The complete UGC rights and permissions guide
Who owns a customer photo? What does a usage licence need to cover? What about music, disclosure and deleted posts? The full, practical guide to using UGC without legal exposure.
This is the reference to keep open while you build a UGC programme. It is practical, not legal advice, for anything high-stakes, run it past a lawyer in your market, but it covers the questions that come up again and again.
Who owns a customer photo
Copyright vests in the creator at the moment of creation. The customer who took the photo owns it. Your brand appearing in it, or being tagged, changes nothing. The platform’s terms grant the platform a licence, not you. To use the content yourself, you need permission from the creator. Full stop.
What a usage licence should cover
- Scope of use: organic social, your website, email, paid advertising. Paid ads are the scope creators most often have not agreed to.
- Channels and surfaces, be specific; "marketing" is too vague to rely on.
- Duration, perpetual, or a fixed term. If unstated, do not assume perpetual.
- Edits: may you crop, trim, add captions or overlay product tags?
- Attribution, whether and how you credit the creator.
- A record: the request, the affirmative reply, the date, tied to the specific asset.
Disclosure: FTC, ASA and incentivised content
Genuine, unsolicited customer content carries no disclosure obligation. The moment content is incentivised (gifted product, a discount, a competition entry, any paid relationship) disclosure rules apply. In the US that is the FTC; in the UK, the ASA and CMA. The duty is shared: the creator should disclose, and the brand should not publish incentivised content dressed up as spontaneous.
Music and third-party content
A customer video can be perfectly cleared for the visuals and still carry a music track you have no licence for. The licence the customer (or the platform) holds for posting on TikTok or Instagram does not extend to your website or your ads. When in doubt, use content where the audio is the creator’s own, or replace the audio with a track you have licensed.
Edge cases: bystanders and deleted posts
Two more catch brands out. Identifiable people who are not the creator, a friend in the shot, can have their own rights, especially in stricter jurisdictions; favour content where everyone visible is the creator or has consented. And if a creator deletes the original post, your licence to the copy you cleared still stands, but only if you kept your own copy of the asset and the permission record. Relying on a live link to the original is fragile.
Sources & notes
- 1U.S. Copyright Office · Copyright ownership basics.
- 2FTC, Endorsement Guides · US disclosure rules for incentivised content.
- 3UK ASA / CMA, influencer and endorsement guidance · UK disclosure rules.
- 4Note · This article is practical guidance, not legal advice. Confirm specifics with a qualified lawyer in your market.
30 days
GDPR right-to-erasure SLA
End-to-end inc. CDN purges
45 days
CCPA deletion SLA
CPRA
64%
of brands fail withdrawal SLA on audit
Idukki research Q1 2026
38%
Median rights yes-rate
Idukki dataset
More from Rohin Aggarwal
- Conversational commerce
Why we built the Conversational PDP
Most product-page exits are a single unanswered question. Here is the case for answering it on the page, from your own evidence, and the story of why we built a Q&A that is curated-first and AI-second.
- Strategy
PDP before and after UGC: what actually changes on the page
Strip a product page back to brand-only content, then layer verified customer photos, video and reviews into the middle scroll, and watch what moves. A scroll-by-scroll look at the before and after, the numbers the public studies actually support, and where "just add UGC" gets oversold.
- Industry playbook
How to vet a creator: audience authenticity, engagement, and the fake-follower problem
On a typical account, roughly a fifth of followers are fake or inactive. Here is how to read the signals that separate a real audience from an inflated one, before you pay, with the four checks that catch most of it.
