Photo

Shereen Way and her daughter Gloria, 4Credit Andrew Renneisen for The New York Times

Shereen Way did not think twice about posting a photo on Instagram of her 4-year-old daughter wearing a green dress and pink Crocs sandals.

Crocs, which Ms. Way had identified with a hashtag, pulled the snapshot from Instagram and featured it in a gallery of user-generated photographs on its website. The company had not asked Ms. Way for permission, and she was not aware that Crocs had used the photo until a reporter contacted her on Instagram.

“No one reached out to me,” Ms. Way, 37, of Pearl River, N.Y., said in a phone interview. “I feel a little weirded out.”

Much later, Crocs sought her permission.

Instagram and other social sites like Pinterest and Twitter have long been sources of selfies and candid shots that retailers and other companies mine for “consumer engagement,” a broad industry term that can mean anything from Facebook likes to hashtags for brands.

But as the practice of promoting user-generated content has intensified, the intersection between brands trying to capitalize on social media activity and people’s expectations of some privacy (even as they post personal photos on public platforms like Instagram) has grown far more murky.

No one, it seems, wants to actively police traditional rights issues like those presented in Ms. Way’s situation. Using photos like her daughter’s generally requires getting the consent of the person who posted the original content before it can be reused elsewhere.

“This is a new area, and we want to make sure our customers are dotting the ‘Is’ and crossing the ‘Ts,’ ” said Sharad Verma, the chief executive and co-founder of Piqora, which helps brands curate user-generated content from sites like Instagram. “It’s important for brands to be very upfront and transparent about how the photos are being used.”

For its part, Instagram, which has about 300 million users, says it is responsible only for how brands use consumers’ photos posted on its site.

The Federal Trade Commission, which polices unfair or deceptive practices, could step in if Instagram violated its own privacy policy or promises made to consumers in its terms of service. But consumers have little recourse on their own, other than pursuing costly legal action.

The lack of oversight comes at a time when brands and social media sites are strengthening their relationships in efforts to generate ad revenue and lock in loyal consumers. Instagram, in particular, has been working to open its photo feed to all advertisers, big and small, across the globe.

Privacy groups and consumer advocates continue to voice concerns about how companies use data culled from social media to endorse or sell products. In 2012, Facebook, which owns Instagram, reached a settlement in a class-action lawsuit over its “sponsored stories,” or its practice of turning a users’ likes into ads tailored to their friends. The court approved the settlement in 2013, but it is currently being appealed.

Still, in the age of the selfie, many users enjoy getting a broader audience for the photos, opinions and tastes they share online.

“I’m always really excited,” said Liza Day Penney, a 23-year-old from Dayton, Tenn., whose photo appears on American Eagle Outfitter’s website. She estimated that the company has used more than half-a-dozen of her photos, and even once sent her a $25 gift card.

“That was one of the things, too, that really encouraged me to continue to post and continue to tag and hashtag them as I wear the clothes,” she said.

In many cases, getting consent from a user can be as casual as a comment underneath the photo itself.

“We love your pic!” the Crocs Instagram account writes on many of the user-generated snapshots featured on its website, followed by a request to feature the photo elsewhere.

To agree, users just have to reply with “#CrocsOk,” and many do.

In the case of Ms. Way, however, Crocs did not comment on the photo to ask for permission until after posting it on its website. Ms. Way has not responded and says she does not intend to.

In a statement, Crocs said it believed it was “acting consistently with social media marketing best practices.”

“We are continually evaluating our practices and welcome consumer feedback,” the company said. “It’s our policy to get permission before making any other use of photos consumers have tagged us in.”

Clothing and retail brands say that featuring user-generated photos on their websites and in their Instagram feeds is an effective way to connect with consumers, who are increasingly skipping commercials, blocking online ads and generally ignoring anything that resembles traditional advertising. Taking photos from social media accounts is also often cheaper and faster than creating a traditional marketing campaign.

The tactic is particularly popular among apparel companies, as they rethink how to maintain customer loyalty in the digital age.

“There’s a significant risk of us losing that relationship with the customer and that bond you get from the experience in the store,” said Joe Megibow, the chief digital officer at American Eagle, which has galleries of consumers’ photos on its website.

Mr. Megibow said American Eagle, which works with Olapic, monitors Twitter and Instagram for photos that users have identified with the hashtag #AEOstyle or #AerieReal. Olapic is a marketing company that helps brands collect users’ photos.

Giggle, an online baby products retailer, says it is particularly cautious when using photos of small children.

“It’s so critical, especially with babies and kids, that you get 100 percent permission for anything you are planning to do with these photos,” said Shawna Hausman, Giggle’s vice president of e-commerce and digital marketing.

Giggle, like Crocs, works with Olapic and often requests permission in the comment section of a photo.

But, like Crocs, Giggle’s strategy is not bulletproof. Julie Wax, a 33-year-old mother of two who lives in Little Rock, Ark., said she was not contacted by Giggle before a photo of her baby girl appeared in a gallery on the company’s website.

“It seems a little bit invasive, especially when you’re dealing with kids,” Ms. Wax said.

When asked about Ms. Wax’s photo, Ms. Hausman of Giggle wrote in an email: “Obviously, this was a miss.” She added that the company tries to go “above and beyond” the industry standard for getting permission. Giggle has since removed Ms. Wax’s photo from its site.

A spokeswoman for Olapic said in an email that brands do not always need to ask for permission to use a photo on their websites because users can give implied consent by tagging a company in their posts.

Privacy experts point to the Children’s Online Privacy Protection Act, or Coppa, which requires operators of websites and apps aimed at children to get “verifiable parental consent” before collecting information from children under the age of 13. The F.T.C., which enforces the rules, declined to comment.

“When a company obtains information about a child under the age of 13, however it’s obtained, Coppa kicks in,” said Marc Rotenberg, president of the nonprofit Electronic Privacy Information Center. “Then the question is, ‘Did the parent consent to the use of the information by the company?’ ”

Adults also have rights to their photos. The person featured in a photo may own the publicity rights, which may give the individual control over the commercial use of his or her likeness, legal experts say. Broadly speaking, whoever takes a photo holds the copyright.

“Both rights may apply when companies want to use a photo that depicts a person in advertising, while typically only the copyright matters for other photographic content,” according to James Silverberg, an intellectual-property lawyer who works with American Photographic Artists.

Eric Goldman, a lawyer who specializes in intellectual property, said: “One of the questions that we run into online is, ‘What is the line between advertising and editorial content?’ If the brand is publishing the content online, odds are that it’s going to be considered an advertisement.”

Brands may argue the opposite. Social media sites themselves may also give brands some troubling wiggle room, according to Mr. Silverberg.

Instagram outlines some of the ways it may share content in its privacy policy and user agreement, but does not place enough restrictions on how other companies may use that content, Mr. Silverberg said.

“For rights owners, there is an extremely uncomfortable ambiguity in what the ramifications are for the terms of use,” Mr. Silverberg said.

That ambiguity, he argued, is being driven by a growing thirst to document our daily lives on social media.

“We are seeing this more and more because so many people are growing up in a time when there’s a sense that you can share imagery that’s out there,” he said.

Instagram says that it strongly encourages brands to contact users directly, regardless of whether they have tagged a photo with the brand’s name.

“It’s absolutely clear from our standpoint that there has to be explicit permission given,” said James Quarles, Instagram’s global head of business and brand development.

Ms. Way, whose daughter’s photo appeared on the Crocs website for weeks without her permission, said the company had eventually contacted her.

“Crocs just sent me their request to use my photo,” Ms. Way wrote. “I didn’t respond.”