The UGC Rights & Compliance Handbook: Permissions, Licensing & FTC/ASA at Scale

Two obligations sit on every reused asset. The first is rights: documented consent for a specific use, with a clear scope and an expiry. The second is compliance: the disclosure rules under bodies like the FTC and the ASA, and the tighter claim limits that apply when the category is regulated. Both are manageable at scale, but only if they are built into the flow rather than bolted on at the end. The goal is a system where a missing permission or an out-of-scope claim cannot reach a live surface, because the workflow will not let it.

The request-to-expiry workflow

Every customer asset should move through the same four states, with a record created at each transition, so that at any moment you can answer what is live, what it is cleared for, and when that clearance ends. Run from a single workflow, this is what lets a small team manage rights across thousands of assets without a permission slipping through. The flow below is the spine of the whole programme.

Which rights each use actually needs

The most common compliance failure is scope creep: content cleared for one use quietly migrating to another that the customer never agreed to. A permission for an organic repost is not a permission for a paid ad, and neither covers putting the customer's face on an in-store screen. The table maps the common use cases to the rights they actually require, so the request asks for the right scope up front rather than forcing a re-request later.

Disclosure and claims in regulated categories

Rights clear the use of the content. They do not clear what the content says. The moment a brand republishes a customer testimonial, that testimonial reads as a claim the brand is making, and in regulated categories that distinction carries real consequences. A skincare customer saying a product "cleared my acne" is, once you put it on the PDP, a brand making a treatment claim. A finance customer describing a return is, republished, a brand making a performance claim. Bodies like the FTC and the ASA also require that material connections, incentives, gifts, affiliate relationships, are disclosed clearly and unambiguously. Route claim language and disclosure through a category-aware review before any regulated-vertical asset goes live.

• Disclosure. Material connections (paid, gifted, affiliate) must be disclosed clearly under FTC endorsement guides and ASA / CAP rules. "Ad" or an equivalent, where the audience can actually see it.
• Cosmetic versus medical. In beauty and health, keep republished language to appearance and feel, not diagnosis, cure or treatment. A republished cure claim is a brand cure claim.
• Financial and performance. In finance and similar, performance and outcome claims carry their own disclosure and substantiation rules. A testimonial does not exempt the brand from them.
• Territory matters. Disclosure and claim rules differ by market: the ASA in the UK and the FTC in the US are not identical, so scope review to where the asset will run.

The 30-60-90 day plan

Moving from goodwill to compliance by design is a sequenced build. This is the cadence that replaces memory with a workflow, then makes a missed permission or an out-of-scope claim structurally impossible.

Compliance by design, not by diligence

Human diligence does not scale, and it fails at exactly the wrong moment: the rushed campaign, the new hire, the asset reused in a hurry. The durable answer is structural. Enforce the rules in the workflow so a non-compliant asset cannot reach a live surface: no documented consent means no publish, an expired licence means an automatic pull, a regulated-category asset means a mandatory claims-review gate. Built this way, the audit trail is a by-product of the process rather than a thing someone has to remember to maintain, and the question from legal or a regulator has an answer ready before it is asked.