How to Collect User-Generated Content on Instagram

To collect user-generated content on Instagram, find the posts where customers tagged or mentioned you, ask each person in writing for permission to reuse the content, record what they agreed to, then publish it. Instagram’s API exposes tagged and mentioned media, and a keyword-triggered DM can deliver the rights request within seconds of the post going live.

Most brands get the first part right and skip the rest. A customer posts a photo of your product, tags you, and the photo sits in your notifications until someone screenshots it and drops it into an ad. That screenshot is an unlicensed copy of a photograph you do not own, running in paid media, with no record of consent anywhere.

This guide covers where Instagram keeps the content you are allowed to collect, how to request rights in a DM without killing the goodwill, what the FTC requires when you offer to feature someone, how to store permissions so you can prove them a year later, and which tools handle each part of the job.

Key Takeaways

• Tagging you is not a license: the person who took the photo owns the copyright, and a tag, a hashtag entry, or a public account grants a brand nothing
• Instagram exposes the source content through its API: GET /{ig-user-id}/tags returns media your account was tagged in, and the mentions webhook fires when someone @mentions you in a comment or caption (developers.facebook.com, August 2026)
• A DM is the fastest place to ask: the request reaches the person while they still care about the post, and their reply is the written record
• Offering to feature someone counts as an incentive: the FTC lists “the possibility of appearing in other media promotions” as a material connection that has to be disclosed (16 CFR 255.5, ecfr.gov, August 2026)
• The permission has to be specific: name the channels, the time period, and whether paid ads are included, because “yes go ahead” covers none of that
• Shoppers act on it: 74% of shoppers say they trust user-generated content more than brand-created content on product pages, and 55% say they are unlikely to buy without it (Bazaarvoice Shopper Experience Index, 7,000+ consumers surveyed by Savanta, November 2023)
• Best first move: pick one keyword, run one rights-request DM on your next product post, and log every yes in a spreadsheet before you buy any software

What Counts as User-Generated Content

User-generated content is any photo, video, review, comment, or Story that a customer created about your product, rather than your team creating it. On Instagram it arrives in five places: feed posts and Reels that tag your account, Stories that mention you, comments on your own posts, replies in your DMs, and posts carrying your branded hashtag.

The distinction that matters for collection is ownership. Content you commissioned from a paid creator comes with a contract, and the terms in that contract are set by the brief you send before the shoot. Content a customer made on their own comes with nothing, and it is the second kind that fills your notifications.

Reviews sit in the same category. Klaviyo’s UGC tracking product treats reviews, customer photos, and social engagement as one pool and attaches each piece to the customer profile that produced it, so a reviewer, a photo contributor, and a commenter can each trigger a different follow-up (klaviyo.com, August 2026). That model is worth copying whatever software you use. Content and the person who made it belong on the same record. Which channels actually carry that identity, and which arrive anonymous, is covered in our breakdown of what UGC tracking can and cannot measure.

Where Instagram Keeps the Content You Can Collect

Meta’s Instagram Platform exposes the two surfaces that matter, and knowing which is which saves you from manual scrolling.

Tagged media. GET /{ig-user-id}/tags returns a list of media objects in which another Instagram user tagged your professional account. Private media is never returned (developers.facebook.com, March 2025). This is your standing library of customer posts, and it is queryable rather than something you have to catch in the moment.

Mentions. The mentions webhook notifies your app when an Instagram user @mentions your account in a comment or a caption on media you do not own. Meta’s documentation notes that the account which owns the media must be public for comment and @mention notifications to fire, and that comment notifications require Advanced Access (developers.facebook.com, March 2026). Mentions are real-time, so they are the trigger to act on.

Two things sit outside those endpoints. Stories that mention you appear in your notifications and expire in 24 hours, so they need to be saved on the day. Branded-hashtag posts do not tag you at all, which means finding them is a search job rather than an API job.

There is also a native option worth knowing about. Instagram launched reposts globally in August 2025. You can repost public Reels and feed posts, the repost is credited to the original poster, and it lands in a separate tab on your profile (about.fb.com, August 2025). That is a legitimate way to amplify a customer’s post inside Instagram. It grants you no right to use the photo anywhere else.

Why a Tag Is Not Permission

The person who pressed the shutter owns the copyright in the photograph. Tagging your brand, entering your hashtag, or keeping their account public transfers no commercial license to you. Reposting to your Story with credit is a norm the platform tolerates. Cutting the same photo into a Meta ad, a product page, or an email is a different act with a different exposure.

US copyright law allows statutory damages up to $150,000 per work where a court finds the infringement willful (17 U.S.C. 504(c)(2)). Very few customers sue their favorite brand. The realistic risk is smaller and more common: a takedown demand mid-campaign, a public complaint under the post, or an agency refusing to run creative you cannot document rights for.

Three habits cause almost all of it:

• Treating a hashtag entry as a license, when hashtag campaigns need terms the entrant can actually read
• Using content in paid ads when the person only agreed to an organic post
• Editing beyond what was agreed, including crops that remove a watermark, added text, or music swapped into a Reel

Ask before you publish. The ask is short, and it doubles as the record.

How to Request Rights in a DM

The DM is the right channel because it reaches the person while the post is still fresh to them, and because their reply is written evidence attached to a named account.

A rights request needs four elements. Anything less leaves you guessing later.

1. Say what you want to use. Point at the specific post, not “your content”.
2. Say where it will appear. Instagram and email is a different ask from paid social.
3. Say how long. Twelve months is easy to grant and easy to renew. Perpetual makes people hesitate.
4. Ask for a clear yes. One word they have to type, so the reply is unambiguous.

A version that works:

Hi Maya, your shot of the olive tote from Tuesday is beautiful. Would you let us use that photo on our Instagram, our website, and our email for the next 12 months? We will credit @yourhandle every time. Reply YES to agree, and we will send you the discount code as a thank you.

Every clause there is doing a job. The specific post removes ambiguity. The three channels are the license scope. Twelve months is the term. YES is the record.

You can run the same request as an automation instead of by hand. Set a keyword on the post that invites people to send in their photos, and the trigger word starts the conversation the moment they use it. Our complete guide to Instagram DM automation covers the setup, and the ambassador enrollment workflow shows the same mechanic used to sign people up rather than to license a single post.

Featuring Someone Is an Incentive Under FTC Rules

This is the part most UGC guides leave out, and it changes how the last line of your DM should read.

The FTC’s Endorsement Guides say a material connection between the endorser and the seller must be disclosed clearly and conspicuously when the audience would not reasonably expect it. The rule lists what counts, and the list is broader than cash: “monetary payment or the provision of free or discounted products (including products unrelated to the endorsed product) to an endorser, regardless of whether the advertiser requires an endorsement in return”, plus other benefits such as “early access to a product or the possibility of being paid, of winning a prize, or of appearing on television or in other media promotions” (16 CFR 255.5, ecfr.gov, August 2026).

Read the last clause again. The possibility of appearing in a brand’s media promotions is itself a material connection. So is the discount code in the example above, and so is the free product that produced the photo in the first place.

Two practical consequences:

• If you gave the person the product, sent a discount, or ran a contest, the resulting post needs a disclosure. The customer adds it to their post. You cannot add it for them after the fact.
• A platform label is not enough on its own. Instagram’s paid partnership tag supplements a disclosure in the creator’s own words rather than replacing it.

Handling it costs one extra sentence in the DM: “If you post about it again, please add #ad so it is clear we sent you the product.” That sentence protects the brand, not the customer, and brands that skip it are the ones the FTC writes to.

How to Store Rights So You Can Prove Them Later

The reply in your inbox is worthless the day the person who ran the account leaves, or the day Instagram’s message history stops going back that far. Move every yes into a record you control on the day it arrives.

A rights log needs seven columns:

Time-bound grants beat perpetual ones for most teams, because a 12-month ask gets said yes to more often and a renewal is a warm conversation rather than a cold one. Set a reminder 30 days before each expiry.

Where the log lives matters less than whether it exists. A spreadsheet is fine at 20 pieces of content. Past a few hundred, the constraint becomes the link between the content and the customer record, which is exactly the problem the CRM tools solve. Our guide to running Instagram as a CRM covers the point where a spreadsheet stops holding.

Where to Use UGC Once You Have the Rights

Put the content where a purchase decision is being made, not only where it will be liked.

• Product pages. Bazaarvoice’s Shopper Experience Index Volume 17 measured shoppers who interacted with on-site UGC: reviews lifted conversion 144% and revenue per visitor 162%, and on-site photo galleries lifted conversion 127% and revenue per visitor 145% (Bazaarvoice, 2023).
• Paid social. Only with explicit paid rights in the log. This is the use that gets brands in trouble.
• Email. A customer photo in the hero slot of a launch email outperforms a studio shot for most catalogue brands, and it costs nothing to produce.
• Your own Instagram. Native reposts credit the original poster automatically (about.fb.com, August 2025), so the amplification path inside the app needs no extra tooling.
• Retention flows. A customer who submitted a photo is a customer worth a different follow-up from one who never did.

The reason to bother is on the demand side. In the Bazaarvoice survey of more than 7,000 shoppers, 74% said they trust user-generated content more than brand-created content on product description pages, 78% said UGC makes them more confident in a purchase, and 55% said they are unlikely to buy a product without shopper content to inform the decision (Bazaarvoice Shopper Experience Index, conducted by Savanta, November 2023). Which formats survive a shopper’s scrutiny once you publish them is ranked in our guide to Instagram social proof.

UGC Collection Tools Compared

Four categories of tool touch this job, and they solve different halves of it. Pricing and features verified at the dates shown.

Two notes on choosing. If your bottleneck is asking, a DM tool is the whole answer and a CRM is more than you need. If your bottleneck is that nobody can find the approved photo, the library and the profile schema are what you are paying for. We wrote a longer read on what Klaviyo’s social product actually ships if that is the direction you are weighing.

The Workflow, Start to Finish

Seven steps, in order, repeatable weekly.

1. Post something that invites content, and name the keyword in the caption
2. Pull tagged media through the API or your tool, and catch mentions as they fire
3. Save Story mentions the same day, before the 24-hour window closes
4. Send the rights-request DM within a day of the post going up
5. Log the yes: handle, URL, channels, term, screenshot
6. Publish only inside the granted scope
7. Diary the expiry, and renew before it lapses

Steps 1, 2, and 4 are the ones worth automating. Steps 5 and 7 are the ones that save you later.

FAQ

How do I collect user-generated content on Instagram?

Pull the posts your account was tagged in through GET /{ig-user-id}/tags, subscribe to the mentions webhook so @mentions reach you in real time, then send each person a DM asking for permission to reuse the specific post. Record their reply, the channels they agreed to, and the term. Publish only within what they granted.

Do I need permission to repost user-generated content?

Yes, for anything beyond a native repost inside Instagram. The person who created the photo or video holds the copyright, and a tag, a hashtag entry, or a public profile grants no license. Get a written yes that names the channels and the time period before the content appears on your site, in an email, or in an ad.

Can I use a customer’s Instagram photo in a paid ad?

Only if they agreed to paid advertising specifically. Permission to post something to your feed does not extend to Meta ads, and paid use is where brands most often exceed what was granted. Ask for ad rights explicitly, and log the answer separately from organic permission.

What should a UGC rights request DM say?

Name the exact post, list the channels the content will appear on, state how long the permission runs, and ask for a one-word reply so the yes is unambiguous. Add a line asking the person to disclose with #ad if you gave them the product, a discount, or a contest entry.

Does the FTC require disclosure on user-generated content?

It requires disclosure whenever a material connection exists between the person and the brand that the audience would not expect. The Endorsement Guides count free or discounted products, prizes, early access, and the possibility of appearing in a brand’s media promotions as material connections (16 CFR 255.5, ecfr.gov, August 2026). A customer who bought the product with their own money and posted unprompted has nothing to disclose.

How long should UGC usage rights last?

Twelve months suits most brands. It is short enough that people grant it without hesitation, long enough to cover a full campaign cycle, and it forces a review before content ages out of your brand look. Diary the expiry when you log the grant, and ask for a renewal 30 days out.

Where do I store UGC permissions?

Outside Instagram, in something you control. At minimum, a spreadsheet holding the handle, the post URL, the grant date, the channels agreed, the expiry, and a screenshot of the reply. Message history is not a rights record, because access to it disappears with the account or the staff member who owns it.

Can I automate the UGC permission request?

The request itself, yes. A keyword on the post can trigger the DM that carries your rights request within seconds, which is when the person is most likely to reply. The decision about scope and the log entry stay manual, because those are the parts you may have to defend.

Where to Start

Do not buy software this week. Pick one product post, name one keyword in the caption, and send the rights-request DM by hand to everyone who uses it. Twenty conversations will teach you what people say yes to, what term they hesitate over, and how many of your customers were waiting to be asked.

Once the ask is proven, the trigger is the part to automate, because speed is what turns a maybe into a yes. CreatorFlow is a Meta Tech Provider (since December 2025) built for that job on Instagram: comment, Story reply, and keyword triggers that send the message instantly, click tracking on the link inside it, and CSV export of everyone who replied. Pro is $15 a month flat, so the bill does not move when the content starts arriving. For the wider picture of turning Instagram engagement into something you own, our guide to collecting email addresses through Instagram DMs covers the capture side, and the DTC Instagram strategy guide puts customer content in the context of a full storefront funnel.

Instagram API behavior verified from developers.facebook.com as of August 2026. Repost feature details from about.fb.com, August 2025. FTC Endorsement Guides quoted from 16 CFR Part 255 at ecfr.gov, August 2026. Klaviyo product details verified from klaviyo.com, August 2026. EmbedSocial pricing verified from embedsocial.com/pricing, August 2026. ManyChat pricing verified from manychat.com, July 2026. Bazaarvoice figures from the Shopper Experience Index, 2023 and 2024. This article is not legal advice. Individual results vary.