UGC rights in the EU: consent, GDPR and usage terms for brands

Your customers post about you every day. A shopper in Valencia films her new trainers, a runner in Bogotá tags your account after a race, a creator in Madrid reviews your serum without being asked. That content converts better than most studio photography, and it is tempting to drop it straight onto a product page.

Do not. In the EU and most of Latin America, a public post gives you the right to look at it and to share it inside the platform with the native share button. It does not give you the right to download it, put it on your website, or turn it into an ad. This post covers what you actually need, in plain language. It is not legal advice: for a specific campaign, ask your lawyer.

Three separate rights sit on every post

When you reuse a piece of user-generated content (UGC), three different rights can apply at once. Clearing one does not clear the others.

1. Copyright

The person who took the photo or made the video owns the copyright. Under EU copyright law that protection is automatic: no registration, no notice needed. Reproducing the work on your site or in an ad is a use that needs the owner's permission.

The platform's terms do not help you here. When someone posts on Instagram or TikTok, they grant the platform a licence to show the content on that platform. That licence is between the user and the platform. It does not pass to brands.

2. Image rights of the people in the content

If a person can be recognised, they have rights over their own image. In Spain this is the derecho a la propia imagen, protected by Ley Orgánica 1/1982. Using someone's likeness for commercial purposes without consent is the classic case the law was written for. Other EU countries and most of Latin America have equivalent protection, in civil codes or in constitutional rights.

This matters when the creator is not the only person in the frame. A creator can license their own photo, but they cannot consent on behalf of a friend who appears in it.

3. Personal data under GDPR

A photo or video of an identifiable person is personal data. So is the handle, the name and the caption that come with it. Once you download a post, store it and publish it on your own site, you are processing personal data and you need a lawful basis under Article 6 of the GDPR.

For marketing reuse of UGC, the practical basis is consent: freely given, specific, informed and unambiguous. Article 7 adds two things that matter for brands. You must be able to show that consent was given. And the person can withdraw it at any time, as easily as they gave it.

Latin American markets follow similar principles: Brazil's LGPD, Mexico's federal data protection law, Colombia's Ley 1581 de 2012 and Argentina's Ley 25.326 all treat images of identifiable people as personal data and expect a clear basis for processing.

What a usable licence states

A comment saying "sure, go ahead" is better than nothing, but it is weak evidence and it says nothing about scope. A licence you can rely on answers five questions.

Owned channels and paid ads are different permissions

The most common mistake is treating "we can use your post" as one permission. Showing a creator's photo in a gallery on your website is a modest use. Putting money behind it as an ad in front of hundreds of thousands of people is a different use, and creators know it. Many will say yes to the first and want a fee for the second. Our worked calculator for pricing usage rights and exclusivity shows how that fee is usually set.

Ask for paid use separately and explicitly. If you might boost the content later, say so at the start. Widening a licence after the fact means going back to the creator. If the ad will run from the creator's own account, you also need the contract terms for whitelisting and partnership ads.

Write the territory and the term into the terms

If your licence text does not mention territory or duration, a reasonable reading is that you did not limit them, but a creator can just as reasonably argue they never agreed to a worldwide, perpetual use. State it either way. "Worldwide, for 24 months, on our website and our own social accounts" is a sentence nobody can misread.

Disclosure and the influencer codes

Rights are one question, disclosure is another. If a creator was paid or gifted product, the original post must say so, and your reuse should not hide that relationship. In Spain, the Autocontrol and AEA code of conduct on influencers in advertising sets out how to label commercial content. Our EU and Latin America disclosure guide covers the main markets.

Organic UGC that you did not pay for is not an ad when it is posted. It becomes part of your marketing when you put it on your site. Keep the original handle visible and do not edit the content in a way that changes its meaning.

Withdrawal: plan for it

Consent can be withdrawn. Build for that from day one:

• Every licence should have a way for the creator to say "stop".
• When they do, the content should come off your live surfaces quickly, not at the next quarterly clean-up.
• Keep the record of the original grant and of the withdrawal. You may need both.

This is also why spreadsheets and DM screenshots break down at scale. With 20 posts you can track it by hand. With 2,000 posts across three markets, you cannot tell which tiles on your site are still covered.

Minors

Treat posts by or featuring minors as out of scope unless you have consent from a parent or guardian. In Spain, data protection law sets the age of digital consent at 14, but image rights for minors and the reputational risk for the brand make a stricter rule sensible. The simplest policy: if there is any doubt about age, do not request.

How cyrqle handles this

cyrqle's rights pipeline is built around the points above. When you find a post in a UGC collector, you request rights from the post card. cyrqle emails the creator a link to a grant page, or gives you the link to send by DM when there is no email on file. The creator does not need an account. The page shows your brand, the post and your terms, and the creator clicks to allow or decline.

• Terms are yours. You write rights templates in your workspace, in each language you work in. Put the channels, markets and term into the text.
• The grant is recorded. Each licence is stored with its origin, scope and expiry or "perpetual", and appears on the Agreements page with a PDF.
• Withdrawal is real. A creator can return to the same link and withdraw. The post then drops off your content walls on the next render. An expired licence removes the post the same way.
• Paid ads are separate. The standard licence covers owned channels. Boosting a post as an ad needs a separate paid-ads right, agreed with the creator.
• Campaign creators sign once. For paid collaborations, the signed campaign agreement grants content-wall and campaign use, and paid ads only when you ticked that option on the offer.

Walls only serve posts with an active licence, so the rights record and what visitors see stay in step. For a step-by-step version, read our guide to requesting content rights from a creator.

FAQ

Can I repost a customer's photo if they tagged my brand?

Inside the same platform, using its native share or repost feature, generally yes: that is what the platform licence covers. Downloading it and putting it on your website, in email or in an ad is a different use and needs the creator's permission.

Is a hashtag campaign enough consent?

A hashtag campaign can work if the terms are published clearly and people actively choose to take part under them. A hashtag alone, with no terms, is weak evidence of consent for anything beyond the platform. Ask post by post when you want to reuse content outside the platform.

Do I need a separate licence for paid ads?

Yes, in practice. Paid amplification is a materially bigger use than a gallery on your site. Ask for it explicitly, and expect some creators to want a fee.

What happens when a creator withdraws consent?

Stop using the content and remove it from your live surfaces promptly. Keep the record of the original grant and of the withdrawal. In cyrqle, a withdrawn or expired licence removes the post from your walls automatically.

Does GDPR apply to Latin American creators?

GDPR applies when you, the brand, are established in the EU, or when you target people in the EU. Latin American creators are also protected by their own national data protection laws, which follow similar principles. Ask for clear consent either way.