The photo on your website isn't yours: image copyright and who gets the bill

It usually arrives as a PDF attached to a very polite email with your domain name in the subject line. Inside is a screenshot of your own website with a red box drawn around one photo — often a stock shot of a smiling technician somebody dropped in three years ago — a claim reference, and a number. Welcome to image copyright enforcement, the part of owning a website that nobody mentions during the sales call. The money is not the shocking bit. The shocking bit is the answer to the first question everyone asks: my designer chose that picture, so this is their problem, right? No. It's yours. And the companies that send these letters put that in writing on their own websites.

A caveat before anything else, because it matters: I build websites, I am not a lawyer. What follows is the working knowledge of somebody who has read the Copyright Act, read what the enforcement companies publish about themselves, and had to explain both to business owners who did nothing wrong except trust the person who built their site. If a letter has actually landed on your desk, take it to a lawyer. Read this first so the conversation is a short one.

My web designer chose the photo. Why is the letter addressed to me?

Because you are the one publishing the page. Every enforcement company works from the same rule: the end user is responsible for what appears on their own website, whether or not somebody else supplied the image. They will not chase your designer unless the designer volunteers to be chased. If you believe your designer owes you for this, pursuing them is your job — not the rightsholder's.

This is not my interpretation. PicRights, one of the agencies that sends these letters on behalf of image owners, answers the question directly in its own FAQ: "It doesn't matter if someone else who designed your website provided you with the image or whether you knew about our client's rights in the work before using it. As the end user, you're responsible for the content of your website and for paying the appropriate license fees." And then the sentence that decides how your week goes: "We won't contact the designer to reach a settlement unless the designer agrees to take responsibility for the claim and has the means to do so. If you believe the designer is responsible, the onus is on you to contact the designer."

The same page closes two other doors people reach for. Buying a design template doesn't help — "you're still responsible for the claim if that company didn't properly license the image to include your use." Neither does not making money from it: "Making money from the use of an image is irrelevant when determining whether the use was an infringement."

Here is the part worth understanding properly, because it changes what you should ask for at the start of a project rather than the end. A contract between you and your designer is a private agreement. It can absolutely say the designer carries the cost of a claim like this, and a decent one does. What it cannot do is bind a photographer who never signed it. The rightsholder's claim runs against the publisher; your claim runs against your designer; those are two separate arguments and you may end up having both. It is the same structural point as who actually owns your website — the paperwork you never asked for is the paperwork that saves you later.

Is this letter real, or is it another scam?

Both exist, and they look nothing alike once you know what to compare. A genuine claim names one specific image, shows you a dated screenshot of the exact URL it sat on, names the copyright owner, and carries a claim reference from a company that has a real office and a real phone number. A scam wants urgency and a click.

The fakes lean on the same reflex the fake SSL-renewal invoices do — see website security basics for that whole genre. Typical tells: no particular image is identified, the message threatens to take your site offline today, payment is requested by e-transfer to a personal address or by cryptocurrency, or the entire message is a link that "shows the infringing content." That last one is often a malware lure rather than a copyright claim at all.

Verify without touching the message. Search the company's name yourself rather than using the phone number or link they gave you. Open your own site and confirm the image is actually there. Then run the image through a reverse image search and see where else on the internet it lives — if it turns up in a wire-service or stock library, the claim is very likely genuine, whatever you think of the tone.

I deleted the photo. Isn't that the end of it?

No, and this is the single most common misunderstanding. Copyright infringement is about the period the image was published, not about whether it is still there today. Removing it stops the clock; it does not undo what is already on the meter. Every enforcement company treats removal as a precondition of settlement rather than a substitute for one.

PicRights states it in one syllable: "Is the problem solved if I remove the image? No. While removing the image is a starting point and a condition of settlement, it doesn't solve the problem. The use of copyrighted images requires proper licensing to cover any and all uses."

One practical order of operations, because people get this backwards in a panic. Screenshot the page before you change anything — the full page, with the URL and the date visible. Then note when the image went up and where it came from, if you can reconstruct that from your designer's emails. Then take it down. If you delete first and document second, you have destroyed your own record of a use you may later need to describe accurately, and "I don't remember what was on that page" is a bad sentence to say to anybody.

What can one photo actually cost in Canada?

Under section 38.1 of the Copyright Act a rightsholder can elect statutory damages instead of proving actual loss. For infringements made for commercial purposes — which a business website is — that is "not less than $500 and not more than $20,000 that the court considers just, with respect to all infringements involved in the proceedings for each work." Per work, not per view.

Two provisions in the same section pull hard in the other direction, and neither one appears in the letter you received. The first is subsection (2): if you "satisfy the court that the defendant was not aware and had no reasonable grounds to believe that the defendant had infringed copyright," the court "may reduce the amount of the award under paragraph (1)(a) to less than $500, but not less than $200." Ignorance is not a defence to the infringement itself — you still infringed — but Parliament wrote a specific discount for the person who genuinely didn't know, which is exactly the business owner whose designer supplied the file.

The second is subsection (3), which lets a court go lower still where there is more than one work in a single medium and even the minimum "would result in a total award that, in the court's opinion, is grossly out of proportion to the infringement." That is not theoretical. In Trader v CarGurus (2017 ONSC 1841), an Ontario Superior Court case over vehicle photographs republished on a competing site, the plaintiff asked for $500 per photo and was awarded $2 per photo across more than 150,000 images, on exactly that reasoning.

Be careful how far you carry that comparison. CarGurus was a mass-scraping case where the "single medium" provision did the heavy lifting; one stock photograph on a contractor's About page is a different shape of file entirely, and nothing here predicts what any particular claim settles at. What it does tell you is that the figure printed on a demand letter is a request, not a judgment, and that Canadian courts have shown themselves entirely willing to price these things far below the ask.

One more line from the Act that nobody quotes and everybody should. Subsection (5) tells the court to consider "the good faith or bad faith of the defendant" and "the conduct of the parties before and during the proceedings." Translated: how you behave from the moment the letter arrives is itself a factor in the number. Ignoring it for four months, or firing back something satisfying, is not free.

The letter is written to sound like an invoice. It is a claim — and in Canada the law that prices it is on a public website you can read in ten minutes.

My hosting company forwarded the notice. Is that different?

Yes, meaningfully. Canada runs a notice-and-notice regime, not the American notice-and-takedown. A copyright owner may send a notice to your internet provider, to whoever hosts the page, or to a search engine, and that intermediary's statutory duty is to pass it along to you and keep records — not to pull your page down.

The interesting part is what such a notice is forbidden from saying. Section 41.25(3) of the Copyright Act is unusually blunt: a notice of claimed infringement "shall not contain (a) an offer to settle the claimed infringement; (b) a request or demand, made in relation to the claimed infringement, for payment or for personal information; (c) a reference, including by way of hyperlink, to such an offer, request or demand." That prohibition was added in 2018 precisely because the forwarded-notice channel was being used to deliver settlement demands with the implied authority of your own ISP behind them.

So the practical triage is: how did it arrive? Forwarded by your host or ISP, and containing a dollar figure? That notice does not comply with the section it is riding on, and forwarding it gave it no legal force it didn't already have. Mailed or emailed straight to your business by a law firm or an enforcement agency? Then it is an ordinary civil demand, section 41.25 has nothing to do with it, and the prohibition above does not apply. Same words, completely different weight, and the only way to tell them apart is the envelope.

What a compliant notice must contain, incidentally, is a useful checklist for judging any claim: the claimant's name and address, the work in question, the claimant's interest in the copyright, the location data for the page, the infringement claimed, and the date and time it happened. A "notice" missing half of that is worth asking questions about.

How do I check what's already on my site?

Inventory first, panic never. Most small business sites have somewhere between fifteen and sixty images, and the vast majority are either your own photos, your logo, or icons that came with the theme. The job is to find the handful you cannot account for, and it is an afternoon's work, not a project.

1. List every image, page by page. Homepage, services, about, gallery, blog. Write them down; a list you can tick is worth more than a vague memory of "mostly our own stuff".
2. Sort them into three piles. Photos you or your staff actually took. Images with a licence you could produce today if asked. Everything else. Only the third pile matters.
3. Reverse-image-search the third pile. Right-click, "Search image with Google", or use TinEye. A photo that appears on hundreds of unrelated sites, or inside a stock library, is the risky kind. A photo that appears nowhere else is almost certainly yours.
4. Ask your designer in writing for the source and licence of each image they supplied. If they sourced properly this takes them ten minutes. If the reply is vague, that is your answer, and it tells you something about the rest of the build too — the same instinct behind vetting a designer before you hand over money.
5. Replace anything you can't account for — before somebody else finds it. Replacement is cheap. A claim is not.
6. Keep the receipts in one folder, stored where the domain and hosting logins live, not in the designer's Dropbox. Licences you cannot find are licences you do not have.

Where do I get photos I'm actually allowed to use?

Four honest routes, in the order I'd recommend them. Your own camera wins on every axis that matters for a service business, and it is not a close contest — but the free libraries are genuinely usable if you read what their licence says rather than what the word "free" suggests.

Now the trap that catches careful people, because it isn't a copyright question at all. A free licence gives you the photographer's permission. It does not give you the permission of the person in the photo, or of the brand on the van behind them. Putting a stranger's face on your clinic's homepage above the words "our patients" is a different kind of problem from an unlicensed download, and no stock licence fixes it. If a recognisable human being is the point of the photo, either it is your own staff and client with their agreement, or you need to know a release exists.

AI-generated images sidestep the photographer entirely, which is a real advantage, and they carry their own open questions about what the model was trained on. They also, still, look like AI to anyone who spends time online — six-fingered handshakes have mostly gone, but the uncanny gloss hasn't. For a service business the honest answer is the one I keep giving in preparing content and photos for a new site: a phone photo of your actual crew on an actual job outperforms every library on earth, because it is the only image on the page a competitor cannot also buy.

What should the next contract say?

Two clauses, in plain words, and neither needs a lawyer to draft. First: every image, font and icon the designer supplies is either original or licensed for this use, and the licences are handed over with the site. Second: if a claim arrives because of something they supplied, they deal with it. Ask for both before the deposit, not after the launch.

And then the unglamorous truth about indemnity clauses: they are only as good as the business standing behind them. A promise from a freelancer who has since moved to another country and stopped answering email is a promise you cannot collect on, which is a specific and familiar failure mode — see what to do when the person who built your site stops replying. So treat the clause as the second line of defence and the receipts folder as the first. On every site I build the image sources are documented and handed over with the rest of the assets, which is part of what a web design project should include and part of what ongoing maintenance and support keeps current; both are priced openly on the pricing page so you can see exactly what you are getting.

Frequently asked questions