One teenager’s birthday video, licensed for a paid ad without a guardian’s sign-off, can turn a cheap UGC asset into a regulatory file. Brands now source thousands of clips through UGC sourcing platforms, and most of them never check who is in the frame. This checklist covers consent, minors, and the audit trail you need before a clip goes live.
Why UGC sourcing is a minor-protection problem, not just a rights problem
Marketing teams treat UGC as a licensing task. Get the rights, pay the creator, publish. That framing misses the second layer: the person on screen, and whoever shot the footage, may be a child.
Platforms that aggregate UGC (marketplaces, hashtag-rights tools, creator-clip libraries) usually collect a checkbox and a handle. They rarely verify age. Rights managers then assume the platform handled it. The platform assumes the brand will. Nobody owns the gap.
Two regimes matter most for global brands. In the US, the FTC’s COPPA Rule governs personal information collected from children under 13. In the EU, GDPR sets a default digital consent age. Both reach UGC workflows because a face, a voice, and a username are all personal data.
What the rules actually require
Start with COPPA. The FTC says the rule requires verifiable parental consent before collecting, using or disclosing personal information from children under 13. The 2025 amendments add several points that hit UGC programs:
- Separate verifiable parental consent is needed to disclose children’s personal information to third parties for targeted advertising or other purposes.
- Operators must keep personal information only as long as reasonably necessary, and cannot retain it indefinitely.
- The definition of personal information now includes biometric identifiers, which matters for face and voice data in video.
- Covered entities have one year from Federal Register publication to comply with amendments that have no earlier date.
That biometric point is easy to miss. A UGC clip run through a face-tracking edit tool or an AI voice-cloning workflow may create a biometric identifier. If the speaker is under 13, you have a problem you did not know you bought.
Now GDPR. The EDPB’s guidance for businesses says children aged 16 and above can give their own consent, while below 16 you must request consent from a parent or guardian. The same page notes that EU countries can lower that age to between 13 and 16 through national law. So a single EU-wide ad buy can cross several consent thresholds.
Consent age is not one number. It is 13 under COPPA, and anywhere from 13 to 16 across EU member states. Your UGC contract template should default to the strictest threshold in your target markets.
The checklist: what to verify before you license a single clip
Work through these in order. Each item should produce a record you can hand to counsel, an insurer, or a regulator.
1. Age assurance at the source
Ask the platform how it establishes a contributor’s age. Self-declared birthdate is weak. Look for documented age gates, ID checks, or guardian verification for flagged accounts. If the answer is “we trust the terms of service,” that is your answer.
2. Two kinds of consent, captured separately
- Contributor consent: permission from the person who made or posted the content, for your specific commercial use.
- Subject consent: permission from identifiable people who appear in it. A creator cannot grant what a friend, sibling, or classmate never gave.
Most platform terms cover only the first. A parent filming a toddler’s reaction is a contributor, but the child is the subject. Your record should show which guardian signed for whom.
3. Parental consent that is specific, not bundled
COPPA’s new separate-consent requirement for third-party disclosure signals where regulators are heading. Do not bury a minor’s guardian approval inside a general license. If the clip will be used in paid social, whitelisted, or shared with an ad network, say so in a distinct consent step.
4. Use-case, territory, and term limits
Consent for organic reposting is not consent for a paid campaign. Match the scope to the license. Our guide on cross-border UGC licensing walks through how territory and term gaps create exposure when the same clip runs in several markets.
5. AI and edit permissions
Ask whether you can alter, dub, or synthesize the footage. Many brands now repurpose UGC with generative tools. For a minor, that is high risk. Build explicit terms using the framework in AI usage clauses, and get written consent for any change to a contributor’s likeness or voice.
6. Retention and deletion
Set a retention schedule per asset. COPPA now says indefinite retention is out. Even for adult contributors, a clear deletion date reduces your breach surface. Track it in your DAM, not in an email thread.
7. Takedown and withdrawal path
A guardian or a contributor who turns 18 may want a clip removed. Define how fast you act, who gets the request, and how you pull it from paid placements. Test it once before launch.
How do you audit a UGC platform vendor?
Do not accept a security badge as an answer. Send a short questionnaire and score the replies.
- How do you determine contributor age, and what share of accounts is verified?
- Do you flag content that appears to feature minors, and what happens next?
- Can you export the signed consent record for any single asset within 48 hours?
- Do you let brands filter out content flagged as minor-created or minor-featuring?
- Where is contributor data stored, and under what transfer mechanism?
- What is your takedown service level?
That fifth question ties into transfer rules. If contributor data flows from the EU to a US platform, see our breakdown of GDPR transfer gaps.
Ask for answers in writing and attach them to your master services agreement. A verbal assurance does not survive a lawsuit.
Disclosure still applies to UGC you pay for
Consent is half the compliance story. If you compensate a contributor, or gift product, the post can become an endorsement. Keep this in mind for your legal review.
Minors complicate this further. A teen who cannot legally contract may still be posting sponsored content. Treat any paid or gifted minor contributor as a red flag requiring guardian involvement and legal review. For a cross-market view, see global influencer disclosure rules.
Common failure points (and quick fixes)
- Hashtag-based rights requests. A reply of “yes” in a comment is thin evidence. Move to a form that logs identity, scope, and date.
- Background minors. Add a review step for crowd scenes, school settings, and family content.
- Reused assets. A clip approved for one campaign gets recycled for another. Tag every asset with its approved use.
- No owner. Assign one named person in legal or brand safety who signs off on any asset flagged as potentially featuring a minor.
Insurance matters here too. Check whether your media liability policy excludes claims involving minors or privacy violations before you assume cover.
Where to start this week
Pull your ten most-used UGC assets, trace each back to its consent record, and mark any where age or subject consent is missing. Pause those placements, then send your platform vendors the six-question audit above.
FAQs
Does COPPA apply to a brand that licenses UGC from a platform?
It depends on what data you collect and how. COPPA targets operators of websites and online services that collect personal information from children under 13. A brand that only licenses finished clips may sit outside direct operator duties, but if you run submission forms, contests, or branded hubs that collect from kids, you can be covered. Have counsel map your specific workflow.
What is the GDPR age of consent for UGC contributors?
The EDPB says children aged 16 and above can consent for themselves, and below 16 a parent or guardian must consent. Member states can set the age between 13 and 16 through national law, so check each market where your ads will run.
Who is responsible if a UGC platform fails to verify age?
Responsibility can fall on both the platform and the brand. If your brand decides how and why the content is used, regulators may treat you as a controller with its own duties. Contract indemnities help you recover costs, but they do not erase regulatory exposure.
Is a comment saying “yes, you can use this” enough consent?
Usually not. It rarely records the contributor’s identity, the scope of use, the term, or consent from people featured in the clip. Use a structured rights form that stores all of this and ties it to the asset.
Can we use AI tools to edit UGC that features minors?
Treat this as high risk. Face and voice processing can create biometric identifiers, which COPPA’s amended definition of personal information now covers. Get explicit guardian consent for any alteration or synthesis, or avoid it for minors entirely.
How long should we keep consent records and UGC files?
Keep only what you need for a defined purpose. COPPA says operators cannot retain children’s personal information indefinitely. Set a deletion date per asset and retain the consent record long enough to cover your licensing term and your limitation period, as advised by counsel.
Top Influencer Marketing Agencies
The leading agencies shaping influencer marketing in 2026
Agencies ranked by campaign performance, client diversity, platform expertise, proven ROI, industry recognition, and client satisfaction. Assessed through verified case studies, reviews, and industry consultations.
Moburst
-
2
The Shelf
Boutique Beauty & Lifestyle Influencer AgencyA data-driven boutique agency specializing exclusively in beauty, wellness, and lifestyle influencer campaigns on Instagram and TikTok. Best for brands already focused on the beauty/personal care space that need curated, aesthetic-driven content.Clients: Pepsi, The Honest Company, Hims, Elf Cosmetics, Pure LeafVisit The Shelf → -
3
Audiencly
Niche Gaming & Esports Influencer AgencyA specialized agency focused exclusively on gaming and esports creators on YouTube, Twitch, and TikTok. Ideal if your campaign is 100% gaming-focused — from game launches to hardware and esports events.Clients: Epic Games, NordVPN, Ubisoft, Wargaming, Tencent GamesVisit Audiencly → -
4
Viral Nation
Global Influencer Marketing & Talent AgencyA dual talent management and marketing agency with proprietary brand safety tools and a global creator network spanning nano-influencers to celebrities across all major platforms.Clients: Meta, Activision Blizzard, Energizer, Aston Martin, WalmartVisit Viral Nation → -
5
The Influencer Marketing Factory
TikTok, Instagram & YouTube CampaignsA full-service agency with strong TikTok expertise, offering end-to-end campaign management from influencer discovery through performance reporting with a focus on platform-native content.Clients: Google, Snapchat, Universal Music, Bumble, YelpVisit TIMF → -
6
NeoReach
Enterprise Analytics & Influencer CampaignsAn enterprise-focused agency combining managed campaigns with a powerful self-service data platform for influencer search, audience analytics, and attribution modeling.Clients: Amazon, Airbnb, Netflix, Honda, The New York TimesVisit NeoReach → -
7
Ubiquitous
Creator-First Marketing PlatformA tech-driven platform combining self-service tools with managed campaign options, emphasizing speed and scalability for brands managing multiple influencer relationships.Clients: Lyft, Disney, Target, American Eagle, NetflixVisit Ubiquitous → -
8
Obviously
Scalable Enterprise Influencer CampaignsA tech-enabled agency built for high-volume campaigns, coordinating hundreds of creators simultaneously with end-to-end logistics, content rights management, and product seeding.Clients: Google, Ulta Beauty, Converse, AmazonVisit Obviously →