We Checked 100 Museum Open-Access Files: What the Licences Really Say

On 13 October 2026, GeMarkt checked the records and links for 100 museum images already labelled open or public domain. All 100 object records were readable; 99 image links answered our technical check and one returned a server error. This was a deliberately selected sample, not evidence that every museum image is free to reuse.

“Checked” needs a precise meaning here. We read the machine-readable object records, recorded their rights fields and exact image addresses, and requested each image’s response headers without downloading the full picture. We also read available institutional policy pages. We did not inspect 100 images visually, authenticate their contents or obtain a worldwide commercial-use clearance. The useful finding is how easily those different questions can be confused.

What the 100 checks included

The sample contained 40 records from the Metropolitan Museum of Art, 30 from the Art Institute of Chicago and 30 from the Cleveland Museum of Art. These institutions have public APIs: interfaces that provide structured collection records without a visitor needing an account. We chose them for that practical accessibility, not as a representative cross-section of museums.

We fixed the selection rules before checking the image links. At the Met, we sorted the European Paintings department’s object IDs and took the first 40 records with a positive public-domain flag and a primary image. That required screening 42 records. Chicago supplied the first 30 matching records in numerical ID order. Cleveland supplied a first page of 30 open-image records, which we then sorted locally. A preliminary Cleveland ordering query returned no records; we documented the corrected query before freezing the sample.

The resulting list of 100 IDs was frozen before the individual rechecks. A failure after that point stayed in the denominator. This matters: replacing an awkward response with a convenient one would make the finished results look better than the actual test.

The 100-record audit log contains the selected IDs, institution links, measured responses and timestamps. It is a data file rather than a gallery. The method is intentionally narrow, and the uneven 40/30/30 allocation carries no statistical weighting.

The results with the failed request left in

Institution	Selected records	Object records read	Image HEAD responses: 200	Other image responses
Metropolitan Museum of Art	40	40	40	0
Art Institute of Chicago	30	30	29	1
Cleveland Museum of Art	30	30	30	0
Total	100	100	99	1

HEAD is a small technical request for response information, not an image download. A 200 response means the server answered successfully; it is not a permission statement. Here, those 99 responses identified their content as JPEG images.

The remaining link, associated with Chicago’s Priest and Boy, accession 1880.1, returned HTTP 500, a server-error response. Its object record still carried a positive public-domain flag. We retained that result without substituting another artwork or repeatedly trying to make it succeed. It does not establish that the image is permanently unavailable, restricted or wrongly labelled.

All 100 rechecked records retained their positive rights indicator and supplied distinct image addresses. That consistency is useful, but unsurprising: a positive indicator was part of selection. It would be misleading to turn it into a headline claiming that “100% of museum images are cleared.”

Open metadata is not the same as an open image

Cleveland makes the distinction particularly explicit. Its API documentation says the dataset is released under CC0, while the individual image-related field can say CC0, Copyrighted or Other. Open catalogue information does not make every associated photograph open. Our 30 selected records each said CC0 in that individual field and supplied a web-image address.

Chicago’s responses contain another useful distinction: the notice treats the descriptive text separately from most other metadata, assigning the description a CC BY notice. Copying a museum’s interpretive paragraph is therefore a different act from recording its object number. Our public audit log leaves those essays out.

Even a department label needs care. The first Met item selected was a carved and gilded wooden frame, accession 07.225.393, catalogued in European Paintings. We did not silently replace it with a canvas to make the sample sound more familiar. “Museum image” is broader than “painting,” and selection by department does not change an object’s identity.

Why the policy page still matters

The Met’s open-access policy connects its public-domain artwork images and basic collection data with CC0. Cleveland’s policy likewise distinguishes open image downloads from collection metadata and images subject to other restrictions. Those explanations help interpret a flag in a record; they are not interchangeable with the flag itself.

There was an access limit at Chicago. Its public API and documentation were readable, but the main open-access page could not be fetched through our research reader, and the linked image-licensing and terms pages returned 403 responses. We did not bypass those responses or pretend to have read the current full terms. The log therefore records the observable public-domain flags, not 30 fresh, complete licence clearances.

This distinction changes the conclusion. The audit supports a reproducible record-and-link finding, not a blanket recommendation to use every selected image for every project. Our guide to CC0, Public Domain Mark and museum licences explains why these statements should not be collapsed into a single “free” label.

What a working link cannot tell you

A server can return an image successfully without proving that it is correctly identified, uncropped or suitable for a large print. This audit did not measure pixel dimensions, inspect signatures, compare colours or assess restoration. Some metadata responses include tiny preview data, but we did not extract or examine those previews. No full image payload was requested.

Nor does a recorded file size prove that the file can be reproduced unchanged later. Our hashes identify the stored metadata and response logs, not the undownloaded JPEGs. Twenty-nine HEAD responses supplied no content-length header; we left that field unknown rather than estimating it.

Creative Commons’ CC0 explanation also makes clear that a rights waiver does not eliminate every possible third-party right or imply endorsement. An institution’s statement deserves to be recorded accurately, while the intended use and relevant country still need their own consideration. This is research information, not legal advice.

Keep the evidence with the image

For someone choosing a museum file, the practical sequence is simple: identify the exact object, follow its own image link, read the statement that applies to that image, and keep a dated record. Then inspect the file you actually download. Do not use a successful connection test as a substitute for that last step.

Save the object number and source URL alongside the image, not just in an easily lost browser tab. If a future copy has a different crop or filename, those references help you establish whether it is the same source. A changed response should prompt a new check, not an assumption that an old screenshot still describes current availability.

The strongest result of this small audit is not a universal percentage. It is a visible chain of evidence, including an error and a policy-access limit. Keeping those limits attached to the numbers makes the 100 checks useful—and prevents them from promising more than they measured.