Licensing Images, Music & Fonts for US/EU Builders — What "Royalty-Free" Does Not Mean

Written: 2026-05 / Jurisdiction focus: United States & European Union (Japan referenced for contrast) / last_updated: 2026-07-11 Changelog: 2026-05-25 first published / 2026-07-11 updated for the terminated Getty–Shutterstock merger (agreement terminated 7 Jul 2026; CMA inquiry closed 8 Jul 2026)

Where this sits in the series: part of the "rights for builders" series — after The Pre-Ship Rights Checklist (rights overall), Reading OSS licenses (other people's code), and The legal boundaries of scraping (acquiring other people's sites and data), this piece is about the next step: using the assets other people made — images, music, and fonts.

A few terms first:

• Royalty-free (RF): a pricing model — pay once, then reuse within the license terms without per-use royalties. It does not mean "$0" or "copyright transferred."
• Standard vs. Extended (Enhanced): standard has caps on copies/impressions and no merchandise; extended lifts the caps and allows merchandise/templates.
• Editorial-Use-Only: news/commentary contexts only. Not for ads, promotion, or product packaging (no model/property release).
• Model / Property release: permission covering the people / private property shown in an asset.
• Master rights / sound-recording rights: rights in the actual sound recording, separate from the song's copyright. In the US this is a sound-recording copyright; in the EU/Japan it is a neighboring (related) right. Either way, for music you check both layers.
• Creative Commons (CC): standardized licenses (BY / NC / ND / SA combinations, plus CC0).

"It says free, so I can use it however I like" — that instinct is where most mistakes start. For images, music, and fonts, "free" and "royalty-free" usually describe how you pay, not that copyright is gone or that use is unlimited. Each asset type has its own traps. Below, we go type by type through what to check before you use an asset, and end with copy-paste checklists and a font-by-use table. The focus is US and EU practice; Japan is referenced for contrast (the Japanese edition leads with Japanese law).

"Free" and "royalty-free": clearing up the terms first

The biggest beginner trap is assuming what the words mean. "Free," "royalty-free," and "no attribution required" feel like "use it however you like." But most of these describe how you pay, not whether copyright still applies.

Royalty-free (RF) is a pricing model. Pay the license fee once, and you may reuse the asset within the terms without paying a royalty per use. It is not "$0," and it is not a transfer of copyright — the rights stay with the owner, and use outside the terms can be infringement.

By contrast, rights-managed (RM) licenses each use for a specific purpose, period, region, medium, and size. A different project needs a new license.

Even within RF, Standard caps copies and impressions and forbids merchandise (T-shirts, mugs). Extended / Enhanced lifts those caps and unlocks merchandise and resale templates.

Then there is Editorial-Use-Only. Assets without a model/property release are offered this way: fine for news and commentary, but not for ads, promotion, or product packaging (buying a higher tier does not unlock it — you need the rights holder's written consent).

Free sites (Unsplash, Pexels, and the like) are not "anything goes" either. Common limits:

• No redistribution or resale of the asset itself as a standalone file — the core rule on nearly every site.
• Credit requirements vary from site to site (some require none, some require it).
• Little to no model release or legal indemnity (Unsplash, for example, caps liability at $100 in its terms).
• No "the asset is the product" merchandise.

And "commercial use OK" is only a starting point: ① caps on copies and impressions, ② merchandise and resale templates need a separate license, and ③ logos and trademarks need separate permission — all of these remain.

External assets split into three families by where you get them, and the traps differ.

The common core across all three: assets are meant to be used as part of your content, while redistributing, reselling, or merchandising the asset itself is a separate matter (a separate license, or prohibited). Below we go type by type.

Stock images and photos — caps, and watch "people and logos"

Images are the most familiar external asset, and the global majors set the baseline in the US and EU.

• Shutterstock: Standard covers web, social, and online media with no view/distribution cap, but caps physical reproductions at 500,000 in aggregate (and out-of-home campaigns at under 500,000 impressions); no merchandise, resale templates, or broadcast (indemnity up to $10,000). Enhanced removes those caps and unlocks merchandise and broadcast (indemnity up to $250,000). Editorial is non-commercial only.
• Getty Images: three license types — RF, Rights-Ready, and Rights-Managed. RF is a one-time fee, worldwide, unlimited runs, and perpetual, but only up to 10 individuals (total, not concurrent) within a single legal entity may use it. Putting an image into a logo or trademark needs separate written consent and a fee. Note that its subsidiary iStock is a separate brand with a different model ("standard / extended," with a 500,000-copy cap on standard) — Getty's RF/RR/RM and 10-seat terms do not apply to iStock.
• Adobe Stock: standard = 500,000-copy cap, Enhanced = caps removed, Extended = merchandise unlocked — the same structure in the US and EU.
• Unsplash: once CC0◆, it moved to its own Unsplash License in 2017. Free for commercial use, attribution optional — but legal indemnity is thin (the terms cap liability at $100) and model releases are unverified. With people in the frame, the user bears the full risk (Getty acquired Unsplash in 2021; it still runs independently).

One note on the Getty–Shutterstock deal: it is off. The two announced a "merger of equals" in January 2025, and the US Department of Justice cleared it unconditionally in February 2026. But the UK's CMA cleared it only on condition that Shutterstock's global editorial business be divested. Getty declined to pursue that sale, terminated the merger agreement on 7 July 2026, and the CMA closed its inquiry on 8 July 2026. The two remain separate companies, so there is no post-merger license structure to plan around — check each provider's terms on its own.

An extra layer in the EU

The global majors offer the same terms in the EU, but two layers sit on top of the contract text — points the US does not raise:

• GDPR◆ (personal-data protection): a photo showing an identifiable person is "personal data," and commercial use needs a lawful basis (consent, legitimate interests, etc.). If you rely on consent, the person can withdraw it at any time, and absent another lawful basis or exception, an erasure obligation (Art. 17) can arise — but consent is not the only possible basis, so it is not always a delete duty. A "model release obtained" badge does not remove the GDPR layer.
• Personality / image rights (e.g., German KunstUrhG §22/§23): Germany makes it law that a person's likeness may not be distributed or published without consent (§22), subject to statutory exceptions (§23) for figures of contemporary public interest, people who appear only incidentally, and public assemblies — broader in scope than US publicity rights.

So in the EU, putting a person's photo into an ad means checking both the site's model release and image-rights / GDPR. Across multiple jurisdictions, aligning to the strictest (EU) baseline is the safe move. (In Japan, sites such as PIXTA add their own twists — see the Japanese edition.)

Music and SFX — two layers of rights, and "after you cancel"

What makes music different from images is that two layers of rights apply: ① the copyright in the song itself (lyrics and composition) and ② the rights in the master (the actual sound recording) — a sound-recording copyright in the US, a neighboring right (the record producer's right) in the EU/Japan. Using a commercial track in a video generally needs both. A synchronization (sync) right also applies when sound is set to picture. The value of an asset library is that it clears all of this for you — and stepping outside the terms (redistribution, selling the audio alone, off-license media) falls outside that clearance.

Pricing splits into three types, and "what happens after you cancel" is the dividing line.

• Epidemic Sound (subscription): unlimited catalog use while subscribed, with a direct, worldwide license that includes performance rights. Content published while subscribed stays cleared forever after you cancel, but new use after cancellation is not allowed. Business use is a separate plan; Enterprise includes indemnification against third-party claims. App embedding and AI handling could not be confirmed from public pages (unconfirmed).
• Artlist (subscription): Social (personal) and Pro (client work). Projects published while subscribed stay usable after the term ends, but new projects afterward are not allowed — except Artlist's own AI-generated assets, which remain free after cancellation.
• YouTube Audio Library (free): two licenses are mixed in. ① standard = no credit, ② CC BY = credit required (check per track). Whether standard-license tracks may be used outside YouTube is unconfirmed in official primary sources; secondary explainers say "YouTube videos only."

Two common misconceptions. "Cancel the subscription and every past video is now illegal" is wrong — what you published while subscribed stays cleared. What you lose is new use after cancellation. The reverse — "subscribe once and use new tracks forever" — is also wrong.

The Content ID misconception: "I have a valid license but YouTube filed a claim, so it's a scam or a bug" is also wrong. Epidemic and Artlist register their tracks in Content ID to protect them, and the usual cause is a channel that isn't linked (a safelist / Clearlist gap). A claim does not mean your license is void. Linking your channel before publishing is the rule.

Generative AI assets — "commercial use" and "you own the copyright" are different

When you use AI-generated images or music as assets, the first thing to separate is "who owns the output under the terms (contract level)" from "whether the AI output attracts copyright at all (copyrightability)." On many services, "you may use it commercially" and "you hold the copyright" do not coincide. The latter depends on copyrightability — how much human creative contribution there is.

The risk the user carries

• Output can closely resemble an existing work (OpenAI itself notes similar output can appear). Across these terms, the infringement liability ultimately sits with the user.
• Asymmetric indemnity: most are "AS IS, no warranty," and on infringement the user indemnifies the vendor (the reverse direction). The exception is Adobe Firefly, where for eligible enterprise/paid contracts and covered features Adobe may indemnify the user (confirm the scope in your contract). To limit infringement risk commercially, an indemnified service with closed training data is the pragmatic safe choice.
• Deliberate mimicry (prompts targeting a specific artist's style or a brand logo) can be a terms violation as the user's own act, before any training-data question arises.
• Trademark, publicity, and image rights are separate layers that remain even after copyright is cleared.

Disclosure and registration differ by jurisdiction

Article 50 is not a blanket "label every AI-generated asset" rule. Providers (those offering the AI) mark synthetic output in a machine-readable way, and deployers (those publishing) disclose deepfakes (content made or altered to resemble real people or events) as "AI-generated or manipulated." For artistic, satirical, or fictional works the disclosure method is relaxed (not a full exemption). Shipping across jurisdictions, aligning to the EU baseline is the safe move.

As for credit: Midjourney, DALL-E, Firefly, and Stable Diffusion do not require it; Suno and Udio require it on free plans. Firefly auto-attaches Content Credentials (provenance), and removing them is prohibited.

Creative Commons in practice — the form of credit, and the "NC trap"

Creative Commons (CC) lets a creator say "use this freely under these conditions" (BY / NC / ND / SA combinations, plus CC0). Here we focus on using CC as an asset.

Credit with TASL. CC recommends linking each of Title / Author / Source / License.

• Basic: "Title" by Author is licensed under CC BY 4.0.
• When modified (required for the BY-family licenses; CC0 needs no attribution, and ND forbids sharing adaptations at all): "Title" by Author, used under CC BY 4.0 / modified (e.g., cropped) by your name
• Writing only "Creative Commons license" is not enough — without the specific variant, the conditions are not conveyed.

The NC (NonCommercial) trap. CC's official FAQ defines NC as forbidding use "primarily intended for or directed toward commercial advantage or monetary compensation," judged by the nature of the use, not whether the user is an individual or a company. So an ad-supported personal blog or a monetized YouTube channel is at real risk of counting as "commercial-leaning." CC itself does not adjudicate borderline cases ("ask the rights holder, or pick commercially usable material"). The grey zone is the official position — if revenue is involved, avoiding NC and choosing BY / BY-SA / CC0 is the safer path.

SA (ShareAlike) and mixing. BY-SA / BY-NC-SA require the same license on adaptations. BY-SA and BY-NC-SA cannot be mixed (the NC flag makes them incompatible); BY-ND forbids making derivatives at all. The easy mistake is the scope: the share-alike obligation applies to adaptations only. Adapting SA material into your own work can trigger it, but merely placing it unmodified alongside other elements (a collection) is not an adaptation and is outside the obligation — "mixing always contaminates" is false.

The limits of CC0 / public domain. CC0 tries to waive copyright and related rights as far as possible, but in jurisdictions where moral rights cannot be waived (Japan, Germany, France, etc.) a fallback clause applies, and trademark, patent, and third-party rights are not waived. Don't assume "CC0 = zero copyright everywhere" (the people, buildings, or other works depicted may carry separate rights).

Search tools are not an endorsement. Openverse (official CC) auto-generates TASL credit lines but states plainly that it does not guarantee license accuracy — verify on each work before use. Wikimedia Commons likewise requires checking license and attribution per file. Finally, CC 4.0 restores rights automatically if you cure a violation within 30 days of noticing it (3.0 and earlier have no auto-restore). Mind the version differences.

Fonts — licensed by use, not by a single "commercial OK" (with a by-use table)

Fonts have a difficulty of their own: the same font can permit different things for logos, web, apps, print, and PDF.

Open-source fonts. The main licenses are the SIL Open Font License (OFL) 1.1 and the Apache License 2.0.

• OFL 1.1 (Google Fonts / Noto / Source Sans): commercial use, modification, redistribution, embedding, and web-font serving are all allowed, under five conditions — ① no selling the font on its own (bundling in software is fine), ② ship the copyright notice and full OFL text on redistribution, ③ don't use a Reserved Font Name in derivatives, ④ don't use the author's name to promote derivatives without permission, ⑤ derivatives must also be released under OFL.
• Apache 2.0 (Roboto): commercial use, modification, and redistribution allowed; it grants a patent license and requires keeping the NOTICE file and noting changes on redistribution.

Commercial fonts. Adobe Fonts (formerly Typekit) serves Creative Cloud subscribers: alongside desktop-app use, web use is via embed code only (no downloading the raw font file or placing it on your server), and embedding the font file into a mobile/desktop app needs a separate foundry license. An outlined logo may be used commercially and registered as a trademark. Monotype (MyFonts / Linotype) licenses web fonts by page views, and desktop use or logos need a Desktop license.

A US copyright note. In the US, typeface designs are generally not protected by copyright, while the font software (the file) is. So, as in Japan, control comes largely from the license / EULA rather than from the shape of the letters — which is exactly why a by-use check matters.

Font by-use table. Judge a font by "what you use it for," not by a blanket "commercial OK."

What happens when you use without permission — claims and case law (claim ≠ award)

"I found it online" and "it said free" are not defenses. Here is what tends to happen, in claims practice and case law. Note that this article does not declare anything "legal" or "illegal" — it gives a sense of the risks.

Claims practice (demand letters)

• 【US】Getty Images' automated tracking: image-tracking technology scans the web, and unlicensed use draws a settlement letter. Demands run from hundreds to thousands of dollars with wide room to negotiate (the first figure is a starting point), and buying a license afterward does not cure the past unlicensed use.
• 【US】Higbee & Associates / PicRights: bots hunt for unlicensed images and seek settlements of roughly $1,500–$20,000 per image, sometimes citing $150,000 statutory damages. Demands often run several times the real license fee, and negotiation can bring them to 10–40% of the opening figure, or to withdrawal (secondary sources).
• 【EU/DE】Abmahnung (cease-and-desist): seeks an injunction, damages, and the other side's attorney fees. The fictional-license-fee damage is typically a few hundred euros per image, and even free assets can draw a claim over a missing credit.

Cases (we separate claim vs. award, and final vs. pending)

• 【US】Agence France Presse v. Morel (S.D.N.Y. 2013): over unauthorized redistribution of photos posted to social media, a jury found willful infringement and returned $1.2 million in 2013 (figure from secondary explainers rather than the primary judgment text). A landmark on reusing social-media photos.
• 【US】Brammer v. Violent Hues Productions (4th Cir. 2019): a photo reposted to a film-festival site. The Fourth Circuit reversed the district court's fair-use finding (commercial, non-transformative, harming the licensing market). "I found it online" is not a defense.
• 【US】McDermott v. Kalita Mukul Creative (E.D.N.Y. 2024): only $940 in statutory damages and no attorney fees (willfulness rejected) — a reminder that infringement is not always expensive (secondary sources).
• 【US】Carol Highsmith v. Getty / Alamy (filed 2016): she sued for $1 billion, alleging license fees were charged on her own public-domain photos. But $1 billion was the claim, not an award. The core federal claims were dismissed in 2016, and the state-law claims were dropped by settlement. A "reverse" trouble where a stock company overclaims rights.
• 【EU/DE】Marlene Dietrich (BGH, 1999): held that the commercially valuable part of personality rights is inheritable — a foundational German image / publicity case.
• 【EU/DE】Pixelio hotlink-attribution case: the dispute was whether a free asset's direct image URL needed a credit. The first instance (LG Köln, 30 Jan 2014, 14 O 427/13) required attribution even at the direct image URL; on appeal, at the oral hearing the OLG Köln (15 Aug 2014, 6 U 25/14) signaled the LG ruling could not stand, and the applicant then withdrew the preliminary-injunction request — leaving the first-instance ruling without force. (This was a preliminary-injunction proceeding resolved by withdrawal, not a final merits judgment.) A textbook case of legal uncertainty.

It happens with free assets and music too. Even "free," a missing model release for the subject can cause trouble. With music, Content ID detects audio matches, not whether a license exists, so legitimate or free BGM can still draw a claim — dispute it citing your license and show proof. As of May 2026, no final damages judgment over a terms violation of free BGM was identified in the sources reviewed.

A checklist by case — priorities differ by who you are

Finally, a before-you-use checklist. Priorities shift with your role.

Enterprise practitioners: caps, indemnity, product bundling, a ledger

□ Check caps on copies/impressions (Shutterstock/Adobe 500k). If you may exceed, move to Extended/Enhanced
□ Merchandise, resale templates, and logo/trademark use are not in Standard → higher tier or separate permission
□ For people/buildings/brands in ads or products, confirm model/property releases
   (in the EU, double-check image rights + GDPR)
□ App/game bundling and venue BGM: "video-BGM license ≠ product-bundling license." Confirm embedding up front
□ If you need legal indemnity, use an indemnified plan (free sites are inadequate for enterprise risk)
□ Generative AI: mind revenue thresholds (Midjourney/Stability); when training on assets that include third-party rights, personal data, or contract restrictions, confirm the rights, consent, and contract terms first
□ Keep an asset ledger (acquired date, URL, license type, use, term)

Indie developers: the conditions on "free," monetization, credit

□ "Free" = conditional. Confirm credit (CC BY tracks require it) and no standalone redistribution/streaming
□ Monetization makes it "commercial." Ad-supported blogs, monetized YouTube, paid apps, merch — all flip to commercial
   → don't reuse NC material or free-tier output (e.g., Suno)
□ Streaming: even "video BGM OK," some sites forbid "audio as the main content." Link your channel first (safelist/Clearlist)
□ Generative AI: free plans require credit and restrict commercial use. For US registration, disclaim the AI portions
□ At minimum, save the license type and source URL (your evidence when disputing a Content ID claim)

Rules for everyone (lessons from the cases)

□ "I found it online / it said free" is not a defense (Brammer)
□ Even RF/free, watch "people" and "trademarks/logos" (image and publicity rights)
□ Don't exceed caps on count, copies, or term
□ Don't pay a demand letter/Abmahnung instantly — but don't ignore it either; verify, then consult a pro if it's high or suspicious
□ Assume "a claim can happen even with free music." Keep credits strict and link your channel before publishing

Wrap-up — check, by asset, before you use

Images, music, generative AI, CC, and fonts each have different traps, but they share one thing: check before you use.

• Images: caps, and "people / logos." Music: two layers of rights and what happens after you cancel. Generative AI: "commercial use ≠ copyright" and disclosure. CC: the NC trap and SA inheritance. Fonts: permission by use. Know the axes, and most calls are clear.
• When a case is genuinely hard (a person or brand in the frame, multiple jurisdictions, bundling into a product, trademarking an AI output), don't force a self-call — ask an attorney, an IP specialist, your in-house legal team, or each provider's official channel.

A license is not just a leash on the user; it's an agreement between the maker and the user. Understand the mechanics and there's no need to be afraid. A little effort before you use prevents big trouble later.

This series also covers the pre-ship rights checklist, reading OSS licenses, and the legal boundaries of scraping.

References

Primary sources first (（primary）= official terms / statutes / government documents / party announcements; （secondary）= commentary / news). Provider terms change, so all of this reflects the state at the time of writing.

Laws and statutes

• EU AI Act = Regulation (EU) 2024/1689, Article 50 (transparency, applying 2 Aug 2026)（primary — official EUR-Lex）
• U.S. Copyright Office — Copyright and Artificial Intelligence（primary）

Stock images (official terms)

• Shutterstock — License Comparison（primary）
• Getty Images — Content License Agreement（primary）
• Adobe Stock — License terms（primary）
• Unsplash — License（primary）
• Pexels — License（primary）

Music (official terms)

• Epidemic Sound — How it works（primary）
• Artlist — License Explained（secondary）
• YouTube Help — Use songs from the Audio Library（primary）

Generative AI (official terms / government)

• Midjourney — Terms of Service（primary）
• OpenAI — Terms of Use（primary）
• Adobe — Generative AI User Guidelines（primary）
• Stability AI — License（primary）
• Suno — Paid subscription rights（primary）
• Udio — Changes associated with the UMG partnership（primary）

Creative Commons and fonts

• Creative Commons — Recommended practices for attribution（primary）
• Creative Commons — Frequently Asked Questions（primary）
• Creative Commons — CC0 1.0 Legal Code（primary）
• SIL — Open Font License (Official Text)（primary）
• Apache License, Version 2.0（primary）
• Adobe — Font licensing（primary）
• Monotype — Font licensing principles unpacked（primary）

Cases

• Brammer v. Violent Hues (USCO fair-use summary)（primary-ish）
• Carol Highsmith v. Getty Images (Artnet)（secondary）
• Agence France Presse v. Morel (Loeb & Loeb)（secondary）
• Marlene Dietrich, BGH (UT Foreign Law Translations)（primary-ish）
• Pixelio hotlink-attribution case (Kluwer Copyright Blog)（secondary）

For AFP v. Morel and McDermott, the damages figures rely on secondary sources rather than the primary judgment texts. Figures and docket numbers are subject to further verification.

AI assistance, disclosed: this article was built from points the author already worked with, using Claude (Anthropic) to help research, organize, and distill, after which the author confirmed primary sources (each provider's official terms, statutes, government documents). Points with little settled case law, or that may change as terms are revised, are flagged in the text and references. As noted, some cases rely on secondary sources.

About the author

More than 20 years of electrical and software development — from control engineering at a major electronics manufacturer — plus about 10 years of solo development. Across hardware and software, and across enterprise and individual work, I publish the basics that "become a risk if you don't know them," and I plan to cover practical ways to use AI as well. More at About this blog.