Stock photography and the invoice that arrives later

Stock photo licence risk is the chance that an image on your site, app or ad was never licensed for the way you're using it — and that someone invoices you for it years later. Enforcement letters typically land two to five years after publication, when the receipt and the account it was bought under are long gone.

Key Takeaways

A stock image is only safe when the licence on file matches how you actually use it, on every channel you use it on. Most disputes come from editorial images used commercially, standard royalty-free assets pushed onto merchandise, and Creative Commons files whose uploader never owned them.

• Paying for a download is not the same as holding the right licence for your use.
• Editorial-use images are for news and commentary, not product pages or ad campaigns.
• Standard royalty-free licences often exclude merchandise, templates and large print runs.
• Licences bought on a designer's personal account belong to the designer, not your company.
• Claims arrive years later because enforcement is retrospective crawling, not real-time checking.
• A one-page licence register — source, licence type, licensee, receipt — defeats most claims.
• Replacing an image takes an hour. Rebuilding a page after a takedown takes a week.

What is stock photo licence risk, exactly?

Every stock image ships with a licence that defines who may use it, where, for how long, and in what context. Infringement happens when your actual use falls outside those terms, even if you paid. The download price is irrelevant; the exposure is the retroactive claim, the takedown, and the redesign afterwards.

Most people think the risk sits with whoever downloaded the file. In practice it sits with the publisher — the business whose domain, app store listing or ad account carried the image. If your brand is on the page, your company is the defendant, no matter which freelancer picked the photo.

Why does the claim land years after publication?

Enforcement agencies crawl the web continuously and match images against the catalogues they represent. They work backwards: find the image, identify the domain owner, then check whether a licence was ever issued for that use. Because the crawl is retrospective, a photo published in 2023 can produce a letter in 2026.

The delay is structural, not accidental. Rights holders sign agencies on commission, so there's no incentive to chase a single small use immediately. Instead they batch discoveries and send letters in waves. By then your site may have been redesigned twice, the freelancer has moved on, and nobody can produce a receipt.

Which image licences carry the most risk?

Licences differ in who may use the asset, how many copies may exist, and in what context. The three that generate most disputes are editorial-only images used commercially, standard royalty-free files pushed onto merchandise or templates, and Creative Commons images whose uploader never held the rights to grant.

Licence type	What it usually allows	Where it bites you
Standard royalty-free	Web, social and modest print use by one licensee	Merchandise, templates and large print runs are often excluded
Extended royalty-free	Resale products, templates and bigger print runs	Costs more, and must be bought before the use, not after
Rights-managed	A specific use, territory and duration	Every new channel or extra year is a separate fee
Editorial use only	News reporting, commentary, editorial blogs	Product pages, ads and packaging are straightforward breaches
Creative Commons	Depends on the variant; attribution is often required	The uploader may not have owned it, and share-alike can restrict your layout

How do images end up on your site unlicensed?

Images arrive through people, not process. A client emails a folder, a designer buys on a personal account, a theme ships demo photography, or a developer grabs something from a free gallery without checking the uploader. Each path looks harmless at the time and leaves a different kind of hole later.

How do you audit the images already on your site?

Auditing means listing every image, finding its origin, and recording the licence that covers it. Do it once, properly, and you convert an unknown liability into a short list of items with a fix. The audit is dull work; the alternative is discovering the gap in a legal letter.

1. Crawl the live site and download the sitemap, then export every image URL from the HTML and CSS.
2. Reverse-search each image to identify the library and asset ID — that's how agencies find you too.
3. Match each image to a purchase: which account, which invoice, which date, which licence tier.
4. Record the licence type and whether it permits commercial use, merchandise and paid advertising.
5. Check releases for anything showing an identifiable person, private property, artwork or a logo.
6. Flag orphans — images with no traceable source — and put them on a replacement list, highest-traffic pages first.
7. Store the register somewhere the business owns, not in a freelancer's inbox or a chat thread.

How do you verify an image is safe before you publish?

Verification is a five-line record you keep at the moment of download, while the evidence still exists. Store it next to the asset, in version control or a shared drive the company controls. If you cannot complete the record, treat the image as unsafe and pick another.

assets/hero-office.jpg
  source: agency name / asset ID
  licence: extended royalty-free
  licensee: Client Pvt. Ltd.
  purchased: 2025-03-11
  receipt: INV-2291 (account: studio@company)
  releases: model yes, property not required
  permitted: web, print, paid social, merchandise
  expires: perpetual

Two details trip people up. First, the licensee must be the entity that publishes — if the agency buys and the client publishes, the licence is on the wrong name. Second, download dates and receipts need to survive staff turnover; a register that lives in someone's personal drive is not a register.

What happens when a demand letter arrives?

A demand letter claims your use was unlicensed and offers a retroactive licence plus a penalty. Do not reply in anger and do not quietly delete the image. Check the diagnostic order below, because each signal rules something out and changes your position.

1. Confirm the image is genuinely on your site, and capture a dated screenshot before you change anything.
2. Search your records for a purchase under every account the business has ever used, including former staff.
3. Read the licence you find against the actual use — sometimes a valid licence exists but covers the wrong channel.
4. Check whether the claimed rights holder actually owns the image, or is just an agent working on commission.
5. If you were licensed, respond with the receipt and the licence terms; most agents drop the claim quietly.
6. If you were not, remove or replace the image and negotiate — but get advice before signing anything.

What does getting this wrong actually cost?

Costs are rarely the licence fee. They're the retroactive settlement, the legal time, the engineer hours spent swapping images across templates, and the traffic lost while a page is down. In some jurisdictions statutory damages are available, which is why demands often land far above the original download price.

• Direct: a retroactive licence fee plus a penalty, negotiated or settled.
• Engineering: finding and replacing the image everywhere it appears — site, social, print, app store assets.
• Commercial: campaigns paused, ad accounts flagged, a store listing pulled during review.
• Reputational: a public takedown notice on a page customers were reading.
• Ongoing: a licence register nobody maintains becomes the next gap in two years.

When is the simple approach the right one?

Sometimes the cheapest path is to stop using stock entirely. If your product photographs well, commission a shoot or shoot it yourself — you own the output, and the release paperwork is a one-time task. Illustration and custom graphics avoid the issue too, though they cost designer time instead.

Free public-domain galleries remain a reasonable option for low-stakes decorative imagery, as long as you record the source. AI-generated images are not an automatic escape: platform terms vary, training-data claims are still working through the courts, and in some jurisdictions purely machine-generated output may not be protectable at all. Check current guidance rather than assuming.

What are the common mistakes?

The same handful of errors show up in almost every audit. They're all cheap to prevent at the start of a project and expensive to unpick afterwards, which is why we push clients to settle image provenance during planning rather than after launch.

• Assuming a paid subscription covers merchandise, templates or client resale.
• Using editorial imagery on a commercial page because it looked better than the licensed option.
• Licensing under a personal account, so the company has no rights at all.
• Deleting an image the moment a letter arrives, destroying the evidence you need.
• Relying on a theme's bundled demo photography after launch.
• Hotlinking images from another site — a licence problem and an availability problem at once.

One small technical habit helps: strip EXIF metadata on upload, including GPS coordinates and camera details. It's a privacy win, and it stops you publishing location data you never meant to share.

A realistic scenario

A trekking operator launches a new site with a striking Himalayan hero image. The freelancer found it through a search engine, saved it to their own laptop, and moved the site onto new hosting six months later. Nobody kept a receipt because nobody thought there was anything to keep.

Two years on, an agency letter arrives citing the image and asking for a retroactive licence. The operator has no record, the freelancer is unresponsive, and the image appears in a homepage banner, a PDF brochure and three social posts. The fix is a replacement image, a designer to rebuild the banner, and a negotiated settlement — plus a licence register so the next rebuild doesn't repeat it. This is exactly the kind of provenance work we do during a build, and it's far cheaper as part of website design in Nepal than as a cleanup afterwards.

In short

Stock photo licence risk is a documentation problem wearing a legal costume. If you can show, for every image, where it came from, who licensed it and what the licence permits, most claims evaporate on first reply. If you can't, you negotiate from the weakest possible position.

• Audit the images you already publish, starting with the highest-traffic pages.
• Record source, licence type, licensee and receipt at download time.
• Replace anything you can't trace, and stop reusing it in new campaigns.
• Keep the register where the business owns it, and review it after every redesign.

If that sounds like paperwork you'd rather not own, our team can help you build the register, replace the risky assets and hand the whole thing over documented — see website maintenance services in Nepal or UI/UX design services.

People also search for

These are the questions clients ask us most often after a licensing scare. Each one maps to something we've written or built before, from quote reviews to hosting decisions that affect how quickly a takedown reaches your site.

• Who actually owns the photos on my website?
• Is a cheap website quote hiding unlicensed images?
• How much of a project quote is photography and design?
• What happens if my host receives a DMCA notice?
• Do I need a lawyer to review a stock image licence?
• How do I swap out stock photos after a takedown?

If you're not sure whether the images on your site are covered, get a second pair of eyes on it before a letter arrives. Our team can audit your assets, replace what's risky and leave you with a register you actually own — start with a look at work we've delivered, then contact us and we'll tell you plainly what needs fixing first.