Do You Need Permission to Use Customer Photos in Ads?

The short answer: yes, you need permission, and specifically a written license that covers paid advertising. The customer who shot the photo or video owns the copyright in it from the moment they hit record. Posting it publicly does not give you rights to it, tagging your brand does not give you rights to it, and entering your hashtag contest does not give you rights to it. If you want to run that content as an ad, you need a license that says so.

This trips up good marketers constantly, because the content feels like it is about you. It is not yours, though. It is theirs, about you.

Why a hashtag is not a license

The logic brands apply is reasonable and wrong: we asked people to post with #OurBrand, they read the rules, they posted, so they agreed. The problem is that copyright licenses are not usually created by implication. A customer who uses your hashtag has done one thing: used your hashtag. Unless your campaign terms are genuinely presented to them and genuinely accepted, and unless those terms actually grant you an advertising license, you are holding a photo you like and nothing else.

Instagram's terms are worth understanding here too, because they are the source of another common mistake. When someone posts to Instagram, they grant Instagram a broad license. They do not grant one to you. Instagram being allowed to use the content has no bearing on whether you are. Brands have been sued over reposted vacation photos and product shots, and the defense that the photo was public has not worked well.

There is a related version of this that catches even careful teams: you got permission months ago to repost something organically, and now the performance team wants to put media behind it. Organic permission is not paid permission. Somebody saying "sure, feel free to share it" in a direct message was agreeing to a repost, not to appearing in an ad that runs against a cold audience for a quarter.

What the license actually needs to say

Vague permission causes almost as many problems as no permission. When you ask, ask for something specific enough to be useful later. Five terms do most of the work.

• Paid advertising, named explicitly. The single most important line. "You may use my content in your marketing" is ambiguous. "You may use my content in paid advertising" is not.
• Editing and derivative use. You will crop it, add captions, cut it to six seconds, and put it in a different aspect ratio. That is making a derivative work, and it needs to be covered.
• Territory. If you might run it outside the US, say worldwide. Do not let it be implied.
• Term. How long. Perpetual is cleanest if the customer will agree to it. A fixed term means somebody has to remember to pull the creative, and nobody ever does.
• Their name and likeness. Copyright covers the photo. It does not cover the fact that a recognizable person is in it. If a face appears, get consent for using their likeness in advertising as well.

Get it in writing. Email is fine. A form submission is fine. A verbal yes on a call is not, because in a year the person who took the call will have left and the content will still be running.

The cleanest version of this is to stop chasing content after the fact and instead have customers submit it to you directly, through a request link that presents the terms at the moment they upload. That way the license and the asset arrive together instead of you reconstructing consent months later from a thread of direct messages. Software that collects customer reviews and video through a single request link handles that flow, and the same pattern works whether you want a written testimonial or a clip you intend to boost.

The second rule: disclosure

Copyright decides whether you may use the content. A separate rule decides what you have to say when you do, and it is the one that turns a cheap campaign expensive.

Under the FTC Endorsement Guides at 16 CFR 255.5, when a connection exists between an endorser and the seller that might materially affect the weight or credibility of the endorsement, and the audience would not reasonably expect that connection, it must be disclosed clearly and conspicuously. The regulation names monetary payment and the provision of free or discounted products as material connections, including products unrelated to the one being endorsed, and it applies regardless of whether you required an endorsement in return.

Read that last clause again, because it is the one brands miss. You do not escape the rule by not asking for anything. If you sent someone a free product and they posted about it, the connection exists whether or not you requested the post.

The same reasoning reaches contests and rewards. The regulation's examples treat points and reward programs, where people earn perks for posting about products, as materially affecting weight or credibility. A prize draw is not obviously different in kind. If entering your campaign puts someone in line for a thousand dollars of product, a reader deciding whether to trust their enthusiasm would probably want to know that.

Clearly and conspicuously has a practical meaning too. A disclosure buried after a "more" link, or sitting fourteenth in a stack of hashtags, is not doing its job. Put it where someone will actually read it, in the content itself when you can.

What this means for how you run the campaign

None of this makes customer content a bad idea. Genuine customers saying genuine things is the most persuasive asset you can put in an ad, and no generated presenter substitutes for it. What the rules do is change the cost calculation, because the content that looks free is not.

A collection campaign carries per-asset legal work: a license for each piece, a disclosure decision for each incentive, and someone tracking which assets are cleared for paid use and which are not. At ten assets that is an afternoon. At three hundred it is a job, and it is why rights management tools exist.

Content you commission or generate works differently. The rights question is settled in the contract or the tool terms before the asset exists, so there is no customer to chase for a signature afterward. That is a large part of why performance teams drift toward produced creative as they scale: not because it performs better, but because it clears faster. The trade-off is real and worth naming, and the difference between a collection campaign and a production campaign is worth deciding deliberately rather than by accident.

If you go the generated route, one line applies and it is not subtle: an AI presenter may deliver your claims, but it may not pose as a real customer or a verified review. Framing generated content as a genuine testimonial is exactly the thing the FTC's rule on fake and AI-generated reviews addresses. Use a presenter to say what your brand says. Do not use one to say what a customer said.

A workable process

For most brands this comes down to four habits. Ask for the license in writing before the content runs anywhere, and name paid advertising in it. Assume anything you gave the customer creates a connection you should disclose. Keep one list of which assets are cleared for paid use, because your future self will not remember. And when you need volume rather than authenticity, produce the creative instead of harvesting it, so the rights question never comes up.

The brands that get burned here are almost never the ones who thought about it and made a judgment call. They are the ones who never asked the question, ran a customer's photo for six months, and then heard from a lawyer. Asking takes a sentence.

This is general information to help you plan, not legal advice. Copyright and endorsement questions turn on specifics, so run a large campaign past a qualified advisor before you spend on it. If you want the wider planning picture, including what each type of campaign costs and how to pick between them, start with the UGC campaign guide, and the UGC creator marketplace guide covers how usage rights are normally handled when you hire a creator instead.