Rules and ethics
Part of UGC rights social commerce UK: How to use customer content
UGC rights social commerce UK: How to use customer content
UK copyright and GDPR consent decide whether you can reuse customer photos in social commerce. Here is how to clear rights and keep evidence.
What to take away
- Copyright in a customer's photo, clip or caption stays with the person who made it, so reposting needs their permission.
- A tag, a like or a campaign hashtag is not permission, and neither is a public profile.
- Consent under the UK GDPR is a separate test from copyright, and it can be withdrawn at any time.
- Keep one record per asset showing the rights holder, the allowed uses, the evidence and the review date.
- Advertising rules apply once customer words appear in paid or brand-owned space.
Copyright in customer content belongs to the customer
Copyright in a photograph, video or caption starts with the person who made it, under the Copyright, Designs and Patents Act 1988. Uploading a photo to a platform gives that platform a licence to display it. It gives you nothing.
A tag, a comment or a campaign hashtag is not a licence either. Reposting without permission infringes copyright, and the customer can ask you to take the post down.
Consent under the UK GDPR is a second test
A photo of an identifiable customer is personal data. The Data Protection Act 2018 sets the framework for handling it across the UK, and the ICO handles complaints.
Consent must be freely given, specific, informed and unambiguous, and as easy to withdraw as to give. Marketing reuse normally calls for consent rather than legitimate interests. Asking a customer to agree to "all future marketing" does not clear that bar.
Build one record per piece of content
A record that survives a staff change is worth more than a folder of screenshots. One line per asset, reviewed before every reuse, is enough.
UGC rights record fields
- Author and ownername, handle, date
- Licence scopechannels, territory, edits, term
- Consent recordwritten reply stored
- Withdrawal routemonitored email, 72-hour removal
- Review datechecked before each reuse
| Field | Why it matters | Weak answer | Defensible answer |
|---|---|---|---|
| Author and owner | Copyright starts with the maker | "It came from the hashtag" | Name, handle, date and the original post |
| Licence scope | Channels, territory, edits and term | "We can use it" | Named channels, UK, cropped only, 12 months |
| Consent record | Consent is the lawful basis for marketing | A verbal yes in a direct message | Written reply stored with the asset |
| Withdrawal route | People can change their mind | No contact recorded | Monitored email alias and a 72-hour removal target |
| Review date | Campaigns outlive permissions | Never diarised | Checked before each reuse |
Clear a customer photo in four steps
- Identify every right in the asset. One clip can carry the camera owner's copyright, a music track, a recognisable voice and a branded backdrop.
- Ask in writing for the uses you actually want, naming organic posts, paid ads, email and in-store screens, plus territory and duration.
- Store the reply beside the asset. Log the date, the exact wording and anything the customer refused.
- Diarise a review. Reconfirm before a second campaign, and remove the asset in the same week that someone withdraws.
Reviews and screenshots follow the same rules
A customer review is a piece of writing, so copyright applies to it. Screenshotting one into a brand carousel makes a copy, and a named reviewer's words are personal data too.
Ask before you repost, and strip the handle if the words alone will do. If you only need the sentiment, paraphrase it and leave the image out of the design.
Where social commerce teams get caught
Campaign hashtags are the commonest trap. Inviting customers to post with a tag builds reach, but it transfers neither copyright nor consent. Treat the tag as a signal of interest and ask each person separately. Running a social commerce quality checklist before a post goes live catches missing permissions alongside claims, prices and reviews.
What each trigger does not clear
Hashtag campaign
- Copyright
- Not transferred
- Consent
- Not given
- Risk
- Commonest trap
Editing
- Copyright
- Crop may be fine
- Consent
- Still required
- Risk
- Moral rights
Paid promotion
- Copyright
- Needs licence
- Consent
- Filed in writing
- Risk
- Ad codes apply
Editing carries its own risk. Cropping a customer's photo is usually fine if the licence allows it. Adding a caption that mocks the product may not be. Moral rights protect the maker's reputation as well as the work.
Paid promotion changes the rulebook again. Customer testimonials in ads sit within the advertising codes, so claims must be honest and commercial relationships must be obvious. Lifting a gifted creator's footage into a brand advert without a licence is a common failure. Ask for an advertising licence in writing, filed with the consent record.
Someone has to own this. Naming a single person for rights and consent, alongside the other roles a selling operation needs, turns a policy into a habit: six owners every social commerce operation needs.
Common questions
Does a tag or a hashtag count as permission?
No. A tag shows the customer is happy to be associated with you in that moment, but it licenses nothing and satisfies no consent test. Ask separately, in writing, for the uses you need.
Is a customer's photo personal data?
Yes, where the person can be identified from it. That brings the UK GDPR into play alongside copyright, so you need a lawful basis, a retention period and a removal route for every asset you keep.
Can we use customer videos in paid ads?
Only with a licence that names paid advertising, and normally with explicit consent. If the footage came from a gifted creator, read the contract and the disclosure requirements before you spend.
How long can we keep using the content?
For as long as the permission allows and no longer. Set a term when you ask, diarise the review, and take the asset down promptly if the customer withdraws.
