Can You Use a Customer's Testimonial Without Asking? What to Get in Writing in 2026

A customer sends you a gorgeous message. Or she tags you in a post with a photo of her results and a paragraph about how you changed her business. You screenshot it, drop it on your sales page, and move on with your day.

Nobody asked. Nobody said yes. And then one day she writes, "Wait, where did you get that?"

That is a Business Fire Drill, and the best time to run it is before the fire starts. User-generated content feels free because it was posted publicly by someone who is thrilled with you. But public is not the same as permission, and in 2026 the stakes have a new layer: AI.

The Alarm: what this looks like in your business

It usually starts with a thought: "It's public. It's fine." You see a great testimonial in your inbox, your DMs or a comment and decide to use it. A member posts her results in your community and you want them in your next ad. A member shares someone else's paid worksheet, or posts a video with copyrighted music in the space you host.

This is not 2020 user-generated content, or even 2024. Today it also looks like a member pasting your lesson into an AI tool and posting the summary, an AI-generated image that looks suspiciously like someone else's work, you asking AI to turn one testimonial into five ads, or an AI note taker recording your group call so everyone's stories end up in a tool you have never heard of. The new thought is "It's just AI. It's fine."

Reacting or responding?

Reacting is assuming that if someone posted it, you can reuse it, reshape it or run it through a tool. It is also ignoring the post you know shouldn't be in your community and hoping it disappears. Once the fire starts, reacting is deleting everything in a panic, arguing in public, or telling someone they posted it so it's yours.

Responding is knowing what you actually have permission to do, including with AI, asking first in writing, and having documents written for 2026 that everyone agreed to before anything went wrong.

The DRILL, and the fire extinguisher you build as you run it

D: Don't react. Don't assume public means permission. A kind word about you does not automatically let you put it in an ad, on a sales page or on a banner, and permission to use it is not permission to edit it, remix it or feed it into an AI tool. Extinguisher piece 1: ask first, every time, and include the AI question: "Can I use AI tools to edit or adapt this?"

Have thousands of customers? You don't message each one. You build the permission into your purchase terms, so that "yes, I agree to pay" is also "yes, I agree to these terms."

R: Record everything. Piece 2: a one-page release and a place to keep it. A simple release says who the person is, what content you are using, where, for how long, whether you can edit it (like trimming a long testimonial) and whether they can change their mind. Add the 2026 line items: can you use it with AI tools, create new versions of it, or recreate their name, image or voice with AI? Keep the releases in a named folder, log what you remove from your community and why, and keep a paper copy of anything that could bring down your business.

I: Identify the real risk. Piece 3: match the right document to the right fire. There are two fires under one name, and AI feeds both. Fire one is you using someone else's content, and running their words through a tool goes beyond a simple repost if they never said yes to that. Fire two is a member posting something that isn't theirs in your space, like a paid course, a copyrighted image or your own lessons pasted into AI. Fire one needs a release. Fire two needs community guidelines and terms.

Here is the piece I most want you to hear: having the documents isn't enough. Have they been updated for AI? Your testimonial release, website terms, community guidelines and privacy policy are your public documents. Your purchase terms, client agreements and contractor agreements are your private ones. If they were written before AI was part of everyday business, you are operating like it's 2020. In plain English, they should answer these questions in writing:

• Can members put your content into AI tools?
• Can anyone use the community's content to train AI?
• Who is responsible for what a member creates with AI?
• Can you record and summarize calls with AI, and what happens to that data?
• Can you use a testimonial, name, image or voice with AI?

L: Lead with calm. Piece 4: a calm way to ask and a calm way to remove. To ask: "I'd love to feature what you shared. I have a one-page permission form. It just says where and how I'll use it, including whether I can edit it or use it with AI tools. Is that okay?" To remove: take it down, tell the member privately and kindly, and point to the guideline they agreed to. No public callout, no lecture.

L: Lock in the lesson. Piece 5: make it permanent. Put community guidelines and updated terms in front of every new person at signup or purchase, build the release into how you collect testimonials so the ask and the yes arrive together, and put a date on your calendar every few months to ask: has anything changed in how I, my members or my team use AI that my documents don't cover yet?

A note on geography: I am a lawyer in the United States and I am talking about the United States. If you or your members are elsewhere, the rules on photos, names, content and AI can differ, and I recommend following the strictest standard that applies to your audience rather than the lowest.

If it's already on fire

You still run the drill, just with smoke in the room. Don't argue and don't post about it. Take down what is yours to remove. If you used someone's content, including through AI, without a yes, ask now in writing or take it down. Remove copyrighted material from your space promptly, and write down the real history: who posted it, when, what you did and what you told them. If there is a demand letter or a threat to sue, get an attorney's eyes on it before you respond.

Your next right decision

Do nothing, if every feature has a written yes and your public and private documents are updated for AI. Put the drill in place, if you have ever reposted a testimonial without asking or your documents predate AI. Or send this to a friend who runs a community and has never asked.

Free homework: make two lists. First, every testimonial, photo and screenshot on your site and socials from someone other than you, with whether you have a yes in writing. Second, pull up your testimonial release, website terms, community guidelines and purchase terms and look for the word "AI." If it isn't there, you know what needs updating.

Keep Exploring

• Fire Drill 19: Who Owns Your Course If a Contractor or Collaborator Helped Make It?
• Fire Drill 16: Someone Copied Your Content? Why You Can't Stop It and What to Protect Instead
• The Terms and Conditions for Your Online Courses, Memberships and 1:1 Services
• Why I Updated My Purchase Terms After Kajabi Backstage Changed Everything
• The 4 Legal Pages Your Kajabi Site Needs
• Using Licensed Content in Your Kajabi Business

Listen to the Business Fire Drills Podcast

Where is the smoke detector in your business?

Eleven questions, about three minutes, and it shows you which fires your business is most likely to have. Run the Smoke Detector at tamsenhorton.com/business-fire-drills. Business moments are predictable. Panic is optional.

This post is general educational information, not legal advice for your situation. Laws vary by state and country.