If they can be identified, consent is required (unless an exception applies). If they can't be identified, consent is not required, because it's not personal data. If someone intentionally photobombs the photo, you may be able to argue that they provided deemed consent.