User-Generated Content (UGC): how to legally use photos and customer reviews in your advertising?

A photo of a happy customer with your product is the best advertising. Such user-generated content (UGC) inspires maximum trust and works better than any professional footage. But the temptation to simply take a screenshot and publish it on your page can lead to serious legal problems. In this article, we’ll break down how to legally and ethically use  UGC in marketing, turning grateful customers into real ambassadors of your brand without any risks.

Section 1: Why can’t you just take a customer’s photo?

You see the perfect photo in your Instagram feed: your customer is happily unpacking your order, the light is perfect, the composition is flawless, and they even tagged your account! A marketer’s first instinct is to immediately take a screenshot and post it on their profile with the caption “Thank you for your trust!”. It seems logical and correct because you were tagged, so they wanted to attract your attention. However, from a legal point of view, such an action is a direct violation of two fundamental human rights.

1.1 Copyright belongs to the author, i.e., your client, not you

This is a basic principle of copyright law that we have looked at many times before. The moment your client pressed the shutter button on his smartphone, he created a photographic work. And it is he, as the author, who automatically became the owner of the exclusive property rights to that work.

• Right of reproduction: Only the author can make copies of his photo. When you take a screenshot or upload a file, you are committing the act of reproduction (copying).
• Right to publish: Only the author can decide where and how to publish their work. Your Instagram page is another platform, and by posting a photo there, you are committing a new act of publishing.
• Recycling rights: If you want to put your own logo, filter, or crop on the photo, this is an act of recycling, which also requires the author’s permission.

The fact that a customer has tagged your account is not a legal transfer of rights. It’s just a way to get your attention, thank you, or brag about a purchase. It doesn’t mean that he has automatically gifted you his intellectual property. In fact,  user content rights work the same way as a professional photographer’s rights – you can’t use their work without permission.

1.2 The right to one’s own image: if there is a person in the photo, his or her consent to the use of the image in the advertisement is mandatory

This is the second, no less important legal aspect. If your client’s (or any other person’s) face is clearly visible in the photo, the Civil Code of Ukraine comes into play, namely Article 308 “Protection of the interests of a natural person depicted in photographs and other artistic works”.

The law clearly states that a photograph depicting a natural person may be publicly displayed, reproduced, or distributed only with the consent of that person. And when it comes to use for commercial, advertising purposes, such consent is absolutely mandatory.

• Example: A client took a photo of herself in your brand’s dress and posted it on Instagram. You took that photo and ran a targeted advert on it. In this case, you not only violated his copyright on the photo but also illegally used his appearance for commercial gain.

Even if the author of the photo and the person in it are different persons (for example, a husband took a photo of his wife), for legal use, you need the consent of both: the author of the photo (permission to use the work) and the model (permission to use the image).

1.3 Risks to business: from demands to remove content and reputational damage to lawsuits

Ignoring these rules can lead to a range of unpleasant consequences, the severity of which depends on your client’s mood and legal awareness.

• Demand removal of content and public apology: This is the easiest scenario. The customer writes to you in private messages or comments, “I did not give permission to use my photo. Delete it immediately!”. You will be forced to do so, and possibly publicly apologise, which is already a small reputational blow.
• Reputational damage: If a client decides to take the situation public and write a post exposing it (“The @your_brand_name brand is stealing their customers’ photos!”), It could trigger a wave of negativity that will be very difficult to “wash off”. You’ll look like a company that doesn’t respect its audience.
• Formal complaint from a lawyer: A more advanced client can contact a lawyer, and you will receive a formal complaint demanding not only the removal of the content, but also compensation for the illegal use of copyright and their personal image.
• Lawsuit: This is the worst-case scenario. Although such lawsuits are not yet widespread in Ukraine, their number is growing. In court, the client can demand significant monetary compensation, and the chances of winning such a case will be very high.

Thus, the minute benefit of publishing a “perfect” photo of a client is not worth the potential legal and reputational risks it creates.

Section 2: How to get permission to use UGC: 3 solid ways to do it

So, we’ve established that taking users’ content without permission is a path to trouble. But that doesn’t mean that UGC should be abandoned. On the contrary, you should use it, but you should do it the right way. There are simple and reliable ways to obtain legal authorisation that will not only keep you legally safe but will also demonstrate your respect for your clients, which will only strengthen their loyalty.

2.1 Method 1: Direct request. The simplest and most transparent method

This is the gold standard for working with UGC. It is based on simple human communication and is the most reliable in terms of proof of consent. When you see a photo, video, or review you want to use, you simply contact the author directly.

How it works in practice:

1. Write a comment below the author’s post: this is a public and transparent way. Your comment could be something like, “Wow, what a great photo!” 😍 We love it. Can we share it on our profile and website with a note of your authorship? Thank you!”
2. Write a private message (Direct Message): this method is more private and appropriate if you want to discuss wider use of content (e.g. in paid advertising). The message can be more detailed: “Hello, [Name]! We are the brand team of [Your Brand]. Saw your photo of our product, and it’s incredible! Thank you for tagging us. We would very much like to use this photo in our social networks (Instagram, Facebook) and possibly in a future email newsletter. Of course, with the obligatory marking of your profile as the author. Would you mind?”

Why is this method the best?

• Transparency and respect:  You don’t take something quietly; you ask openly. This makes the customer feel positive and valued. Most people are happy to agree.
• Explicit consent: A customer response such as “Yes, of course you can!” is unambiguous and explicit permission.
• Ease of proof: You can always take a screenshot of this correspondence, which will be your proof of consent in case of any misunderstandings in the future.

Requesting the use of a photo is the easiest step that turns a potential violation into a pleasant and legal co-operation.

2.2 Method 2: Branded hashtag. Create a unique hashtag for the campaign and clearly spell out the terms and conditions

This method is great for large-scale campaigns, contests, or simply for systematically collecting UGC. The idea is to invite your customers to use a specially created, unique hashtag, while explaining in advance exactly what its use means.

How to implement it:

1. Create a unique hashtag: It should be related to your brand or specific campaign. For example, #MyDressOfYourBrand or #BreakfastCYourBrand.
2. Clearly spell out the terms and conditions: This is the most important step. You must post a clear explanation in the contest rules, in your profile description, in your pinned Stories, or on your website. For example:
   “Share your photos with our products, put our official hashtag #MySuknyaBidYourBrand, and we will publish the best pictures in our profile! Important: by using this hashtag, you confirm your consent and grant us a non-exclusive licence to use your photo for free on our social media channels and website, with the obligatory mark of your authorship.”

How does this work legally? Your posted terms and conditions are a public offer. When a user puts your branded hashtag under their photo, they are accepting that offer, i.e., they are knowingly agreeing to your terms. Thus, you get “mass” consent from all participants.

Advantages:

• Automation: You don’t need to ask permission from everyone individually.
• Scalability: Perfect for large campaigns with hundreds of participants.
• Incentivise content creation: This motivates customers to create content for you.

Disadvantage: This method only works for content that was created as part of your campaign and with your hashtag. It does not apply to photos where you are simply tagged.

2.3 Method 3: Terms of Service clause. Relevant for platforms where users upload content themselves

This method is relevant for businesses that have their own platforms that involve users uploading content. These can be:

• Review sites where customers can leave text reviews and add photos to them.
• Marketplaces where sellers upload photos of their products.
• Educational platforms with the ability to upload homework or projects.
• Any services that have the ability to upload an avatar or profile photo.

In this case, you may include a clause in your Terms of Service/Terms of Use that each user agrees to when registering.

Example wording:

“By uploading any content (including text, photos and videos) to our Site, you grant us a non-exclusive, royalty-free, worldwide licence to use, reproduce, publish and display that content in connection with the operation of our Service and in our marketing materials.”

Nuance is important:

• The wording must be clear and unambiguous.
• The user must take an active action to agree to the Terms of Use (e.g., ticking the box “I have read and agree to the Terms of Use”).
• This method is quite “aggressive”, so it should be used carefully and only where it is really justified by the functionality of the platform. It is not suitable for ordinary social networks.

The method you choose depends on your specific situation, but a combination of the first and second methods covers 99% of most brands’ needs.

Section 3: What exactly should your permission request include?

So you’ve decided to take the most reliable route and make a direct request to the author of the content. That’s great. But for this request to be not just a polite gesture, but to have legal weight, it must be formulated correctly. It is not enough to simply ask “May I?”. You need to be clear about what you are asking permission for. This will help avoid misunderstandings in the future and provide you with reliable proof of your consent.

3.1 Clearly state exactly where you plan to use the content

This is the most important point. The user needs to understand where they could potentially see their photo or review. The more specific you are, the better. Imagine you are asking a friend to borrow a car. There’s a big difference between “borrow it for an hour to go shopping” and “borrow it for a month to go travelling in Europe”. It’s the same with content.

Levels of detail for your request:

• Minimal (for a simple repost): “Can we share your photo on our Instagram and Facebook profiles?”This gives you permission to post to the feeds and Stories of those specific social networks.
• Advanced (for wider use): “We’d like to use your photo on our digital platforms: website, social media (Instagram/Facebook/TikTok) and in our monthly email newsletter.”This greatly expands your options.
• Maximum (for a full ad campaign): “Your photo is perfect for our new ad campaign. Do you give us permission to use it in all of our marketing materials, including (but not limited to) social media, website, email newsletters, and paid targeting and contextual advertising?”

Why is this important? If you only get permission to repost on Instagram and then use that photo in a paid advert on Facebook, technically, the user can make a claim to you that they did not consent to such commercial use. So always ask permission for the maximum you are potentially planning.

3.2 Ask if the author agrees to the mentioning of his/her profile (credit)

Identifying the author of content is not only a legal requirement (the right to be named is an inalienable right of the author), but also a good tone and an effective marketing move. It’s called “credit” (credit).

Why it needed:

• Respect and Ethics: It shows your respect for the author and their work.
• Motivation: For many users, a mention from their favourite brand is a nice bonus and recognition. It motivates them and others to create content for you in the future.
• Social proof: Other subscribers see that this is a real person and not a model from a stock photo, which increases trust in your brand.

Your query should include this point. For example: “Of course, we’ll be sure to tag your profile as the author of the photo. Do you mind?”.
99% of people agree, but there are exceptions. Some people may ask to keep their profile private. It is your responsibility to honour this request. It is always better to clarify this point in advance.

3.3 Keep evidence of consent: take screenshots of comments or messages

Your dialogue with a user and their positive response is your legal document. It is the authorisation to use UGC that will protect you in case of any problems. Therefore, this proof needs to be kept securely.

• Take a screenshot: As soon as you get a clear answer (“Yes, we can”, “Sure, I’d be happy to”, “I agree”), take a screenshot of the entire dialogue. The screenshot should show the user’s profile name, the date, and the text of their consent.
• Create a folder for evidence: Do not save screenshots chaotically on your desktop. Create a separate folder (e.g. on Google Drive) called “UGC Permissions”.
• Systematise the files: Name the files so that they are easy to find. For example: [User Nickname]_[Date of consent]_[Brief description of photo].png. For example, ivanova_petra_25-11-2025_photo_with_dress.png.

This simple archive is your “insurance”. If in a year the same user suddenly forgets about his agreement and writes you a complaint, you can easily pull up this screenshot and remind him of your agreement. Without such proof, your word will be against his word, and your position will be much weaker.

Section 4: Features of using text-based testimonials

Photos and videos are visually appealing, but not the only type of UGC. Equally valuable, and sometimes even more compelling, are text reviews from your customers. A positive, detailed review on Google Maps, on your Facebook page, or on a specialised review site can be a powerful social proof tool. But as with photos, there are legal and ethical nuances.

4.1 Whether you can copy reviews from Google Maps, social media, etc. Legal and ethical aspects

Let’s imagine a customer has left you an extensive, emotional 5-star review on your Google business page. The temptation to take a screenshot and place it on the home page of your website under the heading “What Customers Say About Us” is very great. Is it legal to do so?

Legal aspect:

• Text Copyright: A text review, if it is original and unfolding enough (not just “everything is super”), is a literary work, copyrighted by the person who wrote it. By copying it without permission, you are technically violating his copyright.
• Personal data: The review almost always contains the name and surname (or nickname) of the author, and sometimes his photo (avatar). This constitutes personal data. By publishing them on your website, you are processing personal data, for which consent is also required.

Ethical aspect:

• Context of publishing: A person leaving a review on a particular platform (Google, Facebook) does so in the context of that platform. He may not expect or want his name and words to be taken out of that context and used in your nationwide advertising campaign or on the homepage of a website with millions of visitors. This could be perceived as an invasion of personal space.

So, while the risk of legal action for copying a text review is much lower than for using a photo, from a legal and business ethics perspective, simply copying without permission is wrong.

4.2 Best practice: ask permission before publishing a testimonial with the client’s name on it

The best and safest approach to using text reviews is the same as using photos – always ask permission. Not only will this keep you legally safe, but it will also demonstrate your respect for the customer, which can turn them from a one-time buyer into a loyal brand advocate.

How to do it right:

1. Contact the author: Find a way to contact the author of the review (for example, via Facebook Messenger if the review is left there, or reply to a comment if possible).
2. Formulate your request: Your request could be something like this:
   “Hello, [Name]! Thank you for such a wonderful and detailed review of our product on [platform name]. We would be very happy if we could share your words with our audience. Would you mind if we published your review (with your name) on our website in the testimonials section and on our Instagram page?”
3. Offer anonymity: If you feel a customer may hesitate, offer them an alternative: “If you don’t want us to include your full name, we can publish the review anonymously or by only including your first name and the first letter of your last name (e.g., “Irina K.”).”
4. Keep the proof: As with photos, be sure to take a screenshot of the correspondence where the customer gives you their consent.

This approach to how to use customer testimonials is a win-win. You get powerful marketing content, insulate yourself from any risks, and further strengthen the relationship with your most valuable audience – satisfied customers.

Conclusions

The number one rule of working with UGC that should become your mantra is to always ask permission. This simple action is the cornerstone of legal and ethical marketing. Not only does it protect your business from legal risks and reputational damage, but it also demonstrates respect for your audience, turning ordinary customers into loyal brand ambassadors.

A simple comment or request message is a paltry price to pay for peace of mind, trust, and quality, authentic content that works for you. Remember, getting your content right is just one item on the complete checklist for a marketer. You can read more about other aspects in our main article, “The Complete Checklist for a Marketer: From Content Creation to Campaign Launch“.