full	Same as client
Guests	Selected set	Limited or none	Web size, watermarked	Short window
Vendors (planner, florist, makeup artist)	Their own album	Limited	Watermarked	Short window
Press or publication	Specific images	By request	Per license	Per agreement
General public	Nothing	No	None	n/a

You do not need every row on every job. A headshot client needs one row. A wedding might need five.

The primary client

This person paid you and expects the full set. Give them full viewing, favoriting and downloading. Protect the gallery with a password or a named invite, and make sure they know the access has an end date, so they save their files rather than assume the gallery is permanent storage.

Guests and family

Guests want to find themselves in a photo and save it. Offer a curated selection instead of the whole gallery. Web-size downloads are plenty for social posts and phone screens. Full-resolution files invite large prints and edits you did not approve.

Vendors

Vendors are a smart place to be generous and strict at once. A planner or makeup artist often wants a few strong images to promote their work. One practical approach from the same comparison is a hidden vendor album inside the main project: they see only the relevant, watermarked photos, not the entire client project or personal moments. Check with the client first. Someone who hired you for an intimate session may not want any image shared beyond them.

The public

Your public audience belongs on your portfolio, not in client galleries. Keep the two apart. Publish selected, approved work on your website, and keep delivery galleries unlisted and locked. If you want a clear model for this split, our overview of private photo sharing built for photographers shows how delivery and portfolio can live side by side.

The permission dials, one at a time

Passwords and invitations

A shared password is simple and works for most jobs. Its weakness is that it travels with the link: once forwarded, it works for anyone. Named invitations, where each person signs in with their own email, give you accountability and let you remove one person without disturbing the rest. For high-trust projects such as boudoir, family sessions with children, or corporate events, prefer the named option.

A few habits make passwords work:

Send the link and the password in separate messages.
Avoid obvious passwords like a client’s surname plus the year.
Use a different password per gallery, so one leak does not expose everything.

Download permissions

Downloads are the permission clients care about most and the one photographers worry about most. Decide by purpose:

Proofing stage: viewing and favoriting only, or small watermarked files. The goal is selection, not delivery.
Final delivery: full-resolution downloads for the client, ideally as a single archive.
Sharing stage: web-size files for guests and social media.

If clients regularly ask for more, offer additional rights as a paid license rather than loosening the default.

Watermarks

Watermarks work best on proofs and on vendor or guest sets. They signal ownership and discourage casual reposting. They do not stop determined copying, and they can irritate clients on final images, so remove them on the delivery set.

Expiry dates

An expiry date turns a permanent link into a defined window. If a client forwards the link months later, it simply no longer works. Pick a window you can explain in one sentence, such as “your gallery is available for 60 days, so please download your files in that time.” Put it in your delivery email and in your contract. Then archive the originals on your side.

Comments, favorites and print orders

These are interaction permissions. Favorites and comments help clients select photos for an album or retouching. Turn them on for proofing and off for guests. Comments you cannot moderate belong on a gallery only the client sees.

Downloading is not owning: copyright and usage rights

Clients often assume that access equals rights. Your permissions settings control access to files. Your contract controls what they may do with them.

Under U.S. law, copyright in a photograph generally belongs to the photographer. The Copyright Office explains that copyright law gives the owner exclusive rights to reproduce, distribute and display a work, or to authorize others to do so. Hiring a photographer does not change that by itself; a transfer needs to be in writing and signed. The Office also publishes a short page of what photographers should know about copyright, which is worth bookmarking.

In practice, most photographers keep copyright and grant the client a license. A good license answers three questions:

Can the client print the photos, and where?
Can they post them online, and with credit?
Can they use them commercially, or give them to vendors?

For a clear explanation written for couples, this piece on who owns wedding photos, copyright, licenses and print rights covers the same ground from the client’s side. It is useful to share when a client asks why they cannot do anything they like with the files.

When a vendor or guest receives watermarked images, your license should say whether they can post them. Many photographers allow it with a credit and a link back.

Be transparent about how images are used

Permissions are also a trust conversation. Data protection regulators, including the UK’s ICO in its advice on taking photographs, stress that people should be told clearly how their images will be used and protected, and should have a way to ask for images to be removed. That guidance is from the UK and is written for schools, so it is not a U.S. legal requirement. Still, it describes a standard clients appreciate.

Put three things in your client agreement:

Where the photos will be stored and who can access them.
Whether you will show any of them in your portfolio, on social media or in ads.
How a client can ask you to take a photo down.

Ask for a separate yes or no on portfolio use. A client can love their gallery and still prefer privacy.

Our perspective

We built PhotoView around a simple idea: photographers should update their work once and present it everywhere, without rebuilding. Permissions are the other half of that idea. The same finished photos that look polished on a public portfolio should be just as controllable when they are a private delivery.

Our perspective — overview diagram

What we see photographers get wrong is mixing the two jobs. A portfolio is meant to be found. A client gallery is meant to be opened by a specific person. When both live in the same loose system, one wrong link can expose a session the client expected to stay private.

So we recommend three habits. Keep portfolio and delivery separate in your head and in your workflow. Share privately by default and open up deliberately. And decide your rules once, then repeat them every shoot, so you are not improvising under deadline. For storage, we have written about what to prioritize in cloud storage for photographers and three private sharing workflows that speed up delivery.

— Mitch Russo

A repeatable setup for every shoot

Use this as a checklist you can paste into your own workflow.

Before the shoot: put usage rights, gallery duration and portfolio permission in the contract.
Create the gallery: unlisted, locked with a password or named invites.
Proofing: share a watermarked or view-only set with favoriting on and downloads off.
Final delivery: swap in the retouched set, enable full-resolution downloads for the primary client only.
Extras: make a smaller web-size set for guests, and a separate album per vendor.
Set an expiry date and mention it in the delivery email, with a reminder a couple of weeks before.
After expiry: archive the originals on your side, close the gallery, and publish only the images the client approved to your portfolio.

This takes minutes once the habit is set, and it answers most client questions before they are asked.

Where PhotoView fits

PhotoView gives you private sharing, custom domains and branding, and a portfolio, all managed from one dashboard, with every template included in every plan. Plans are tiered by storage: Starter is $3.99 per month or $39.99 per year, Growth is $5.99 per month or $59.99 per year, Studio is $7.99 per month or $79.99 per year, and Premier is $11.99 per month or $119.99 per year. Custom storage plans are available for high-volume work. You can compare them on the PhotoView plans page, or see how photo and video storage for a portfolio stays organized.

Common mistakes to avoid

One link for everyone. A single open URL for the client, guests and vendors gives all of them identical access. Split it.
Permanent galleries. Old galleries become forgotten risks. Set an end date.
Full-resolution for all. Not everyone needs print-size files.
No written rights. Clients fill silence with assumptions. Put it in the contract.
Using the client gallery as your portfolio. Curate approved work separately.
Ignoring sensitive sessions. Newborn, boudoir and family work warrant named invitations and shorter windows.

FAQ

Should every client gallery have a password?

For client work, yes, or an equivalent such as a named invitation. An unprotected link can be forwarded to anyone without you knowing. A password adds little effort and gives you a clear point of control.

Who should be allowed to download full-resolution files?

Usually only the person who hired you, and anyone they name in writing. Guests and vendors can have web-size or watermarked files. If someone needs more, offer it under a license that states how the images may be used.

Does giving a client download access transfer copyright?

No. In the U.S., the photographer holds copyright unless a signed written transfer says otherwise, according to the Copyright Office. Download access is a technical permission; usage rights belong in your contract. If you are unsure how to word a license, ask an attorney who works with creative professionals.

How long should a client gallery stay open?

There is no standard. Many photographers choose a window of a few weeks to a few months, then archive the originals themselves. Pick a period, state it in the contract and delivery email, and send a reminder before it closes.

Can I share client photos in my portfolio?

Only if your agreement allows it. Ask for portfolio permission separately, and honor requests to remove an image. Publish approved work on your public portfolio, not through the client gallery.