Reposting a customer's photo feels harmless, they posted it publicly, they tagged your brand, everyone's happy. Legally, that assumption has burned real companies.
A public post is not a license. Understanding the gap between "they shared it" and "you can use it commercially" is the whole lesson.
Copyright lives with the creator, not the subject
Whoever pressed the shutter button owns the copyright, by default, the instant the photo is taken. That is true even if the photo is of your product, tagged with your handle, and posted with glowing praise.
A platform's terms of service give the platform a license to display the content, they do not give your brand a license to repost it on your own channels, ads, or packaging. Those are different uses requiring separate permission.
A woman sued Anheuser-Busch alleging copyright infringement, invasion of privacy, and violation of her right of publicity after her image appeared in a campaign without permission. This is the exact fact pattern brands trigger when they scrape social content and reuse it without asking.
Two rights, not one
Most teams only think about copyright. There is a second, separate right that trips people up just as often.
- Copyright: covers the creative work itself, the photo or video file. Belongs to whoever created it.
- Right of publicity: covers a person's name, image, and likeness being used commercially. Belongs to whoever appears in the content, even if they didn't take the photo.
If a customer posts a selfie holding your product, you may need permission from both the photographer (copyright) and every identifiable person in frame (publicity), and those can be different people. A friend photographing the customer, who is then reposted by your brand, means you need clearance from both.
State law varies a lot here. California and New York have the strongest statutory publicity-rights protections, so a use that's low-risk in one state can carry real exposure if the subject lives in another.
Getting a real license, not a hashtag
"Use #BrandName to enter" is not a rights transfer. Courts and regulators expect clear, affirmative consent for commercial reuse.
- Direct message the creator and ask explicit permission to repost, specifying where (organic social, paid ads, website, packaging).
- Use a UGC rights-management tool that logs consent with a timestamp, so you have a record if questioned later.
- Write consent into contest official rules, but make the grant specific rather than a blanket "we own everything forever" clause.
- Get separate consent for anyone else pictured, the entrant's permission does not cover a bystander's face.
Specificity protects you. A permission that says "repost this photo on our Instagram grid through end of year" survives more scrutiny than "you agree we can use your content."
Where contest rules go wrong
Contest and sweepstakes official rules routinely grant sponsors sweeping IP rights, "in all media, worldwide, in perpetuity, for any purpose, without compensation." That kind of overreach creates two separate problems.
- Enforceability: entrants have privacy and publicity rights that broad contest fine print cannot simply override, some states require express written consent regardless of what the rules say.
- Brand risk: even where legally defensible, expansive grabs generate bad press when an entrant realizes their face is now in a national ad campaign they never agreed to.
A frequently cited cautionary example: a Florida Hooters location ran a sales contest promising a car as the prize, then attempted to award a toy in a play on words, leading the winner to sue for breach of contract and misrepresentation. The lesson generalizes: ambiguous or overreaching contest terms create real legal exposure, not just PR headaches.
A workable UGC checklist
Run every campaign through this before content goes live in paid media or on owned channels.
- Confirm who took the photo and get their explicit repost consent, not just a hashtag mention.
- Identify every person visible in the content and confirm you have (or don't need) their publicity consent.
- Keep a dated record of every permission, screenshots of DMs are fine, verbal-only agreements are not.
- Route contest official rules through legal review before the contest launches, not after an entrant complains.
- Set an expiration or scope on usage rights instead of claiming perpetual, unlimited use by default.
Organic reposting with a simple thank-you comment carries lower risk than paid advertising reuse. The line that matters legally is: are you using someone's content or likeness to sell something. That's when formal consent becomes non-negotiable.
UGC is genuinely valuable, authentic photos convert better than stock imagery. Get the permission in writing and it stays an asset instead of becoming a liability.