Rui runs a small roofing company in Porto with his brother and two employees. His website opens with a photo of a smiling man in a spotless hard hat, giving a thumbs-up against a blue sky. Rui bought it for a few euros. He has never met the man.
Last spring a customer mentioned, kindly, that she had seen the same thumbs-up on a roofer's site in Lisbon, and on a solar-panel company's flyer. She hired Rui anyway, because her neighbor recommended him. But she admitted the photo had made her hesitate. If the face on the homepage was borrowed, what else was?
Rui's real crew is better-looking than he thinks: weathered, competent, standing next to a van with the company name on it. That photo would have told the customer three true things in a second. The stock photo told her nothing, except that someone had bought a stock photo.
Rui and his company are imagined. The studies, rules and court decisions below are real.
People skip decoration
Jakob Nielsen's “Photos as Web Content” (Nielsen Norman Group, 2010) summarized years of eye-tracking with a blunt distinction. Users pay close attention to photos that carry information, such as real products and real people. They ignore what Nielsen called big feel-good images that are purely decorative, and they ignore stock photos of generic people.
His most quoted example was a team page at the accounting software company FreshBooks. Users spent 10% more time looking at the staff portraits than reading the biographies, even though the bios took up 316% more space. On a business school page, by contrast, a generic photo of students was treated as filler: people were there to understand the application process, not to look at models.
Two caveats. This is a summary of usability studies, not a controlled experiment on conversions, and it is from 2010. But the mechanism has not aged: people scan for information, and a photo is information only if it shows something specific to you. Nielsen's own advice was that photos of real people and real products earn attention, while decoration is skipped. That matches what we see in the related banner blindness research too.
Do this: for each photo on your homepage, write one sentence about what it tells a visitor. If the sentence is “it looks nice”, the photo is decoration.
One famous photo test
The most cited case for real people on landing pages comes from 37signals, the company behind Basecamp. In 2011 its team tested marketing pages for its contact manager, Highrise, and published the results on its Signal v. Noise blog.
A short page built around a big photo of a smiling customer and a brief testimonial produced 47% more paid signups than their long-form page. Versions that added more information below the photo did worse. And among the customers they tried, which particular person was pictured did not seem to matter much. The author's summary: big photos of smiling customers worked for them.
Read it for what it is: one test, for one software product, in 2011, reported by the company itself without significance figures, measuring signups rather than long-term customers. The post itself warns that what worked for them may not work for you. We look at it, and the original comparison graphic, more closely in Six weird landing pages that worked.
What the test does support is a specific idea: a real customer's face and words can do a lot of the persuading that paragraphs of features try to do. That is a claim about real people. It says nothing good about stock models.
Faces, gaze and warmth
Why would a face help? Dianne Cyr and colleagues tested exactly this in a study published in MIS Quarterly (2009), using questionnaires, interviews and eye-tracking with participants in Canada, Germany and Japan. They compared a website with human images showing faces, human images without facial features, and no human images.
Images with faces made the site feel more appealing and gave it more warmth, which the researchers call social presence. Appeal and social presence, in turn, predicted trust. But there was no direct link between the face condition and trust. Faces helped indirectly, by making the site feel more human, not by acting as a trust button.
Where a face looks matters too. Pawarat Sajjacholapunt and Linden Ball's 2014 eye-tracking study showed 72 university students web pages with banner ads that had no face, a face looking at the viewer, or a face looking away toward the ad's content. Averted gaze drew more attention to the ad's text and product and improved memory for them. A face staring straight out pulled attention to itself.
The limits are worth stating. Cyr's study looked at perceptions, not purchases. Sajjacholapunt and Ball used fictitious brands and banners, and the authors note the results may not generalize to real ads on live sites. Neither shows that a face increases sales. Together they suggest something modest and useful: real faces make a page feel more human, and a gaze directed at your message can guide attention toward it.
Do this: if your hero photo shows a person, try a shot where they look toward the headline or the product rather than into the camera.
What to photograph instead
You do not need a professional shoot to beat stock. You need photos that are specific, recognizable and honest. A modern phone, daylight and a few minutes of tidying will do.
Small imperfections help more than they hurt: a bit of clutter, real weather, a logo on a van. They are the details a stock library removes, and they are what makes a photo checkable. Showing your actual work is a big enough topic for its own chapter: see Showing your work.
If you must use stock, choose images of objects or textures rather than people pretending to be your staff or customers, and never use a stock person beside a testimonial.
Where your photos come from
Before any photo goes on your site, ask where it came from. The answer decides what you must check, and it fits on one page.
Found online is not free
The baseline is old and simple. Under the Berne Convention, photographic works are protected (Article 2(1)), and protection is not subject to any formality (Article 5(2)). No copyright notice, no registration, no watermark is required. A photo with no visible owner still has one.
A pupil at a German school downloaded a photographer's picture from a travel portal, where it was freely accessible, and used it in a presentation that the school then published on its website. The photographer had licensed only the portal. The EU Court of Justice held that posting on one website a photograph previously posted, with the rightholder's consent, on another website is a new “communication to the public” under Article 3(1) of the InfoSoc Directive 2001/29/EC. Consent to the first site covered only that site's audience.
Source: Judgment in C-161/17, EUR-Lex. Applies across the EU. General information, not legal advice; check your own jurisdiction.
If a school project can infringe, so can a business homepage. The case concerned copying the file and posting it again; linking to the original is treated differently in EU law, which is a separate topic and no help if you want the image on your own page.
Stock libraries are clear about the same principle. Getty Images' licensing FAQ explains that when you download a file you are buying a licence, not the file, and that using a file without licensing it is infringement for which you can be held liable. Rights-managed licences are tied to a specific use; using the image in additional projects needs additional licences.
In practice, this is how small businesses get caught. A designer drops in a picture “from Google”. A freelancer reuses an image licensed for a previous client. A royalty-free licence expires or did not cover the use. Years later, a letter arrives with a demand for payment, and taking the image down does not undo the use that already happened.
Do this: make a simple photo register. For every image on your site: who took it, the licence or permission, where it is allowed, and until when. Keep the receipts.
Photos of real people
Real photos raise a different question. The moment a person is identifiable, their image is personal data under the GDPR, because Article 4(1) covers any information relating to an identified or identifiable person. You need a legal basis under Article 6 to publish it.
The usual bases for website photos are consent (Art. 6(1)(a)) or legitimate interests (Art. 6(1)(f)). Consent can be withdrawn at any time (Art. 7(3)); withdrawal does not make earlier use unlawful, but you must stop. Where you rely on legitimate interests, the person can object at any time on grounds relating to their particular situation (Art. 21(1)), and you then need compelling grounds to continue. Erasure can follow in either case (Art. 17(1)(b)–(c)).
Source: Regulation (EU) 2016/679, EUR-Lex. Not legal advice; national rules add detail.
Staff photos deserve special care. The European Data Protection Board's Guidelines 05/2020 on consent point out that employees can rarely refuse an employer freely, so consent at work is valid only in exceptional circumstances where saying no has no adverse consequences at all. The EDPB's own example: a film crew is shooting in an office, and employees who do not want to appear are moved to equivalent desks elsewhere, without penalty.
That example is a good template for a team photo day. Ask in advance, explain where the photos will appear, make “no thanks” genuinely easy, and remove people promptly when they leave or change their minds. Some countries add their own layer: in Germany, for instance, § 22 of the Kunsturhebergesetz says portraits may only be distributed or publicly displayed with the consent of the person depicted.
For customers, the same logic applies, with more reason to get it in writing. A short model release, a signed permission naming the photos and where they will be used, protects both of you. Pair it with their testimonial, and you have exactly the kind of proof the Highrise test suggests can work. More on using customer voices honestly in Social proof patterns.
AI-generated images
Generating a “photo” of your team, your workshop or a happy customer is now easy. It is also the fastest way to turn a trust signal into a liability.
Deployers who use AI to generate or manipulate image, audio or video content constituting a deep fake must disclose that it has been artificially generated or manipulated (Art. 50(4)). A deep fake is AI-generated or manipulated content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful (Art. 3(60)). For evidently artistic, creative, satirical or fictional work, the duty is lighter: disclose in a way that does not spoil the work. Separately, providers of generative AI tools must mark their output in a machine-readable way (Art. 50(2)).
Article 50 applies from 2 August 2026 under Article 113. Following the AI Omnibus amendments, in force since 27 July 2026, providers of generative systems already on the market before that date have until 2 December 2026 to meet the marking duty in Art. 50(2).
Sources: Regulation (EU) 2024/1689, OJ L of 12 July 2024, consolidated text; European Commission, AI Act overview. Not legal advice.
What does that mean for a small business? An AI image that could pass as a real photo of your actual team, premises or work is the kind of content the deep fake definition describes, so label it clearly. The better answer is not to use one for that job at all. An AI picture of “our crew” that is not your crew misleads visitors whether or not it carries a label.
In the United States, the Federal Trade Commission's rule on consumer reviews and testimonials (16 CFR Part 465, published 22 August 2024 and in force 60 days later) makes it unlawful for a business to create or disseminate a testimonial that materially misrepresents that the reviewer or testimonialist exists, or that they used the product. The rule's definition of a testimonial includes depictions of a person's likeness. When it announced the rule, the FTC named AI-generated fake reviews as an example, and the rule allows civil penalties against knowing violators. On a plain reading, a generated face beside an invented quote is a fake testimonial.
Do this: if any image on your site was generated or heavily altered by AI, decide whether it could be mistaken for a real photo of you or your customers. If yes, replace it or label it plainly next to the image.
Make photos fast
A real photo that takes four seconds to appear, or shoves the text down the page when it arrives, undoes some of its own good work. Three habits prevent nearly all of this.
Use modern formats. According to MDN's image format guide, lossy AVIF files are around 50% smaller than JPEGs of similar visual quality, and lossy WebP files are on average 25–35% smaller. Both have broad support in current browsers; MDN recommends a <picture> element with a JPEG or PNG fallback for older ones.
Serve the right size. With srcset and sizes, you list several widths of the same photo and the browser picks the smallest that fits the layout and screen, as MDN's responsive images guide explains. A phone should never download a 4,000-pixel original.
Reserve the space. Google's guide to Cumulative Layout Shift says to always include width and height attributes on images. Browsers use them to calculate the aspect ratio before the file arrives, so the text does not jump. Sites should aim for a CLS of 0.1 or less for at least 75% of visits.
<picture>
<source type="image/avif" srcset="crew-800.avif 800w, crew-1600.avif 1600w" sizes="(width <= 700px) 100vw, 700px">
<source type="image/webp" srcset="crew-800.webp 800w, crew-1600.webp 1600w" sizes="(width <= 700px) 100vw, 700px">
<img src="crew-1600.jpg" width="1600" height="1067" alt="Rui, Paulo and the crew beside their van on a job in Porto">
</picture>
Keep the first-screen photo out of lazy loading, since it is often the largest thing the visitor is waiting for, and add loading="lazy" to images further down. Write alt text that says what the photo shows, which is easy when it shows something real. For the speed metrics themselves, see Core Web Vitals in plain words.
Tick what is true for your current hero photo.
What to change tomorrow
Rui took a new hero photo on a Tuesday morning, on a roof in Matosinhos: his brother, the two employees, the van, a bit of sky. It took twenty minutes, and everyone agreed to it in writing.
Replace stock people first
Any photo of a person who does not work for you or buy from you goes first, especially next to a testimonial. Swap in your team, your place or your work.
Start a photo register
For each image: source, licence or permission, where it may be used, and until when. Delete anything you cannot account for.
Get permission properly
Written consent from customers; for staff, a genuine opt-out with no consequences. Remove people promptly when asked.
Be honest about AI
Do not present generated people as customers or staff. Label any AI image that could pass as a real photo of you.
Make it fast
AVIF or WebP,
srcset,widthandheighton every image, no lazy loading on the first screen.
What the research supports
Eye-tracking observations show that people look at informative photos of real people and products and skip generic decoration. Controlled studies suggest faces make sites feel warmer and more appealing, which is associated with trust, and that a gaze toward content can steer attention to it. The famous Highrise result is a single company-reported test. No study here shows that real photos guarantee more sales; the strongest reasons to use them are that they carry information, and that the legal risks sit almost entirely on the other side.
Sources
- Nielsen, J. (2010). Photos as Web Content. Nielsen Norman Group, 31 October 2010. Eye-tracking observations, FreshBooks and business-school examples.
- Jamie / 37signals (2011). Behind the scenes: A/B testing part 3: Finalé. Signal v. Noise, 23 August 2011. Original post, results and the author's caveats.
- Cyr, D., Head, M., Larios, H. & Pan, B. (2009). Exploring Human Images in Website Design: A Multi-Method Approach. MIS Quarterly, 33(3), 539–566. Abstract consulted, including the absence of a direct effect on trust.
- Sajjacholapunt, P. & Ball, L. J. (2014). The influence of banner advertisements on attention and memory: human faces with averted gaze can enhance advertising effectiveness. Frontiers in Psychology, 5, 166. Full text consulted for sample, design and limitations.
- WIPO. Berne Convention for the Protection of Literary and Artistic Works, Articles 2(1) and 5(2).
- CJEU, Case C-161/17, Land Nordrhein-Westfalen v Dirk Renckhoff, 7 August 2018. EUR-Lex.
- Getty Images. Licensing FAQ. Licence versus file, unlicensed use, rights-managed limits.
- Regulation (EU) 2016/679 (GDPR). EUR-Lex, Articles 4(1), 6(1), 7(3), 17(1) and 21(1).
- European Data Protection Board (2020). Guidelines 05/2020 on consent under Regulation 2016/679, paragraphs 21–23 and Example 5.
- Kunsturhebergesetz (KUG), § 22, gesetze-im-internet.de.
- Regulation (EU) 2024/1689 (AI Act). EUR-Lex, with consolidated text of 27 July 2026; article texts consulted via artificialintelligenceact.eu (Art. 3, 50, 111, 113). Status of the AI Omnibus from the European Commission.
- Federal Trade Commission. 16 CFR Part 465, Trade Regulation Rule on the Use of Consumer Reviews and Testimonials (89 FR 68077, 22 August 2024), §§ 465.1–465.2; and the FTC press release of 14 August 2024.
- MDN Web Docs. Image file type and format guide and Responsive images. web.dev. Optimize Cumulative Layout Shift.
Sources checked 18 October 2026. Legal sections are general information, not legal advice; rules on images, privacy and AI differ by country and change often. Rui and his company are fictional, and all figures and the demo are original illustrations.