ο»ΏBUSINESS FIRE DRILLS | S1EP21 | Fire Drill 20: Before User-Generated Content Creates Trouble
---
A customer sends you a gorgeous message, or tags you in a post with a photo of her results and a paragraph about how you changed her life, or her business, or her family. You screenshot it, you drop it onto your sales page. Nobody asked. Nobody said yes. And then one day she says, "Wait, where did you get that?"
That's a Business Fire Drill. And we want to run that fire drill before the fire starts. I'm attorney Tamsen Horton. I've been putting out business fires since 2011. I want to make sure that you don't get burned, your business doesn't get burned, and nothing is burning down around you.
Today's fire drill is Fire Drill 20: Before User-Generated Content Creates Trouble. Last time, in Fire Drill 19, we talked about the people you hire or collaborate with, and who owns what they helped you make. This time, it's the content from people you never hired at all. Your customers, your members, your community.
Here's the part that surprises people. User-generated content feels free. Somebody posted it publicly. They're thrilled with you. They'd probably say yes in a heartbeat. So we skip the ask, and that is the whole fire. Public is not the same as permission.
And I'm going to say this right up front, because it changes everything. We are not dealing with 2020 user-generated content. We are not even dealing with 2024. This is 2026, and user-generated content now includes AI. Content your members make with AI, content your members paste into AI, content you yourself might run through AI. And the tools are changing faster than any of us can keep up with. So today we're running the drill for the world we're actually living in.
Now, here's how every drill in this series works. We run the drill before the fire starts: D-R-I-L-L. And as we run it, we're building your fire extinguisher. Each step leaves you with something tangible in your hands, because when your house is on fire, you don't go to the store and shop for an extinguisher. You want it already on the wall. So by the end, you won't have just listened to an episode. You'll have a list of what to do and a reason to do it today. And if the fire has already started, I've got you. I will show you exactly what to grab.
Let me ask you a really important question. Why do you have a smoke detector in your house? Is it so you know about the fire before the curtains go up and the house burns down? Same here. Now, here's my follow-up question. Where's the smoke detector in your business? You live there. You occupy that space. It's supporting you financially. And you probably don't have one, because nobody told you that you needed one. Well, I built one for you. It's 11 questions. It takes about three minutes, and it shows you which fires your business is most likely to have, including the ones already smoldering. The link is in the show notes. Please, please go turn it on.
So let's say the smoke detector does go off. That's your fire alarm. Maybe it's telling you something is smoldering around content from your customers or your community. Great. That's what it's there for. Here's what that alarm looks like, sounds like, and acts like when it shows up in your business.
It looks like this. You see a great testimonial in your inbox, in your DMs, in a comment, and you think, "I'm just going to use that." Or a member posts a photo of her results in your community and you want it in your next ad. Or a member shares a PDF in your community and you realize it's someone else's paid worksheet. Or someone posts a video with copyrighted music in it, right in the space that you are running or hosting.
And in 2026, it also looks like this. A member pastes your lesson into an AI tool and posts the summary in your community. Or a member posts an AI-generated image that looks suspiciously like someone else's work. Or you take a client's testimonial and ask an AI tool to turn it into five ads. Or someone records your group call with an AI note taker, and everyone's stories end up in a tool you've never heard of. Or a customer says, "Hey, I never agreed to my words, my face, or my voice being used like that." The possibilities are truly endless right now.
And almost always, it comes down to the same thought. "It's public. It's fine." Or now, "It's just AI. It's fine."
Well, now you've heard the alarm. Here's the question that decides how you move forward: are you reacting, or are you responding?
Reacting is assuming that if someone posted it, you can reuse it, reshape it, or run it through a tool. It's ignoring the post in your community that you know shouldn't be there and hoping it quietly disappears. And if the fire has already started, reacting is deleting everything in a panic, or arguing with the person in public, or telling them they posted it so it's yours.
Responding is knowing what you actually have permission to do, including with AI. It's asking first, in writing. And it's having documents that were written for 2026, that everyone agreed to before anything went wrong.
So let's run the drill. D-R-I-L-L. And with each letter, we are building one piece of your fire extinguisher.
D: Don't react. Don't assume. Don't assume that public means permission. A customer posting a kind word about you does not automatically let you put it in an ad, on a sales page, or on a banner. And permission to use it doesn't automatically mean permission to edit it, remix it, or feed it into an AI tool. Using someone's words, their face, their photo, or their voice is a different thing than them posting it. And on the flip side, don't ignore it when a member posts something that isn't theirs, hoping it resolves itself.
So here's your first piece of your fire extinguisher. Ask first, every time. Before you feature anyone, you get a yes in writing. That's it. A reply of "yes, you can use this" counts as a start. A short release is better. And in 2026, your ask includes the question nobody used to ask: "Can I use AI tools to edit or adapt this?"
Now, and we will touch on this, I can already hear some of you saying, "There's no way. I have way too many customers. I cannot do this." Guess what? You ask permission in your purchase terms, before they're coming into your world. You include it so that as they're saying yes, it's not just "Yes, I agree to pay this amount." It's "Yes, I agree to these terms and conditions." So I do not expect those of you that get thousands of public comments to truly be asking, "Can I use this? Can I use this? Can I use this?" in the way that you might be thinking I'm talking about.
R: Record everything. Now we build the second piece of your fire extinguisher: a testimonial release, a user-generated content release, and a place to keep it. A simple release says who the person is, exactly what content you're using, where you will use it, for how long, whether you can edit it (like trimming a long testimonial), and whether they can change their mind later. Plus the 2026 line items. Can you use it with AI tools? Can you create new versions of it? Can their name, image, or voice be used or recreated with AI? One page, plain English, same one every time.
Then you keep it. A folder for these releases, named so you can find the person and the date. And keep a record of what you do in your community, too. When you remove a post, write down what it was, when, and why, and what you told the member. Digital is perfectly fine. I use Notion for my own digital infrastructure. But for anything that could bring down your life, your finances, or your business, keep a paper copy too. If you get locked out of your email or your password manager, you don't want to be locked out of your own records.
I: Identify the real risk. Here's where people get tangled up, because there are two different fires under the same name, and AI is feeding into both of them.
Fire one is you using someone else's content: the testimonial, the photo, the screenshot, the story. You need their permission, and you need to stay within what they gave you. Now let's add AI on top. Running someone's words through a tool to polish them up, rewrite them, or generate more of them goes beyond a simple repost. If they didn't say yes to that, you've gone beyond what they gave you permission for.
Fire number two is a member posting something that isn't theirs inside a space that you host. Someone else's paid course, a copyrighted image, a swiped worksheet. And now we add on AI. A member pasting your paid lessons into an AI tool and sharing the output. A member posting AI-made work and claiming it's all theirs. A member feeding other members' stories into a tool. That's a different problem, and the fix is different. You need clear rules and a way to act quickly.
Now, I love my dog. When I got my dog, the breeder told me, "Learn to bathe your own dog. Don't just book the groomer." If you've been listening along, you also know this story very, very well. Not because I'm never going to use a groomer, but because if something happens, I needed to know how to bathe my dog. Same concept here. You may use a template, you may use a lawyer, but you need to know what belongs in a release and what belongs in your terms and guidelines, so that you can tell whether what you're handed is actually doing the job.
So here's your third piece. Know which fire you're looking at and match the right document to it. A testimonial release for fire one. Community guidelines and terms for fire number two.
And here's the piece I really want you to hear. Having these documents isn't enough. Have they been updated for AI? Your testimonial release, your website terms, your community guidelines, your privacy policy: those are all publicly facing documents. Your purchase terms, your client agreements, your contractor agreements: those are your private ones. If those documents were written before AI was part of your everyday business, you are operating like it's 2020 or 2024. And it's not. It's 2026, and it's changing while you're listening to this.
So what does AI-ready look like? In plain English, your documents should say things like this. Whether members can put your content into AI tools. Whether anyone can use the community's content to train AI. Who is responsible for what a member creates with AI. Whether you can record and summarize calls with AI, and what happens to that data. And whether you can use a testimonial, a name, an image, or a voice with AI. You don't need to memorize the legal language. You need to know those questions have answers in writing.
And here's where this gets really easy for you. Your testimonial release and your user-generated content guidelines (your community guidelines) are part of the Legal Bundle Generator. The Legal Bundle Generator is one corner of your legal infrastructure. I think of legal infrastructure as a triangle, with three corners. The Legal Bundle Generator is your publicly facing documents, like your website policies, your guidelines, your releases. The Purchase Terms Generator is your private agreements with the people who buy from you or work with you. And Business Fire Drills, the very thing we're doing right now, is the third corner. Each one holds up the other two. Whatever you use, check it against that AI list. The link is in the show notes if you're curious.
L: Lead with calm. Here's your fourth piece of your extinguisher: how you ask, and how you remove.
How you ask is pretty easy. Here's the line: "I'd love to feature what you shared. I have a one-page permission form. It just says where and how I'll use it, including whether I can edit it or use it with AI tools. Is that okay?" Most people say yes, and they feel honored, not nervous. If someone hesitates, you just learned something really valuable before it went on your sales page, not after.
How you remove it is just as important. When a member posts something that shouldn't be there, don't make it personal. Take it down. Tell them privately, kindly, and clearly, and point to the guideline they agreed to. "Hey, this has to come down. It's someone else's work, and I can't host it. Here's the guideline." Same goes if it's content run through an AI tool in a way that your guidelines don't allow. That's it. No public callout, no lecturing.
L: Lock in the lesson. Here's your fifth piece of your extinguisher: make it permanent. Put community guidelines and updated terms in front of every new person at signup or purchase, and have them agree. Write down what's allowed, what isn't, who can remove content, and how someone tells you if something of theirs was posted without permission. Then build the release into the way you collect testimonials in the first place, so the ask and the yes arrive together.
And here's the 2026 part. You need to be reviewing these at least once a year. Don't just say, "Oh yeah, we've got it." With AI changing this fast, put a date on your calendar every few months to ask one question: has anything changed in how I, or my members, or my team are using AI that my documents don't yet cover? And when it has, update it, and make sure the people who already agreed to it know about it.
I'm a lawyer in the United States, and I'm talking about the United States. Now, I have always operated in the global economy, so I stay aware of what is going on worldwide. However, if you or your members are in other countries, rules around photos, names, content, and AI can be different, which is another reason to put it in writing. It is also why I always recommend, and do so myself, to follow the strictest guidelines. Some of you will probably laugh out loud when I say this, but in the United States, we are the worst when it comes to protecting people and privacy and data. And so I always tell people: operate at the highest standard, especially for those of us who have a worldwide business. Don't operate on the state standard, even though that is what you're bound to, depending on where your business is registered. It's the lowest standard, and you are leaving yourself exposed if that's what you're doing. I like to operate at the highest standard, because we are never going to be setting the bar for privacy and data laws. Not in my lifetime. I wish that was different, but I just don't see it happening.
So look at what you just built while running the drill. Number one: ask first, every time, including about AI. Number two: a testimonial release with a place to keep it. Number three: the right document for the right fire, updated for AI. Number four: a calm way to ask and a calm way to remove. And number five: guidelines, terms, and a release step that get reviewed on a schedule, so it's not depending on your memory. That's your fire extinguisher, and you built it while you were running the drill.
Now, if your smoke detector found something smoldering, or someone already said, "Wait, where did you get that?", here's what you grab. The drill doesn't change. You still run it. You're just running it with smoke in the room. Don't argue, and don't post about it. If the content is yours to remove, take it down quickly. It costs you very little. If you used someone's content, including running it through AI, and never got a yes, ask for permission now, in writing, or take it down. Do not wait. If a member posted someone else's copyrighted material in your space, remove it promptly, and keep a note of what you did and when. Write down the real history: who posted it, when, what you did, what you told them. And if it's a bigger problem, a demand letter or someone threatening to sue, get an attorney's eyes on it before you respond. Sometimes a few things are burning at the same time: a testimonial with no release, a post you knew about for weeks, and terms that never mentioned AI. That's why we do this before the fire.
Now, remember, you live in your business. It's supporting you financially. So where's your smoke detector? If this has brought up some issues to the surface, please go use the smoke detector. It is 11 questions. It takes three minutes. The link is in the show notes. The only thing I cannot do is take it for you.
Now you have three options. Option one, do nothing. Every time you've featured someone's content, you had a written yes, and your public and private documents have been updated to reflect AI. You're good. Option two, put this drill in place. That's the right choice if you've ever reposted a testimonial without asking, or your documents were written before AI. Ask first, every time, and update. Option three, send this to a friend who runs a community or loves to share customer love and has never asked. Any of those choices are valid. Pick the one that's right for you today.
Your free homework for today is two lists. First, open your website, your sales page, your social media. Make a list of every testimonial, photo, and screenshot from someone other than you. Next to each one, write whether you have a yes in writing. Second, pull up your testimonial release, your website terms, your community guidelines, and your purchase terms. Look for the word AI. If it isn't in there, you know what needs updating. Even if the lists are short, take care of this.
So tell me your story. Have you ever reposted a customer's words or photo and later wondered, "Wait, did I ask?" Or has AI changed how you handle your community's content? No names, just the story. Or even if you just have questions, you can send it through the feedback link in the show notes.
Last episode, in Fire Drill 19, we covered who owns what when a contractor or a collaborator helped you create something. If you missed it, it's linked in the show notes. And if you want the flip side, protecting your own content, Fire Drill 16 is what you want to listen to.
And coming up next, we're going to have Fire Drill 21: Before AI Use Creates an IP Mess. Because when you use AI to make your content, who owns what?
Follow the links in the show notes for the smoke detector and everything we've covered. Because business moments like this are predictable. Your panic is optional. Run the fire drill before the fire alarm goes off.
