The complete UGC rights and permissions guide
The customer who shot a photo owns its copyright, not you and not the platform. What a usage licence must cover, plus the music, disclosure and deleted-post traps.
The phrase 'usage rights' bundles a dozen separate operational commitments, and most brand teams have already agreed to all of them in vendor contracts they have never re-read. The guide below walks through who actually owns a customer photo, what a licence has to cover, and the edge cases (music, bystanders, deleted posts) that quietly turn a content win into legal exposure.
In this article
Keep this open while you build a UGC programme. It is practical guidance, not legal advice. For anything high-stakes, run it past a lawyer in your market. What it does cover is the set of questions that come up again and again once real customer content starts flowing. If your programme starts from a campaign, pair this with how to run a UGC competition, where the rights step is built into the entry mechanic.
Who owns a customer photo?
Copyright vests in the creator the moment the shutter fires. The customer who took the photo owns it. Your brand appearing in it, or being tagged in it, changes nothing. The platform’s terms grant the platform a licence, not you. To use the content yourself, you need permission from the creator. Full stop.
What should a usage licence cover?
- Scope of use: organic social, your website, email, paid advertising. Paid ads are the scope creators most often have not agreed to.
- Channels and surfaces, be specific; "marketing" is too vague to rely on.
- Duration, perpetual, or a fixed term. If unstated, do not assume perpetual.
- Edits: may you crop, trim, add captions or overlay product tags?
- Attribution, whether and how you credit the creator.
- A record: the request, the affirmative reply, the date, tied to the specific asset.
| Licence term | What it covers | Default if left unstated |
|---|---|---|
| Scope of use | Organic social, website, email, paid ads. | Assume organic + website only; paid ads is NOT granted. |
| Channels / surfaces | The specific places the content can appear. | "Marketing" is too vague to rely on; treat as unspecified. |
| Duration | Perpetual or a fixed term. | Do not assume perpetual; treat as short-term. |
| Edit rights | Crop, trim, caption, overlay product tags. | Assume no edits beyond what was shown when consent was given. |
| Attribution | Whether and how the creator is credited. | Credit the creator unless they ask otherwise. |
Disclosure: FTC, ASA and incentivised content
Genuine, unsolicited customer content carries no disclosure obligation. The moment content is incentivised (gifted product, a discount, a competition entry, any paid relationship) disclosure rules apply. In the US that is the FTC; in the UK, the ASA and CMA. The duty is shared: the creator should disclose, and the brand should not publish incentivised content dressed up as spontaneous.
Music and third-party content
A customer video can be perfectly cleared for the visuals and still carry a music track you have no licence for. The licence the customer (or the platform) holds for posting on TikTok or Instagram does not extend to your website or your ads. When in doubt, use content where the audio is the creator’s own, or replace the audio with a track you have licensed.
Edge cases: bystanders and deleted posts
Two more catch brands out. An identifiable person who is not the creator (a friend in the shot) can hold their own rights, especially in stricter jurisdictions, so favour content where everyone visible is the creator or has consented. The other trap: if a creator deletes the original post, your licence to the copy you cleared still stands, but only if you kept your own copy of the asset and the permission record. Relying on a live link to the original is fragile.
Sources & notes
- 1U.S. Copyright Office · Copyright ownership basics.
- 2FTC, Endorsement Guides · US disclosure rules for incentivised content.
- 3UK ASA / CMA, influencer and endorsement guidance · UK disclosure rules.
- 4Note · This article is practical guidance, not legal advice. Confirm specifics with a qualified lawyer in your market.
0 days
GDPR right-to-erasure SLA
End-to-end inc. CDN purges
0 days
CCPA deletion SLA
CPRA
0%
of brands fail withdrawal SLA on audit
Idukki research Q1 2026
0%
Median rights yes-rate
Idukki dataset
Continue reading
8 pieces in this clusterThese long-form pieces on the Idukki blog link back to this article, go deeper on the cluster.
- Strategy
How to Repost Customer Content on Instagram (Legally)
Reposting a customer's photo without permission is copyright infringement, tag or no tag. The clean permission flow, what counts as consent, and how to do it at scale.
- AI search
AEO for Reviews: Getting Your Ratings Quoted by AI Agents
AI agents quote a star rating when it is backed by verified, machine-readable review evidence. Mark up real reviews with Review and AggregateRating schema.
- Strategy
Brand vs Employee vs Customer Content: what the conversion data says (and when each wins)
Brand-owned, employee and customer content are not substitutes: each wins a different PDP surface. Ten years of public benchmarks show where, and how to stage all three.
- Strategy
Syndicating UGC to Google Shopping & Meta Catalog Ads
Your product feed already carries titles and prices. Add ratings and customer photos and the same Shopping and catalog ads earn more clicks at the same spend.
- Strategy
How to get more UGC for your store without paying for it
Most stores have a UGC supply problem, not a quality one. Ask at the post-delivery peak, make it one tap, and visibly feature what comes in. No creator budget needed.
- Strategy
How to run a UGC hashtag campaign that actually produces usable content
Run a hashtag campaign on usable, cleared content (not raw post count): set a specific brief, make entering one step, and bake a rights grant into entry.
- AI search
The State of UGC & AI Commerce 2026
Our annual report on how AI engines reshaped product discovery, why UGC became the evidence layer agents quote, and the seven plays separating leaders from laggards.
- Strategy
How to make Instagram Reels and TikToks shoppable on a Shopify store
Bring customer Reels and TikToks onto Shopify as shoppable galleries in five steps: collect, clear the rights, tag products to SKUs, publish, and keep it fast.
More from Rohin Aggarwal
- Strategy
PDP before and after UGC: what actually changes on the page
Add verified customer photos, video and reviews to the middle scroll of a brand-only PDP and conversion lifts. Here is what moves, scroll by scroll.
- Strategy
A kitchen table in Egham, why I built Idukki
Day job: SAP architect on UK government software. Night job: founder of a UGC platform. The Venn diagram of those two communities is roughly one person.
- Strategy
The Death of Impression-Based Pricing: A Finance Director's Case
Impression-based pricing made sense while impressions tracked funnel impact. They stopped. A finance director's argument for outcome-based commercial models in the agentic era.