GDPR, consent and UGC
UGC shows identifiable people, so it is personal data under GDPR. A defensible programme records scoped permission, honours removal requests, and minimises what it holds.
The cookie banner is not a consent record. The DM that says 'yes you can use it' is not a consent record. The Instagram tag is not a consent record. None of the three would survive a regulator walking through your data on a site visit, and closing that gap is what the workflow below is for.
In this article
UGC rights conversations usually stop at copyright: who owns the photo. But a customer photo or video also contains something else, an identifiable person, and under GDPR and comparable regimes that brings data-protection obligations alongside the copyright ones.
Is UGC personal data?
An image of an identifiable individual is personal data. Publishing and storing it is processing that data. None of this makes UGC unusable, businesses process personal data lawfully every day, but it does mean a UGC programme has to be built with data protection in mind, not only copyright.
Why do you need two permissions, not one?
Copyright permission says you may use the content. Data-protection law adds that the person should understand and agree to how their personal data is used, and keeps rights over it afterwards. A good rights request does both at once: it spells out what the content will be used for, which is exactly what informed agreement needs. Our UGC rights and permissions guide covers how to word a request that satisfies both at the point of collection.
What does GDPR mean for UGC in practice?
- Be clear at the point of permission about how and where the content will be used.
- Keep a record of the permission, tied to the asset and the person.
- Honour removal requests, if a person asks for their content to be taken down, have a process to do it.
- Minimise: do not hold UGC, or the data around it, longer or wider than you need.
| Question | Copyright permission | Data-protection consent |
|---|---|---|
| What it covers | The right to use the work | How a person’s data is processed |
| Who holds the right | The content creator | The identifiable individual shown |
| Can it be withdrawn? | Per the licence terms | Yes, including erasure in many cases |
| What you must keep | The licence record | Scoped consent + removal process |
The harder edge case is when a creator deletes the original post after you have featured it. That is where holding your own copy and record matters: we cover it in what happens to your gallery when a creator deletes the original.
Sources & notes
- 1European Commission, GDPR overview · Personal data and processing obligations.
- 2UK ICO, guidance on images and personal data · When images count as personal data.
- 3Note · Practical guidance, not legal advice, confirm with a data-protection specialist in your market.
30 days
GDPR right-to-erasure SLA
End-to-end inc. CDN purges
45 days
CCPA deletion SLA
CPRA
Continue reading
4 pieces in this clusterThese long-form pieces on the Idukki blog link back to this article, go deeper on the cluster.
- Strategy
First-party data strategies post-cookie for ecommerce personalization
Chrome kept third-party cookies, but Safari and Firefox block them by default and consent rules still apply. Where each browser stands in 2026, which first-party signals to collect, and how durable each one really is.
- Strategy
Personalization without creepiness: the data-use line shoppers notice
The line between helpful personalization and surveillance isn't how much data you hold. It's whether the shopper can guess how you knew. A signal ladder, a pre-launch test and label templates you can ship.
- Strategy
When a creator deletes the original post, what happens to your gallery
If your gallery embeds the live original, a deletion leaves a broken hole. If you hold your own copy and rights record, the licence and the tile both survive.
- Strategy
The rights workflow merchants will wish they built in 2024 (and what to do now)
A defensible UGC rights workflow automates detection, outreach and the audit trail, and needs six clauses to hold up. Build it before agents surface your UGC.
More from Rohin Aggarwal
- Strategy
TikTok Shop affiliate content as a UGC source
The TikTok Shop affiliate programme produces a steady stream of creator content by design. Treating it as a UGC pipeline, not just a sales channel, is the underused move.
- Strategy
Building a TikTok-to-Shopify UGC pipeline without manual downloads
A person manually saving and re-uploading TikTok videos is a pipeline that breaks the moment that person is unavailable. The API-based alternative, and what it actually automates.
- Strategy
TikTok Shop vs. website checkout: where the sale should actually happen
TikTok Shop checkout removes friction; your own checkout keeps the margin and the customer relationship. The decision isn't which is better, it's which product belongs where.