Tagging You Is Not Permission to Use Their Photo

A customer posts a photo of your shop front, your biryani, your installed water purifier. They tag you. It is a lovely photo — better than anything your own camera roll holds. You save it, crop it, put your logo in the corner and run it as an ad for three weeks.

You almost certainly did not have the right to do that. Nothing bad may happen. Something bad occasionally does, and when it does it arrives as a legal notice, a platform strike, or a public post that says this brand stole my picture — which costs more than the photo was worth.

This piece is about the boring part of user-generated content, meaning photos, videos, reviews and posts made by your customers rather than by you. Not whether to use it — you should, it works, it is cheap and it is believable. The part nobody explains is how to ask, what the yes is worth, and where it runs out. None of this is legal advice; for anything going on packaging, a hoarding or a TV spot, pay a lawyer for an hour.

What a tag actually gives you

In Indian law, copyright in a photograph or video sits with the person who made it — the photographer — from the moment it is taken. It is automatic. There is no registration requirement for the right to exist. The person who made it does not have to mark it, watermark it or say anything.

That gives you three uncomfortable consequences:

• Tagging you is not a licence. It is a reference. A customer pointing at you is not a customer handing you their work.
• Posting with your hashtag is not a licence either — unless you published clear terms saying what the hashtag means, and it is reasonable to say they accepted them. A hashtag on its own is a label, not a contract.
• Instagram's terms give Instagram a licence, not you. When somebody uploads, they grant the platform broad rights to host and display the content. You are not the platform. Resharing inside the app — the native repost or share-to-story function — operates inside that platform licence and keeps the original attribution attached. Downloading the file and putting it in an ad does not.

There is one more thing people get backwards. Being in the photo does not make it yours. If a customer photographs your product, you own the product and they own the photograph. If your staff photographer shoots a customer, you have the copyright and the customer has something else entirely — which is the next problem.

Two permissions, not one

Almost every mess I have seen comes from getting one permission and assuming it covered both.

Permission one is copyright — from whoever pressed the shutter. Permission two is from the identifiable people in the frame, about the use of their face, name and likeness in your commercial messaging. These are different people often enough to matter: the husband took the photo, the wife is in it, the child is in it too.

India has no single personality-rights statute. Courts have dealt with unauthorised commercial use of a person's image and name through privacy and passing-off reasoning, and the direction of travel has been protective of the individual. For practical purposes, treat it like this: using a recognisable person's face to sell something, without their agreement, is a risk you take knowingly, not a grey area you can plead ignorance of.

Two groups need extra care. Children — get the parent's agreement in writing, named, and do not run a child's face in a paid ad on a casual DM reply. Your own staff — a team photo on the careers page is fine while they work for you; think about what happens when they leave, and agree now that you will take it down if they ask.

How to ask so the yes is usable

Most people say yes. They are flattered. The reason to do it properly is not that they will refuse — it is that a vague yes collapses the moment you want to do something ambitious with the asset.

A usable permission names five things. Send them in the message, in plain words, so the reply "yes, go ahead" is attached to something specific:

1. Where. Our Instagram and Facebook pages, our website, and paid ads on those platforms. Say "paid ads" out loud. People hear "share" and mean organic; they feel differently about their face in a sponsored post.
2. How long. "For two years" or "until you ask us to stop". Indefinite and unlimited reads as greedy and gets refused more often than a bounded ask.
3. What you may change. Crop, colour-correct, add our logo, add text over it, cut the video shorter. If you are going to put a price promise across their face, say so.
4. Credit. Will you tag their handle, use their first name, or neither? Ask which they prefer. Some customers very much do not want their handle on an advert.
5. That they made it and nobody else is in it. One line: "Can you confirm you took this yourself and anyone recognisable in it is happy for us to use it?" This does not make you bulletproof, but it moves you from careless to reasonable, which is most of the distance.

A short DM that covers all five:

Hi — we loved this photo. Would you be happy for us to use it on our Instagram and Facebook pages, our website, and in paid ads on those platforms for the next two years? We'd crop it and add our logo, and we'd credit you as @yourhandle unless you'd rather we didn't. Could you confirm you took the photo yourself and that anyone recognisable in it is fine with this? A simple "yes" here is enough for us.

Then screenshot the whole thread — their handle, the date, their reply, visible in one image. That screenshot is your evidence. DMs vanish when accounts are deleted.

"Credit to owner, DM for removal" is not a permission system. It is an admission that you did not ask. Crediting a photographer you did not get permission from puts their name on an infringement. It helps with goodwill and does nothing for your position.

Contests, hashtags and paid creators

If you run a photo contest, the terms are the licence. Publish them on a page on your own site — not in a caption that scrolls away — and link to that page from every post about the contest. Say plainly what rights entrants grant for entries, and whether winners grant more than non-winners. Keep it proportionate: asking for perpetual worldwide rights to every entry in exchange for a ₹2,000 hamper reads badly and invites the screenshot.

Also decide what happens to the photos after the contest. Most brands quietly keep using them for years. If that is your plan, the terms should say so.

Paid creators are a different animal and the mistake is treating them as customers. If you have paid a creator in cash, product, or a discount in exchange for a post, that is an endorsement. The Department of Consumer Affairs' 2022 guidelines on misleading advertisements and endorsements, and the Advertising Standards Council of India's influencer guidelines, both require that a material connection be disclosed clearly — in the post itself, not buried in a hashtag heap, and in a way a reasonable viewer will actually notice. Vague tags like #collab or #sp do not do the job. The responsibility is not only the creator's; as the advertiser, it is yours too.

And the reverse: do not present paid creator content as spontaneous customer enthusiasm. That is the thing the guidelines exist to stop, and it is also the thing audiences are best at detecting.

The music trap and other small print

Here is the one that catches good agencies. A customer sends you a brilliant fifteen-second reel with a trending Hindi track on it. You get full permission from the customer. You put it in a paid ad. You now have a music licensing problem that the customer could never have solved for you, because the track is licensed for use within the platform's library, by individuals, in organic posts — not for a brand's advertising.

The fix is dull and reliable: strip the audio, use a track from a commercial library your business has licensed, or keep the original ambient sound. If the video only works with that song, it is not a video you can advertise with.

Related small print worth a minute:

• Visible third-party brands. A competitor's logo, a film poster, a cricket jersey in the background. Usually harmless in an organic post; avoid it in a paid one.
• Location. Shots inside somebody else's premises — a mall, a hotel, an airport — can carry their own restrictions.
• Reviews and testimonials. Quoting a Google or Zomato review verbatim with the reviewer's displayed first name is low-risk and normal. Editing it so it says something the person did not say is not. Never stitch a positive sentence out of a mixed review.
• Platform-to-platform. Permission for Instagram is not permission for a hoarding in Laxmi Nagar, a Diwali mailer, or the hero banner of your new site.

What I would not buy

Three things get sold in this category that do not earn their money for a business your size.

Enterprise rights-management software. There are genuinely good tools that send automated permission requests, log the reply and store the asset with its licence attached. They are built for brands handling thousands of submissions a month. If you collect fifteen, you are paying a subscription to replace a spreadsheet and a folder.

Hashtag scraping as a content service. If an agency offers to "source UGC" and the method is bulk-downloading everything on your hashtag, you are buying a pile of files with no provenance and no permission, and you are the one whose name is on the ad. Ask them to show you the permission record for any three assets. The answer tells you everything.

"We'll take it down if anyone objects." This is a real policy that real agencies operate, and I understand the maths — most people never notice. But the downside is not symmetric. A copyright complaint against your page can cost you the page, and an angry post about a brand using someone's family photo travels further than anything you were going to publish that month. You are saving ten minutes of DMs.

Be honest about enforcement too. Most unauthorised reposting in India produces no consequence at all. I am not going to tell you otherwise. The argument for doing it properly is that the cost of asking is ten minutes and the cost of the rare bad outcome is disproportionate — and that asking tends to produce more content, because people who get asked send you more.

A filing system that survives

One folder per year on your shared drive. Inside it, one folder per contributor, named with their handle. In each: the original file, the permission screenshot, and nothing else. Plus one spreadsheet with six columns.

Two rules keep it alive. The person who gets the permission fills the row the same day. And if there is no row, the asset does not get used — no exceptions for the one that would do really well this weekend.

Finally, honour withdrawals immediately and without argument, even inside a valid licence. Someone's circumstances change; a photo of their face is suddenly a problem for reasons that are none of your business. Take it down within a day, confirm that you have, and do not ask why. Keeping that promise is the reason the next customer says yes.

What to do this week

Open your last three months of posts and ads. Find every asset you did not shoot yourself. For each one, ask whether you could produce a screenshot of someone saying yes. Where you cannot, you have two choices — go back and ask now, which usually works and sometimes starts a nice conversation, or retire the asset.

Then write the five-line DM once, save it where your team can reach it, and make it the only way anybody asks. If you want help building the request flow into how your social media is actually run each month, or getting customer photos and testimonials onto your site with the permissions recorded alongside them as part of a website build, tell us what you are sitting on and we will tell you what is usable.

Questions we get asked