Copyright-free and AI-generated images: the legal guide for websites and social media
Understand image licences, AI copyright, image rights and EU disclosure rules before using free or generated visuals on your website and social media.
A business owner finds a beautiful photograph, sees a free download button and adds it to the homepage. A marketing team generates a convincing image of a happy customer and uses it in an Instagram advert. Both decisions take minutes. Neither the download button nor the AI prompt answers the legal question: what gives the business permission to publish that particular image in that particular context?
You can use free stock photography and AI-generated visuals in commercial communication, but the conditions matter. Start with three separate checks: the rights in the image, the rights of anyone or anything depicted, and the message the finished publication communicates.
This guide focuses on Romania and the European Union, with sources checked on 15 September 2026. It provides general legal information and practical publishing guidance, not advice for a specific dispute. The US position is identified separately where relevant.
“Copyright-free” is not a licence category
Free describes a price. It does not establish permission. Romania's Law No. 8/1996 protects original photographs and other artistic works and identifies the author as a natural person. Reproduction and making a work available online fall within rights controlled by the rightsholder, subject to legal exceptions. A credit alone does not grant those rights. See Law No. 8/1996, particularly Articles 3, 7 and 13.
For sourcing decisions, distinguish these labels:
- Free stock image: a file available without a purchase price, under a particular licence.
- Royalty-free: generally a licensing model without a separate royalty for each permitted use; check the actual contract for fees and limits.
- Public domain: material outside applicable copyright protection; verify its status and relevant jurisdiction.
- CC0: a dedication that waives copyright and related rights as far as legally possible. It does not clear trademarks, privacy or personality rights. See the CC0 terms.
A search result, Pinterest board or repost is a starting point for finding the source. Save the original asset page and its permission terms before building a campaign around it. “Found on Google” cannot explain which rights your business acquired.
Read the licence before choosing the visual
Creative Commons offers several licences with materially different conditions:
- CC BY 4.0 permits commercial use and adaptation with appropriate attribution, a licence link and an indication of changes. Retain supplied notices. See CC BY 4.0.
- CC BY-SA 4.0 also allows commercial use, but shared adaptations must use the same or a compatible licence. Check what constitutes the adaptation in your design. See CC BY-SA 4.0.
- CC BY-NC 4.0 restricts use to noncommercial purposes. A business promotion can be commercial even without a paid media budget. Seek separate permission for a promotional campaign. See CC BY-NC 4.0.
- CC BY-ND 4.0 allows commercial sharing of unadapted material; it does not permit sharing adaptations. A redesign or substantial crop may need separate clearance, depending on the change. See CC BY-ND 4.0.
Stock platforms can use their own terms. The Unsplash licence permits free commercial use while restricting unmodified resale and competing image services. The Pexels licence permits website and social uses but prohibits implied endorsements and use as a trademark, among other restrictions. Check the specific asset's licence, including any separate paid collection terms.
Editorial use only is another restriction to check. Such a licence does not automatically permit advertising just because the image appears in a blog post. For example, Adobe Stock’s editorial rules exclude adverts, promotions and advertorials. Assess the purpose of the publication, including an unpaid promotional social post, before selecting an editorial asset.
For a CC BY photograph, an illustrative credit could identify the image title, photographer, source and CC BY 4.0 licence, followed by “cropped and colour adjusted.” Replace those details with real information and links. Keep the credit accessible in the page or post; a filename buried in your media library is not a useful attribution.
A photograph licence does not settle a person's image rights
Romania's Civil Code protects privacy and the right to one's own image, subject to its legal limits. Permission from the photographer and permission concerning a depicted person answer different questions. For commercial portraits, document the intended website, social and advertising uses and check whether the release covers them. See Civil Code, Articles 71–75.
A photograph of an identifiable person can also be personal data. Publishing it or uploading it to an AI service requires an applicable GDPR legal basis and appropriate transparency; consent is not the only possible basis. A stock licence is not a GDPR assessment. See GDPR, Articles 4, 6 and 13–14.
As a practical rule, review recognisable faces, logos, artworks and private settings before approval. Ask whether a viewer could infer a customer relationship or endorsement. Avoid presenting a stock model as an actual employee, patient or testimonial author. Choose another image when the necessary permissions cannot be established.
AI permission and copyright ownership are different questions
An AI service may allow commercial use under its contract. That permission does not itself create copyright protection or clear third-party rights. Review the terms for the particular tool and account plan: permitted inputs, commercial outputs, client use, restrictions, warranties and any indemnity conditions.
Because Romanian copyright law centres on human authorship and original creation, do not assume that a generated output carries exclusive rights simply because you wrote its prompt. This is a practical inference from the legal framework, not a claim that every AI-assisted work has the same status.
For comparison, the US Copyright Office's report on AI and copyrightability distinguishes human-authored contributions from purely generated material. Prompts alone generally do not provide sufficient control under its analysis; original human selection, arrangement or modification may be protected. That is US guidance, not a Romanian ruling.
Keep editable files and records of substantive human decisions when exclusivity matters. Before offering a generated mascot or campaign visual as an exclusive brand asset, obtain a specific rights assessment. A commercially usable output and an asset you can prevent everyone else from copying are different deliverables.
Check both the AI inputs and the finished output
Our recommended workflow is to use reference images you own or have permission to upload and transform. A licence to display a photograph does not necessarily cover every use inside an AI service. Avoid uploading client portraits, confidential material or third-party artwork without checking the relevant permissions and data handling.
Review the output at full size. Look for recognisable characters, logos, copied compositions, signatures and faces resembling real people. A reverse-image search can help investigate obvious similarities, but an empty result is not legal clearance. Do not ask an image editor to remove a watermark as a substitute for acquiring rights.
Give the reviewer the prompt, reference sources and final image together. Reviewing only a small export can hide the context that makes a visual problematic. Record whether the image is an illustration, a product representation or supposed evidence of an actual result.
When must an AI image be disclosed in the EU?
The European Commission confirms that Article 50 transparency obligations apply from 2 August 2026. It distinguishes providers' technical marking duties from deployers' disclosure duties. This is not a blanket requirement that every decorative AI illustration carry the same visible label. See the Commission's transparency guidance.
Under Article 50(4)–(5), deployers must disclose AI-generated or manipulated deepfakes clearly and accessibly by first exposure. Evidently artistic or fictional works have an adapted disclosure requirement, not an unconditional exemption. The definition in Article 3(60) concerns synthetic or manipulated media resembling existing people, objects, places, entities or events that viewers would wrongly take as authentic. Celebrity impersonation is only one example.
For an illustrative property concept, a visible explanation such as “AI-generated concept; proposed appearance” helps readers understand what they are seeing. Assess the legal trigger and use the platform's current disclosure controls where applicable. Keep the explanation with the visual when exporting it from a website into a carousel or advert.
An AI label does not make misleading advertising acceptable
A generated hotel pool that does not exist, a fabricated treatment result or a stock portrait beside an invented review can mislead customers about the offer. Articles 6 and 7 of the Unfair Commercial Practices Directive address misleading actions and omissions in consumer marketing. Labelling an image “AI-generated” does not automatically cure the overall impression.
Use real photographs when the purpose is to prove your facilities, team, completed work or product condition. Use clearly explained illustrations when the purpose is to communicate a concept. Review the image, headline and caption together: a truthful caption in small print may not resolve a misleading main claim.
Keep a rights record that follows the image
Before publication, assign one person to maintain a simple asset record:
- Source: original URL, creator, asset identifier and acquisition date.
- Permission: saved licence version, invoice or written permission, and required credit.
- Scope: website, organic posts, paid advertising, client use, territory, duration and editing limits.
- People and brands: relevant releases and any unresolved restrictions.
- AI history: tool, account plan, permitted references, generation date and material human edits.
- Approval: reviewer, final file, accompanying claims and disclosure decision.
- Locations: published URLs, scheduled posts and campaign variants that may need correction later.
When a client supplies an image, ask for the source and permission evidence during content collection. When an agency supplies it, include the rights record in the handover. An approval email should identify the actual asset and intended use.
If a rights complaint arrives, preserve the correspondence and evidence, pause disputed uses where appropriate, and verify the claimant and licence before responding substantively or paying. Removing an image can limit further exposure but does not by itself resolve past use.
Build these checks into your website content checklist and social content workflow. The useful question is not just whether an image looks good. It is whether you can explain its source, your permission and the truth of the message around it.
