A customer tags you in a great photo of their meal, their new deck or their kid’s first surf lesson. The share button is right there. Most businesses tap it and move on, and most of the time nothing happens.
The problem is the times something does. The person who took a photo owns the copyright in it, not the business in the photo and not the person who tagged you. Being tagged isn’t permission. Instagram’s terms give Instagram a licence to display what people post; they don’t hand that licence on to you. Reposting to your Story inside the app is low risk because it links back to the original. Downloading the image and putting it in your feed, on your website or in an ad is a different thing entirely.
The fix is not complicated. Ask, credit, and keep a record.
Ask first, every time, in writing
A comment or DM is enough for most social reposts. It needs to say what you want to use, where, and how you’ll credit them. Vague asks get vague yeses that people later forget giving.
What we see businesses send, and what we’d send instead:
Too vague:
Love this! Mind if we share?
Better:
This looks brilliant, thanks for tagging us. Would you be happy for us to share this photo on our Instagram and Facebook pages? We’ll credit you as @yourhandle. Just reply “yes” if that’s OK.
If you want it for more than social:
We’d love to use this photo on our website and in a printed flyer too. We’d credit you by name where there’s room. Is that OK with you? No worries at all if not.
The “no worries if not” matters. It makes it easy to decline, which means a yes is a real yes. Ask for a reply in words. A heart reaction on your message is not a record of consent.
Ask each time you want to use something new, and ask again if you want to use it somewhere you didn’t mention. Permission for an Instagram post doesn’t cover a paid ad, a billboard or a brochure.
Credit properly
Credit is not a substitute for permission. It’s the second half of it.
- On Instagram and Facebook, tag the account in the image and name them in the caption (“Photo: @handle”).
- On your website, put a short credit under the image or in the caption field (“Photo by Jess M., used with permission”).
- In print, a small credit line near the image is fine if they’ve asked for one.
Some people would rather not be named, particularly in reviews or testimonials. Ask how they’d like to be credited and do what they say.
Photos with people in them
A photo of food or a finished bathroom is one thing. A photo with people in it raises two extra questions: did the photographer get permission from those people, and are they comfortable being on your business page?
If a customer sends a group shot from their birthday dinner, the customer can say yes for themselves, but they can’t really speak for six friends. For a feed post, we’d either crop to the plates or ask the customer to check with the group. For an ad, we’d skip it unless everyone identifiable is happy.
Australia doesn’t have a general “image right” the way some countries do, and taking photos in public is broadly legal. That doesn’t make every use comfortable or sensible. Using someone’s face to sell your product without asking can still create problems under consumer law (it can imply an endorsement they never gave) and it can definitely create problems with your customers. Privacy law in Australia is also changing, so treat this as general information, not legal advice. The Australian Copyright Council has plain-English information sheets on photographs and ownership if you want the detail.
Kids are a different category
Our rule is simple: don’t repost photos of other people’s children unless the parent or guardian has said yes to that specific photo being used in that specific place. And even then, think about it.
A few practical habits:
- Don’t name children, and don’t tag their accounts if they have one.
- Avoid anything that shows a school uniform, a school name, a home address or a car number plate.
- Avoid swimwear and bath time shots entirely, no matter how cute or how harmless the parent says it is.
- If a child in the background of a photo isn’t the customer’s child, crop or blur them, or don’t use it.
Swim schools, surf schools, kids’ sport and childcare need a written photo policy, signed at enrolment, with a clear opt-out. The eSafety Commissioner has guidance for parents and organisations about sharing images of children online, and it’s worth reading before you write your own policy.
Staff are customers of a kind too
The same rules apply to your own team. A staff member agreeing to be in a photo at work isn’t the same as agreeing to be in your ads for the next three years. Add a line to your onboarding paperwork asking whether they’re happy to appear in marketing, and respect a change of mind when someone leaves. Take their face out of the homepage hero image within a reasonable time.
Keep a record you can find
If someone asks you to take a photo down, or a staff member who handled the DMs leaves, you need to be able to see who said yes to what. Screenshots buried in someone’s phone don’t count.
A simple spreadsheet is enough. One row per piece of content:
| Column | Example |
|---|---|
| Date asked | 3 March |
| Who | Jess M., @handle |
| What | Photo of the Moreton Bay bug special |
| Where they agreed | Instagram, Facebook, website |
| How they want credit | @handle |
| Proof | Screenshot saved in /Permissions/2027 |
| Expires or notes | Remove if requested |
Save the screenshot of the “yes” in a shared folder named for the year. It takes about 30 seconds per photo, and it turns “I think they said it was fine” into an answer.
When someone asks you to take it down
Do it, promptly, and say thanks. Don’t argue about whether they agreed six months ago. Remove it from the feed, the website and any scheduled posts, and note the date in your spreadsheet. Being gracious about a takedown costs nothing and protects you far more than any permission screenshot.
Content for giveaways and campaigns
If you’re running a competition that asks people to post photos, your terms need to say what you’ll do with the entries, including whether you can reuse them. That’s covered in our guide to running an Instagram giveaway in Australia. The same thinking applies to photos you pull into Google Business Profile updates: Google is just another place you’re publishing, so make sure your permission covers it.
A five-minute setup for this week
- Save the two message templates above in your phone’s notes or Meta Business Suite saved replies.
- Make the permissions spreadsheet and a shared screenshot folder.
- Write one paragraph of photo policy for staff and, if you work with kids, for enrolment forms.
- Go back through your last 20 feed posts and check every customer photo has a “yes” behind it.
Customer content works best when it fills gaps around your own photos rather than replacing them. If your feed is running on other people’s pictures because you don’t have any of your own, a half-day of commercial photography will give you a library you own outright. And if keeping on top of the asking, crediting and logging is the bit that never gets done, it’s part of what our social media management team handles day to day.