Most brands are one viral post away from a legal problem they didn’t budget for. A creator posts about your product, you repost it without a rights request, it racks up 400k views, and their lawyer emails your marketing director on a Tuesday afternoon. The playbook you’re about to read is the reason that doesn’t happen.
Why rights management matters more than most brands think
UGC law sits at an uncomfortable crossroads between copyright (the creator owns their photo the moment they press shutter), platform terms (Instagram grants you a licence to display content, not to republish it on your website), and brand liability (reposting without consent can constitute endorsement implication under FTC rules in the US and equivalent CAP codes in the UK).
The practical risk isn’t usually litigation from a creator — most are delighted to have their work amplified and will grant rights happily. The risk is the 5% who aren’t, and the one in 200 who will escalate. At any meaningful scale of UGC (say, 500+ pieces per month), even a 1% issue rate is five legal conversations a month you weren’t planning to have.
The four corner cases behind 80% of disputes
After reviewing 200+ customer support escalations across Idukki’s customer base, four patterns account for the vast majority of rights disputes:
Implied endorsement without explicit rights
You reposted a customer photo showing your product in a flattering context. The customer never said they endorsed your brand. Under FTC and CAP rules, displaying UGC in a marketing context can imply endorsement even if no hashtag or caption says so. Request explicit rights with a clear disclosure statement.
Rights expiry not tracked
A creator grants you rights for 12 months. Month 13, the post is still in your gallery. If the creator has since changed their position, become a competitor's spokesperson, or simply changed their mind, you're now using rights you don't have. Track expiry dates in your CRM or rights platform.
Platform-to-platform migration without re-granting
You had rights to use a creator's Instagram video on Instagram. You then embed it on your website, include it in a paid ad, and export it to a Shopify product page. Each is a new usage context. Your original DM permission likely only covered the original platform.
Minor in the frame
A parent posts a photo of their child using your product. The parent grants UGC rights. The child has no capacity to consent. Some jurisdictions (California, UK under Age Appropriate Design Code) have explicit restrictions on commercial use of images of minors. If you can see a face, flag it for human review before approving.
The full rights stack, explained
A robust rights programme has five layers. Most brands only implement two or three, which is why the corner cases above keep biting.
Discovery
Monitoring: hashtag, mention, tagged post. What you collect determines what you can request rights for. Tools: Idukki Super Search, native Instagram/TikTok Creator Marketplace search, Brand24 for off-platform mentions.
Rights request
Templated DM or comment reply asking for explicit permission. Include: what platform, what usage context, how long, whether the usage will include paid amplification. Platform-specific request copy is in the Appendix.
Consent capture
Creator replies "yes" or clicks a consent link. The consent must be explicit, timestamped, and stored. A screenshot of a DM is legally weak — use a platform (Idukki, TINT, Bazaarvoice) that timestamps and stores consent.
Rights tracking
Every piece of rights-cleared UGC needs: rights holder name, date granted, expiry date, usage scope (web, paid, OOH), and a flag for content involving minors. This lives in your rights CRM or platform.
Ongoing compliance
Monthly audit: check expiry dates, check that content still lives on the creator's original platform (deleted posts = rights revoked in most interpretations), check for any escalations.
Platform-specific rules at a glance
Each platform has its own ToS around content re-use. This is not legal advice — check the current ToS and consult your legal team for paid or OOH use. These are the practitioner rules of thumb the Idukki team applies:
| Platform | Native embed? | Re-publish (own site)? | Paid ads? |
|---|---|---|---|
| Yes (oEmbed) | Rights request needed | Rights + Branded Content tag | |
| TikTok | Yes (oEmbed) | Rights request needed | Spark Ads + creator agreement |
| YouTube | Yes | Rights request needed | Written agreement required |
| Twitter / X | Yes (oEmbed) | Rights request needed | Rights request needed |
| Limited | Rights request needed | Rights request needed | |
| Google Reviews | Via Maps API (ToS) | Explicit consent required | Explicit consent required |
The 30-day implementation plan
This is the schedule most Idukki customers follow when moving from ad-hoc to systematic. It assumes a team of one person owning UGC (typically a social manager or an ecommerce coordinator) and a rights platform that handles request + consent tracking.
Audit existing library
Pull every piece of UGC currently in your gallery or active in ads. Classify each as: rights-cleared, pending, unknown, or flagged. Flag anything involving minors or rights that expired.
Draft request copy
Write three variants of the rights request DM: short (for accounts with <5k followers), standard (most accounts), agency (for brand accounts or professional creators who'll want more detail). Paste them into a shared doc your team can pull from.
Set up tracking
Create a rights tracking view in your CRM or platform. Fields needed: creator handle, post URL, rights granted (Y/N), usage scope, expiry date, minor-in-frame flag, notes. If you're using Idukki, the rights panel handles this natively.
Send first batch
Request rights for all "unknown" posts in your current gallery. Set a 7-day response window. Log results. Expect 60–80% response rates on first outreach for active posts; 20–30% for older content.
Automate the intake flow
Set up a monitoring trigger: when new UGC matches your brand criteria, a rights request goes out within 48 hours. This closes the manual loop. Idukki's rights automation does this via comment reply or DM, based on platform.
Set review cadence
Schedule a monthly 30-minute review: check expiry dates, review escalations, spot-check 20 random posts in gallery vs rights log. Add it to someone's calendar as a recurring task.
Request copy templates
These are the three DM templates the Idukki team uses internally. Adapt the brand name and product references. The key rules: be specific about usage, be honest about paid amplification, make it easy to say yes.
Short (informal creators)
Hi [Name] — we spotted your post about [product] and love it. Would you be happy for us to share it on our website and Instagram? We'd credit you and tag your account. No paid use — just organic sharing. Reply with "yes" or DM us if you'd like more details. 🙌
Standard
Hi [Name], we loved your recent post featuring [product]. We'd love to feature your content on our website, our Instagram feed, and potentially in email newsletters — with full credit and a tag back to your account. This covers organic use only (no paid ads). Rights would be for 12 months from the date you reply. If that works, just reply "agreed" here or sign our simple consent form at [link]. Thanks so much!
Agency / professional creator
Hi [Name], I'm reaching out from [Brand] about your post [URL]. We'd like to request rights to use it across the following: our brand website (product pages + UGC gallery), organic social posts, and email newsletters. We'd also like the option to use it in paid social advertising, for which we'd pay a separate licensing fee. Rights requested: 24 months, non-exclusive, worldwide. We'd credit you in every placement with a tag or named attribution. If you'd like to discuss licensing terms, please reply here or email [email]. Thank you!
One-page compliance checklist
Run this before publishing any UGC to your website, paid ads, or OOH:
- Rights request sent and response received (explicit "yes", not just a like or comment emoji)
- Usage scope agreed: web / organic social / paid / email / OOH — only use what was agreed
- Rights stored: creator name, post URL, date, scope, expiry date logged in your CRM or platform
- Expiry date set and diarised: if rights are for 12 months, set a 30-day renewal reminder
- Minor check: no faces of children visible without parental consent documented separately
- Creator still active on platform: if post is deleted or account is gone, check your rights agreement
- If paid use: separate paid rights agreement in place or Branded Content / Spark Ads tag active
- Attribution: creator handle tagged or named in every placement
This is not legal advice. The templates and guidance above reflect Idukki’s internal practice and the rules of thumb most ecommerce brands apply. For commercial or paid advertising use of UGC at significant scale, consult a lawyer who specialises in IP and advertising law in your jurisdiction.