# How to legally collect UGC from Instagram and TikTok

A repost is not permission. To put a customer's photo or video on your store or in an ad you need a documented licence, with a recorded reply that grants it.

By Rohin Aggarwal · 2026-05-13

The brand's previous UGC vendor told them rights were automatic the moment a customer tagged them. They were not. The cease-and-desist that landed eight months later cited a precedent the vendor had never heard of. The workflow below is the one our counsel signs off on, consent moment captured and dated.

**Quick answer**

- Posting a customer’s content without permission is copyright infringement, the customer owns the photo, not you.
- A like, a tag or a public post is not a licence. You need explicit, documented permission.
- The workable pattern is a rights-request message with clear terms, and a recorded reply that grants them.
- Doing this at scale by hand does not work, it needs a tracked workflow.

The most common UGC mistake is also the most expensive: a brand finds a great customer post, reposts it to their own grid or drops it on the product page, and assumes that because the customer tagged them, it is fair game. It is not. The customer holds the copyright to their own photo or video. Using it without permission is infringement, and "but they tagged us" is not a defence.

## Why a repost is not permission

Copyright sits with the creator the moment they press the shutter. A public post grants the platform certain rights, not you. Tagging your brand is an invitation to notice, not a transfer of usage rights. To put a customer’s content on your store, in an email, or in a paid ad, you need a licence: explicit permission, with terms, that you can produce later if asked.

| Signal | Licence? | Why |
| --- | --- | --- |
| Customer tags your brand | No | An invitation to notice, not a transfer of usage rights |
| A public post on Instagram or TikTok | No | Grants the platform certain rights, not you |
| A like, silence or a thumbs-up emoji | No | Not an unambiguous, recorded yes |
| A recorded, scoped reply from the creator | Yes | Explicit permission with terms you can produce later |

_Signals merchants mistake for permission, next to the one that actually is a licence._

> **The real risk:** Unlicensed UGC is a live liability. Stock-image agencies and individual creators do pursue infringement, and the cost of a settlement dwarfs the cost of having asked. Treat every external [photo and video](/blog/photo-video-reviews-vs-text-reviews) as "not cleared until proven cleared".

## The rights-request workflow

1. Find the content, monitor tags, mentions and brand hashtags for posts worth using.
2. Send a rights request: a direct message that names what you want to use it for (store, ads, email), and asks the creator to reply with a clear yes.
3. Capture the grant: record the creator’s affirmative reply, the date, and the scope they agreed to. That record is your licence.
4. Store it against the asset, keep the permission attached to the specific piece of content, so you can prove clearance for that exact photo or video.
5. Respect the scope, if they agreed to "your website", do not silently move it into paid ads.

## What counts as valid permission

- It is explicit, an unambiguous yes, not silence or a thumbs-up emoji you are choosing to interpret generously.
- It is scoped, it names where and how you may use the content.
- It is recorded, you can produce it later, tied to the asset.
- It is from the right person, the creator of the content, not someone who merely appears in it or shared it on.

## Instagram and TikTok specifics

On Instagram, the practical channel is a DM rights request against tagged posts, Stories and Reels. On TikTok, the same principle holds for videos, and you should be doubly careful with sound — a clip can be visually cleared and still carry a music licence you do not have (covered in the full rights guide). On both platforms, screenshots and re-uploads strip context and quality; always work from the original where you can. Once you have rights-cleared TikTok content, see [how to embed a TikTok feed on your site](/blog/embed-tiktok-feed-on-website) for the display options.

**The rule:** Find it, ask for it in writing, record the yes, use it only as agreed. Permission is not a vibe, it is a document you can produce.

> **How Idukki helps:** Idukki’s [Rights Management](/blog/rights-workflow-2026-merchants-wish-they-built) sends rights-request messages, captures the creator’s reply, and stores the permission against the exact asset, so every [piece of UGC](/blog/repurposing-ugc-across-every-channel) you publish has a clearance record behind it. See the Rights Management product page.

### Sources & notes
- [U.S. Copyright Office, copyright basics](https://www.copyright.gov/what-is-copyright/) — Copyright vests in the creator of a work.
- Instagram & TikTok platform terms — Platform terms grant the platform a licence, not third-party brands. Always seek direct permission.

- **30 days** — GDPR right-to-erasure SLA (End-to-end inc. CDN purges)
- **45 days** — CCPA deletion SLA (CPRA)
- **64%** — of brands fail withdrawal SLA on audit (Idukki research Q1 2026)
- **38%** — Median rights yes-rate (Idukki dataset)

_Compliance benchmarks across UGC programmes._

---
Canonical: https://idukki.io/blog/how-to-collect-ugc-legally-instagram-tiktok
Tags: ugc, rights-management, instagram, tiktok