Not overly hard; model laws are readily available. They may not cover all circumstances (such as revocation of consent in commercial contexts), but they do cover your typical case where consent was given to the taking of the photo, but not to further dissemination: