Using UGC Legally: A Guide to Image Rights in the EU

A public Instagram post isn’t a free image library. If you want to repost a customer’s photo, use an employee video in an ad, or publish event footage, you need to clear the rights before publication.

Your safest operating rule for UGC image rights in the EU is simple: obtain specific, documented permission from the creator and every recognisable person before using content for marketing. Don’t treat a tag, mention, hashtag, or public profile as consent.

Legal disclaimer: This article provides general information, not legal advice. Image rights, data protection, copyright, employment rules, and consumer law can vary by country and situation. Consult a qualified lawyer about your campaigns, permission language, and legal basis.

Why one photo can involve several rights

UGC rarely has a single rights holder. A ten-second customer video can involve the person who recorded it, three people visible in the background, a musician whose song is playing, and a venue with restrictions on commercial filming.

You need to examine four separate layers:

• Image and personality rights: Recognisable people generally control commercial publication of their likeness. In Germany, this is commonly discussed as the Recht am eigenen Bild.
• Data protection: An identifiable photo, video, username, or testimonial is personal data. Collecting, storing, editing, scheduling, and publishing it are forms of processing.
• Copyright: The photographer or videographer usually controls reproduction, editing, and publication of the work. The person shown in an image doesn’t automatically own its copyright.
• Third-party material: Music, artwork, logos, private locations, screens, and other protected content can create additional restrictions.

Clearing one layer doesn’t clear the others. Permission from the person in a portrait doesn’t replace the photographer’s licence, and a photographer can’t automatically authorise commercial use of somebody else’s face.

Use consent as your default for promotional UGC

For ordinary brand marketing, explicit consent is the right default. It creates a clear record, gives contributors a real choice, and avoids stretching another legal basis beyond what people reasonably expect.

Under European data protection principles, valid consent must be informed, specific, freely given, and expressed through a clear action. A preselected checkbox, silence, or a sentence buried in general terms isn’t a sound permission process.

Your request should tell the contributor:

1. Which company will use the content.
2. What photo, video, caption, or testimonial is covered.
3. Where it may appear, such as organic social media, your website, newsletters, or paid advertising.
4. Whether you’ll crop, subtitle, translate, or otherwise edit it.
5. How long you plan to retain and use it.
6. Whether agencies, platform providers, or other partners will process it.
7. How the contributor can withdraw data protection consent or request that future use stop.

Don’t ask for “all media, worldwide, forever” if you only plan to publish three organic LinkedIn posts during a six-month campaign. Narrow permission is easier for a contributor to understand and easier for you to defend.

A tag or campaign hashtag isn’t enough

When somebody tags your hotel in a holiday photo, they’re inviting attention. They aren’t necessarily authorising your marketing team to download the image, rewrite the caption, and feature it in a paid campaign.

The same problem applies to hashtags. A campaign hashtag can support permission only when entrants see clear terms before submitting and take an unambiguous action to enter under those terms. Discovering a branded hashtag in somebody’s ordinary post doesn’t give you a reusable content licence.

Ask through a controlled permission flow instead. A comment saying “Can we share this?” is better than no request, but it still leaves the permitted channels, edits, duration, and withdrawal process unclear.

Why legitimate interest is a poor shortcut

Legitimate interest is a recognised GDPR legal basis, but you shouldn’t use it as your standard justification for publishing identifiable customers in promotional content. Marketing value to your company doesn’t automatically outweigh a person’s privacy, image rights, or expectations.

Relying on legitimate interest also doesn’t solve copyright or national image-rights requirements. You would still need to establish necessity, balance the competing interests, provide appropriate information, and respect objections.

There are narrow contexts where images of crowds, public events, incidental passers-by, or matters of public interest receive different treatment under national law. Treat those as specialist exceptions, not as a UGC growth tactic. Have counsel assess them before publication.

Build permission around each intended use

Organic publication and paid advertising shouldn’t sit behind one vague checkbox. A customer may happily appear in an Instagram story but reject having their face used in targeted ads for six months.

Separate materially different uses, especially:

• Organic brand social posts
• Website pages and case studies
• Email marketing
• Paid social and display advertising
• Printed sales or event materials
• Sharing with distributors, franchisees, or campaign partners

Your rights record should travel with the asset. If the file reaches a social scheduler without its permitted channels, expiry date, and people-clearance status, your workflow is already unsafe.

For a practical setup, use a documented UGC consent and approval checklist rather than relying on screenshots in individual inboxes.

Treat employee content as a higher-risk category

Employee participation isn’t automatically voluntary. A request from a manager, public participation leaderboard, or expectation that “everyone joins the employer-brand campaign” can undermine genuine choice.

Make employee UGC optional and say so plainly. Don’t connect participation to performance reviews, shift allocation, promotion, or informal team pressure, and offer an equally acceptable way to contribute without appearing on camera.

You should also define what happens after somebody leaves the company. A former employee shouldn’t discover that their face is still scheduled for a recruitment campaign because nobody attached an end date to the asset.

Don’t publish minors without a dedicated review

Content involving children needs a separate process. Age thresholds, parental authority, and the child’s own capacity to consent are governed by applicable national rules and the context of the processing.

Don’t accept a casual assurance that “the parents are fine with it.” Verify the responsible adult, obtain documented permission, explain the intended use, and avoid collecting more information about the child than you need. For schools, sports clubs, healthcare settings, and sensitive locations, require legal review before publication.

Mini-case: the hotel campaign with 48 uploads

A Salzburg hotel asks guests to upload short clips for a winter-weekend campaign. Its submission page states that approved clips may appear on the hotel’s Instagram account and website for six months, permits basic cropping and subtitles, and provides a direct withdrawal contact.

The team receives 48 uploads. Its rights check produces these results:

• 31 clips have a confirmed creator, consent from every recognisable adult, and no problematic third-party material.
• Eight show friends or partners who haven’t provided permission.
• Five contain prominent commercial music added outside the platform’s approved brand-use tools.
• Four feature children without verified parental permission.

The hotel publishes only the 31 cleared clips. It asks the other contributors for missing permissions or replacement files instead of assuming that submission cleared everyone visible in the footage.

That decision sacrifices 17 potential posts, but it gives the team a usable audit trail and prevents questionable assets from reaching paid media. A rights-aware collection system such as sharey’s guided UGC workflow can capture permissions and intended uses alongside each upload rather than reconstructing them after selection.

Keep proof, not just the final asset

A folder containing finished images doesn’t prove lawful use. You need a record showing what the contributor saw, what they accepted, when they accepted it, and which content the permission covered.

Keep the following information with each asset:

• Contributor identity and contact route
• Upload date and source
• Original permission wording or version
• Timestamp and affirmative action used to agree
• Confirmed creator or copyright owner
• Clearance status for recognisable people
• Approved channels, edits, territories, and campaign duration
• Restrictions, withdrawal requests, and publication history

Limit access to these records and define a retention period. Keeping every rejected upload and identity record indefinitely creates risk without adding operational value.

Create a withdrawal and takedown process

Consent must be as easy to withdraw as it was to give. Provide a working contact route and make sure social, legal, campaign, and customer-service teams know where to send requests.

When a contributor withdraws consent or disputes your rights, pause future use immediately. Remove the asset from scheduled posts, paid campaigns, reusable libraries, and new production files while the responsible team assesses existing publications and any separate contractual rights.

Maintain a suppression record so that a removed image isn’t uploaded again six months later by another marketer. You may need limited information to document the request and prevent accidental republication, but you shouldn’t retain the full campaign asset by default.

Your pre-publication checklist

Before you publish identifiable UGC in the EU, confirm that:

• The uploader created the content or can license it.
• Every recognisable person has provided appropriate permission.
• The approved uses include the exact channel and campaign format.
• Paid advertising is covered separately when relevant.
• Planned crops, captions, translations, and edits are allowed.
• Music and other third-party material are cleared or removed.
• Minors and employee submissions have passed additional review.
• The asset has a retention or permission end date.
• Your team can retrieve the consent record and stop future use quickly.

If one of those checks fails, don’t publish. Request the missing permission, edit out the protected element where lawful, or choose another asset.

Takeaway

Treat every UGC asset as a bundle of rights, not a free social post. Get specific permission before publication, store that proof with the file, and block any asset whose people, copyright, channels, or duration haven’t been cleared.