Photo and model releases, signed on a phone

Have the person photographed sign the release before you use their image, or, for a minor, a parent or guardian, and with Attest they can sign it on their own phone at the shoot, with no account, app or fee. Each signature is made with a passkey only the signer controls and sealed into a copy you both keep, which shows which release each signer approved with their own passkey, and when, and verifies for free, even without Attest.

By DataHubz · Updated October 12, 2026 · 5 min read

What a release should cover

A release is the person's written permission to use their image. Whether you are a photographer, a studio, or a business photographing customers or staff for its own marketing, a clear release states:

  • who is photographed, and who may use the images;
  • which images: the shoot, the date or the project;
  • how they may be used, such as advertising, the business's website, social media, editorial use or stock licensing;
  • for how long and where;
  • any payment or other consideration;
  • for a minor, the parent or guardian who gives permission, with the minor named in the release.

Keep the release to what the permission needs. Save it as a PDF of up to 8 MB.

Some laws require written consent before a person's image is used commercially. New York's Civil Rights Law, for example, makes it a misdemeanor to use "the name, portrait, picture, likeness, or voice of any living person" for advertising or trade "without having first obtained the written consent of such person, or if a minor of such minor's parent or guardian" (section 50), and lets the person sue to stop the use and for damages (section 51). Rules differ from place to place, so check the law where you photograph and where you publish.

An electronic release can meet a written-consent rule. In the states that have enacted UETA, "If a law requires a record to be in writing, an electronic record satisfies the law" (section 7(c)). New York has its own law: "An electronic record shall have the same force and effect as those records not produced by electronic means" (State Technology Law 305(3)), and an electronic signature has "the same validity and effect as the use of a signature affixed by hand" (section 304(2)).

Minors: the parent or guardian signs

When the person photographed is a minor, the parent or guardian is the signer, with their own email address and passkey. Attest confirms control of the email address and the passkey, not the signer's identity, age or guardianship, so send to an address you know belongs to the parent or guardian and keep your own record of who they are. Name the child in the release itself. If you want both parents to sign, add both: one document can have up to 20 signers, and it completes only when every one of them has signed.

At the shoot: signed on the model's own phone

Prepare the release before the shoot, then send it when the model, or the parent, is with you:

  1. In Attest, open Documents in the menu (it reads Agreements on accounts that use every Attest tool), click New agreement, give it a Title such as "Release, shoot 14" and click Attach the document to be signed.
  2. Under Signers, type the model's email address, or the parent's, and check Add me as a signer (sign in-app, no email) if you sign as the photographer.
  3. Under Verification, choose Private.
  4. Click Next: place the fields, place a signature field and a date signed field for each signer, plus a Text field if you want them to write something, such as the name they want credited, and click Create and send.
  5. The model opens the email whose subject starts with "Signature requested" on their phone, taps Review and sign and sets up a passkey, which with most passkey providers takes one prompt.
  6. Attest emails you; tap Unlock it for … (or open the agreement in Attest), confirm, and approve with your passkey. Your browser releases the document, never Attest.
  7. The model taps Open and start signing, adopts a signature, and taps Sign with your passkey. Then you click Sign on the document's row, under Action needed (you get no signing email yourself).

A passkey is a cryptographic key only the signer controls, unlocked with Face ID, Touch ID, Windows Hello or the device PIN. The model installs nothing, creates no account and pays nothing. When everyone has signed, you both open the signed copy and click Download signed copy, and the model can open it again later: from their link for 30 days after completion, and after that by signing in with their email address.

One release per person

For a group shoot or an event, send each person their own release. Each document is end-to-end encrypted to its own parties, so each model sees only their own release, and each release is its own signed record, with its own fingerprint and anchor. If you shoot often, the Signing plan covers 20 documents a month.

What the signed release proves

  • Which uses were allowed. The passkey signs a statement that names the release's fingerprint (a SHA-256 hash, a short code calculated from the file's contents) and everything the signer entered. A release that allowed only social media and one that allowed advertising have different fingerprints.
  • Permission before publication. The signing time is part of what the passkey signs, and the completed release is anchored on Horizen, a public blockchain, so you can show the permission was in place before the images ran.
  • That it hasn't changed. Change one byte of the release, of any signer's entries or of the signed pages, and verification fails.

The sealed PDF carries a "Signed with Attest" stamp on each signature, with the evidence, the original document and a verifier attached inside. When a client, a publisher or an agency asks for the release, send the PDF: anyone can check it for free at attest.datahubz.com/verify, with no account, and the open-source verifier inside it runs in any browser, even if Attest is gone.

Keep releases private

A release names a person, sometimes a child. Attest encrypts it in your browser before upload, and only you and the signer can open it, in your own browsers; Attest stores it only as ciphertext it can't read. Attest does see the information around it, such as its title, file name and the signers' emails and names, so use titles like "Release, shoot 14" rather than the person's name. Choose Private under Verification: a public certificate would show anyone with its link the title and each signer's name and signing time, among other details.

What it costs

Your first 2 documents are free, in total. After that, the Signing plan is $5 a month for 20 documents sent for signature, and you can cancel any time. The models and parents who sign never pay, on any plan.

Questions people ask

Is a model release signed electronically valid?
Electronic signatures are recognized for most agreements in the United States (the ESIGN Act and UETA) and the European Union (eIDAS). Some documents, such as wills or certain notarized deeds, have special rules in many places: check yours. Where a law requires a writing, UETA section 7(c) says an electronic record satisfies it, and New York's own law gives electronic records and signatures the same effect as paper and handwritten ones. This is general information, not legal advice.
Who signs a release for a minor?
The parent or guardian, with their own email address and passkey; name the child in the release. Attest confirms control of the email address and the passkey, not the signer's identity, age or guardianship, so send to an address you know belongs to the parent or guardian. New York's Civil Rights Law, for example, requires the written consent of a minor's parent or guardian before the minor's picture is used for advertising or trade.
Does the model need an account or an app?
No. The model opens their emailed link in the phone's browser and sets up a passkey, with no account to create, no password and nothing to pay. The first time they sign with Attest, you release the encrypted document to them with your passkey.
Can the model get a copy later?
Yes. Every signer can view and download the same signed copy: from their link for 30 days after completion, and after that by signing in with their email address.
What if the person decides not to sign?
They can tap Decline to sign, which closes the release for every party and emails you. Nothing is signed, and the release's Activity in your dashboard shows "Declined by" with the time.

Sources

  1. New York Civil Rights Law section 50, right of privacy, New York State Senate, read October 12, 2026
  2. New York Civil Rights Law section 51, action for injunction and for damages, New York State Senate, read October 12, 2026
  3. New York State Technology Law section 304, New York State Senate, read October 11, 2026
  4. New York State Technology Law section 305, New York State Senate, read October 12, 2026
  5. Uniform Electronic Transactions Act (1999), final text with comments, Uniform Law Commission, read October 11, 2026
  6. 15 U.S.C. Chapter 96, Electronic Signatures in Global and National Commerce (United States Code, 2023 edition), U.S. Government Publishing Office, read October 11, 2026
  7. Regulation (EU) No 910/2014 (eIDAS), consolidated text, EUR-Lex, Publications Office of the European Union, read October 11, 2026

Read next