# The complete UGC rights and permissions guide

The customer who shot a photo owns its copyright, not you and not the platform. What a usage licence must cover, plus the music, disclosure and deleted-post traps.

By Rohin Aggarwal · 2026-05-05

The phrase 'usage rights' bundles a dozen separate operational commitments, and most brand teams have already agreed to all of them in vendor contracts they have never re-read. The guide below walks through who actually owns a customer photo, what a licence has to cover, and the edge cases (music, bystanders, deleted posts) that quietly turn a content win into legal exposure.

**Quick answer**

- The customer who created a photo or video owns its copyright, not your brand, and not the platform.
- A usage licence should cover scope, channels, duration and edit rights, and be recorded against the asset.
- Disclosure rules (FTC in the US, ASA in the UK) apply when content is incentivised or part of a paid relationship.
- Music, bystanders and deleted originals are the edge cases that catch brands out.

Keep this open while you build a UGC programme. It is practical guidance, not legal advice. For anything high-stakes, run it past a lawyer in your market. What it does cover is the set of questions that come up again and again once real customer content starts flowing. If your programme starts from a campaign, pair this with [how to run a UGC competition](/blog/how-to-run-a-ugc-competition), where the rights step is built into the entry mechanic.

## Who owns a customer photo?

Copyright vests in the creator the moment the shutter fires. The customer who took the photo owns it. Your brand appearing in it, or being tagged in it, changes nothing. The platform’s terms grant the platform a licence, not you. To use the content yourself, you need permission from the creator. Full stop.

## What should a usage licence cover?

- Scope of use: organic social, your website, email, paid advertising. Paid ads are the scope creators most often have not agreed to.
- Channels and surfaces, be specific; "marketing" is too vague to rely on.
- Duration, perpetual, or a fixed term. If unstated, do not assume perpetual.
- Edits: may you crop, trim, add captions or overlay product tags?
- Attribution, whether and how you credit the creator.
- A record: the request, the affirmative reply, the date, tied to the specific asset.

| Licence term | What it covers | Default if left unstated |
| --- | --- | --- |
| Scope of use | Organic social, website, email, paid ads. | Assume organic + website only; paid ads is NOT granted. |
| Channels / surfaces | The specific places the content can appear. | "Marketing" is too vague to rely on; treat as unspecified. |
| Duration | Perpetual or a fixed term. | Do not assume perpetual; treat as short-term. |
| Edit rights | Crop, trim, caption, overlay product tags. | Assume no edits beyond what was shown when consent was given. |
| Attribution | Whether and how the creator is credited. | Credit the creator unless they ask otherwise. |

_Table 1. The five terms a usage licence should pin down, and the safe default when one is missing._

## Disclosure: FTC, ASA and incentivised content

Genuine, unsolicited customer content carries no disclosure obligation. The moment content is incentivised (gifted product, a discount, a competition entry, any paid relationship) [disclosure rules](/blog/ftc-endorsement-guidelines) apply. In the US that is the FTC; in the UK, the ASA and CMA. The duty is shared: the creator should disclose, and the brand should not publish incentivised content dressed up as spontaneous.

> **Do not synthesise proof:** Never invent reviews, inflate an aggregate rating, or present incentivised content as organic. Beyond the legal exposure, AI agents and search engines increasingly detect and penalise fabricated social proof: and trust, once lost, does not come back cheap.

## Music and third-party content

A customer video can be perfectly cleared for the visuals and still [carry a music track you have no licence for](/blog/music-licensing-in-ugc-video). The licence the customer (or the platform) holds for posting on TikTok or Instagram does not extend to your website or your ads. When in doubt, use content where the audio is the creator’s own, or replace the audio with a track you have licensed.

## Edge cases: bystanders and deleted posts

Two more catch brands out. An identifiable person who is not the creator (a friend in the shot) can hold their own rights, especially in stricter jurisdictions, so favour content where everyone visible is the creator or has consented. The other trap: if [a creator deletes the original post](/blog/when-a-creator-deletes-the-original-post), your licence to the copy you cleared still stands, but only if you kept your own copy of the asset and the permission record. Relying on a live link to the original is fragile.

**The standard to hold:** For every piece of UGC you publish, you should be able to answer, in seconds: who created it, what did they permit, when, and where is that record. If you cannot, treat it as not cleared.

> **How Idukki helps:** Idukki’s Rights Management runs the request, captures the scoped permission, and keeps the clearance record attached to each asset, so your UGC library is auditable, not a liability. The same cleared assets then publish as [shoppable video on the surfaces that convert](/blog/where-to-place-shoppable-video).

### Sources & notes
- [U.S. Copyright Office](https://www.copyright.gov/what-is-copyright/) — Copyright ownership basics.
- [FTC, Endorsement Guides](https://www.ftc.gov/business-guidance/resources/ftcs-endorsement-guides) — US disclosure rules for incentivised content.
- [UK ASA / CMA, influencer and endorsement guidance](https://www.asa.org.uk/) — UK disclosure rules.
- Note — This article is practical guidance, not legal advice. Confirm specifics with a qualified lawyer in your market.

- **30 days** — GDPR right-to-erasure SLA (End-to-end inc. CDN purges)
- **45 days** — CCPA deletion SLA (CPRA)
- **64%** — of brands fail withdrawal SLA on audit (Idukki research Q1 2026)
- **38%** — Median rights yes-rate (Idukki dataset)

_Compliance benchmarks across UGC programmes._

---
Canonical: https://idukki.io/blog/ugc-rights-and-permissions-guide
Tags: ugc, rights-management, legal, compliance