Two questions nobody asks
Every other part of an audit asks whether material serves the brand. This part asks two different things. Does it expose somebody, and does that exposure eventually land back on you. And what has been done in your name by people who do not work for you. Consent is where most firms stop. It is where this starts.
Who appears in your material
An inventory of every identifiable person across photography, video, testimonials, case studies, social posts, printed collateral, and anything a supplier produced on your behalf. Customers, staff, children, guests, homeowners. Consent given for one context does not cover another. A customer who approved a photograph for a thank-you card did not approve a public campaign, an advertising placement, or indefinite availability to anyone with a browser. The question is not whether permission exists. It is whether permission was given for the use now proposed, by somebody who understood what that use meant.
What material discloses beyond its subject
A venue. A date. A home interior. A routine. A family composition. A period when a building stands empty. Individually harmless. In aggregate, a profile the subject never agreed to publish. The family name decals once common on car rear windows are the reference case. Voluntarily displayed, cheerfully given, and used for exactly the targeting nobody displaying them had considered. Some categories carry more weight than others. Weddings, funerals, medical and financial. Children, home interiors, security installations, and anything identifying where somebody sleeps or when a property is unoccupied. A business serving these carries a duty proportionate to what its work reveals.
Framed as your risk, not as a lecture
Exposure findings are stated as brand risk rather than moral objection, and the framing is accurate rather than diplomatic.
"A business appearing in a story about a customer coming to harm carries that association regardless of fault, and no consent form removes it."
That is also the framing a client can act on. A moral argument gets overruled by whoever wanted to use the photograph. A risk argument does not.
Never stopping at refusal
A finding that only removes capability is a poor deliverable. The work still needs showing. Derived imagery generated from an original can demonstrate craft, materials, scale and finish while carrying no identifiable person, venue or date. The talent is exposed. The subject is not. Where an exposure is found, an alternative is required rather than optional.
Your own people count too
Staff photographs, names paired with locations, biographies detailing routines. Employees frequently have less real ability to decline than customers do, which raises the duty rather than lowering it.
What was done in your name
A supplier acting for a brand creates consequences that land on the brand. An agency, an SEO or PR firm, a reseller or a franchisee. A contractor, a freelancer, or anybody with publishing access to a platform in your name. We examine what they produced, not what they reported. A monthly report describes activity. The audit looks at what actually exists in public, and these frequently differ. What gets looked for: links built in patterns that read as manufactured, reviews solicited conditionally or negative ones suppressed, undisclosed AI content on your properties, directory and profile spam created at volume, testimonials with undisclosed material connections, claims made in your name you cannot substantiate, and content published on domains you do not control. Reported without accusing. We describe what exists and what risk it creates.
Who can publish as you, right now
Frequently the most immediately actionable finding in an entire audit. Who currently holds credentials to publish in your name, and whether any of them no longer should. Former agencies retaining admin access. Contractors whose engagements ended. Accounts nobody has audited since they were created. This one gets raised immediately rather than saved for a deliverable, because waiting three weeks to mention live access that should not exist would be indefensible.
The finding that sometimes costs you something
You will have material you are proud of and permission to use it. We say it anyway, and say why, and bring the alternative. A firm that only tells clients what they want to hear is the flattery failure mode with better manners.
Where duty of care connects
What suppliers published that is factually wrong is covered in claim verification and digital footprint. Generating derived imagery is covered in AI-assisted design under interactive experience design.
How the engagement runs
Screen shared sessions, with the access review usually running first because it is the fastest thing to fix. If a former agency can still publish as your business, that is worth knowing this week rather than next quarter.