Concepts
Why face search is replacing the public gallery link
A shared Drive folder shows everyone every photo. The future hands each person only the ones they're in.
TL;DR
The default way to share event photos — a public Drive/Dropbox link or an open gallery where everyone can browse everyone — is being replaced by face search: a guest uploads a selfie and receives only the photos they appear in. The shift is driven by three things at once — a better guest experience (no scrolling thousands of frames), a stronger privacy posture (you don't expose every attendee's photos to every other attendee), and monetisable, per-guest delivery. This piece explains the trend and how platforms are building for it.
For a decade, "here are the event photos" meant a link to a folder. It works, but it has two problems that have quietly grown into dealbreakers: it's a bad experience (find your 12 photos among 4,000), and it's a privacy exposure (every guest can see, download, and screenshot every other guest's candid moments). Event platforms are moving to a different model — and face search is the mechanism.
The old model and why it's breaking
| Public gallery link | Face-search delivery | |
|---|---|---|
| Finding your photos | Scroll thousands manually | Upload a selfie, get yours |
| Privacy | Everyone sees everyone | You see only photos you're in |
| Delivery | One link for all | A personal gallery per guest |
| Engagement | Passive folder | Instant, personal, shareable |
| Consent | Implicit at best | Guest opts in with a selfie |
The privacy row is the one changing fastest. A public folder of candid event photos is exactly the kind of dataset people are increasingly uncomfortable with — searchable, downloadable, and out of the subject's control. Handing each person only their own photos, retrieved by their own selfie, flips the default from "everyone exposed" to "opt in to see yourself."
Why now
- Guest expectations — people expect Instant. Scrolling a 4,000-photo folder feels broken next to "selfie → your gallery in seconds."
- Privacy pressure — norms and regulation have shifted; a public link that exposes everyone's photos is a liability event organisers now think about.
- Face recognition got cheap and good — a per-photo API at fractions of a cent makes per-guest delivery economical even for a free event.
- Monetisation — a personal gallery is a place to upsell prints, albums, and downloads; a public folder is not.
The shift isn't "add face search to the gallery." It's inverting the default: instead of publishing everyone's photos and hoping people find theirs, you publish nothing publicly and let each person retrieve only what they're in.
What privacy-first actually requires
"Privacy-first" is easy to say and easy to get wrong. Doing it properly means the architecture — not a checkbox — enforces it:
- Opt-in retrieval — a guest chooses to upload a selfie; you don't push-identify people who never asked.
- Per-event isolation — one event's faces are never searchable from another event.
- No public index — photos aren't exposed at a guessable URL; they're returned only to a matching selfie.
- Short retention + deletion — faces and photos are deleted on a schedule or on request, and the organiser discloses face-tagging up front.
- Consent for indexing, too — indexing attendees' faces from the photos is itself biometric processing that needs a lawful basis, not just the guest's later selfie.
Note: Face search for photo sharing is a consent-first, user-initiated feature — and it should stay that way. It is not a tool for identifying strangers or building a searchable index of people who never opted in. The privacy win only holds if retrieval is opt-in and indexing is disclosed.
What this means if you're building a platform
If you run or are building an event-photo product, the face-search model is quickly becoming table stakes rather than a differentiator. The build is well-understood: index each event's photos into an isolated collection, let guests retrieve by selfie, deliver a personal gallery, and delete on a retention schedule. We walk through the full architecture in how to build a face-recognition photo-sharing platform, and the per-guest economics in the cost breakdown.
See the build behind privacy-first photo delivery.
Read the build guideFrequently asked questions
Why are event platforms moving away from public photo-gallery links?
Public links have two growing problems: a poor guest experience (scrolling thousands of photos to find yourself) and a privacy exposure (every guest can see and download every other guest's photos). Face-search delivery fixes both — a guest uploads a selfie and receives only the photos they appear in, so nothing is exposed publicly and each person gets a personal gallery. Cheap, accurate face recognition APIs have made this economical even for free events.
Is face-search photo sharing more private than a shared folder?
It can be, if built correctly. Instead of publishing everyone's photos at an accessible link, nothing is public and each person retrieves only the photos they're in by uploading their own selfie. That requires opt-in retrieval, per-event isolation, no guessable public index, short retention with deletion, and disclosure that photos are face-tagged. Done that way it flips the default from 'everyone exposed' to 'opt in to see yourself.'
Does using face recognition for photos raise consent issues?
Yes, and they're manageable. Two consent moments matter: indexing attendees' faces from the event photos is biometric processing that needs a lawful basis and up-front disclosure, and a guest uploading a selfie consents to the search itself. Keep retrieval opt-in, disclose face-tagging, offer removal, and delete data on a retention schedule. It should never be used to identify people who didn't opt in.