Rules and ethics
Part of Customer photo permissions UK: lawfully using UGC in marketing
Customer photo permissions UK: lawfully using UGC in marketing
Customer photo permissions UK: what marketers need from copyright, UK GDPR consent and ICO guidance before using customer images in campaigns.
What to take away
- A customer photo usually carries copyright owned by the photographer, not the brand or the customer.
- Using an identifiable person's image in marketing also needs a lawful basis under UK GDPR, normally consent.
- A social media tag, a public post or a competition entry is not enough on its own.
- Your permission should cover the channel, duration, edits and any paid promotion.
- Record consent, honour withdrawal and check every person shown in the image.
Why one photo can need two separate permissions
A customer photo can trigger two separate rights. Copyright protects the image. Data protection protects any identifiable person in it. A brand needs to clear both before using the photo in an advert, on a product page or in an email.
Two rights to clear
Is the image protected by copyright?
Get a licence from the photographer
Check if copyright has expired
The photographer normally owns copyright in a photograph, even if the customer is the subject. The customer can license their own image rights, but not copyright they do not own. If the photographer is unknown, do not assume the brand can use the image.
What UK copyright law allows
The Copyright, Designs and Patents Act 1988 gives the copyright owner exclusive rights to copy, issue copies and communicate the work to the public. Posting a customer photo on your website or social feed is communication to the public. A licence must come from the owner. Fair dealing exceptions for criticism or review rarely cover commercial marketing.
How UK GDPR applies
An identifiable living person in a photo is personal data. Using it to promote goods or services is a new purpose, so you need a lawful basis. Consent is often the cleanest basis for marketing images because it gives the person control and a right to withdraw. The ICO's UK GDPR guidance explains lawful bases and individual rights.
Special category data can arise if the image reveals health, religion or ethnicity. That needs a separate condition. Children need extra care, so take advice for sensitive images.
Permission routes compared
What it gives you
- Written licence from photographer and subject
- Copyright licence plus data consent
- Verbal permission
- Weak evidence, hard to prove
- Social media tag or public post
- No marketing rights
- Competition terms
- May cover entry, not paid ads
- Agency or influencer contract
- Rights often covered
Main risk
- Written licence from photographer and subject
- Scope must be clear
- Verbal permission
- Withdrawal disputed
- Social media tag or public post
- Copyright and GDPR breach
- Competition terms
- Purpose creep
- Agency or influencer contract
- Check duration and sublicensing
A tag or public profile does not transfer copyright or give a lawful basis for marketing. The safest route is a short written permission that names the image, channels and period. If you plan paid ads, say so in the permission.
Permission routes compared
Route
- Written licence
- Copyright plus data consent
- Verbal permission
- Weak evidence
- Social media tag
- No marketing rights
- Competition terms
- May cover entry only
- Agency contract
- Rights often covered
What it gives you
- Written licence
- Scope must be clear
- Verbal permission
- Withdrawal disputed
- Social media tag
- Copyright and GDPR breach
- Competition terms
- Purpose creep
- Agency contract
- Check duration and sublicensing
Main risk
- Written licence
- Verbal permission
- Social media tag
- Competition terms
- Agency contract
A consent workflow for UK marketers
- Identify every person in the image and ask who took the photo.
- Ask the photographer for a written copyright licence.
- Ask each identifiable person for UK GDPR consent to marketing use.
- State channels, campaign, duration, edits and paid media in one document.
- Store the record with the image and set a review date.
- Offer a simple withdrawal route and act promptly.
A template can cover both permissions in one page. Keep it plain English and avoid blanket wording that lets the brand do anything forever. For more on collecting usable assets, see our guide to ecommerce UGC customer content in the UK.
Advertising rules and disclosure
The CAP Code requires marketing communications to be legal, decent, honest and truthful. If a photo is presented as a testimonial, the claim must reflect the customer's genuine opinion and not mislead. Paid partnerships must be identifiable. The ASA's advertising codes set out these rules.
Records, withdrawal and data rights
Under the Data Protection Act 2018, people can ask for access, correction or erasure of their personal data. If someone withdraws consent, stop using the image in new campaigns and remove it where you can. Tell anyone who received the image to stop. The Act supports UK GDPR compliance.
Keep a log: image file, date, names, permission scope and withdrawal date. That record helps if a complaint reaches the ICO. For video assets, our guide on how to get video reviews from UK customers covers similar consent steps.
This is general guidance, not legal advice. Photo rights and data protection depend on the facts, so individual cases need a qualified adviser.
Common questions
Do I need written permission to use a customer photo?
Yes, in most commercial cases. You need a copyright licence from the photographer and a lawful basis under UK GDPR from each identifiable person. A written record is easier to prove.
Does tagging a brand count as permission?
No. A tag or public post does not transfer copyright or create a lawful basis for marketing. Ask for separate permission before you reuse the image.
Can a customer withdraw consent after publication?
Yes. Consent must be withdrawable. Stop using the image in new campaigns, remove it where practical and tell any third parties who received it.
What if the photo shows other people?
You need permission from every identifiable person, not just the customer who sent it. If anyone is under 16, take extra care and consider parental consent.
