I would imagine there is a list of characters that Universal has licensed. It will be clear to them what can be used and not used. I had read that as long as the characters were used in some shape or form at Universal, then they could not be used by anyone else east of the Mississippi, or something like that. And that contract was to last until Universal broke it off.
Here is some info I found:
Deadline Hollywood's Nikki Finke has the list of characters specifically licensed for Universal's theme parks:
For starters, here's the main list of licensed characters at Marvel Island inside Universal Orlando's Islands Of Adventure (provided me by Universal): Spider-Man (also attraction), Dr. Doom (also attraction), Hulk (also attraction), Storm (also attraction), Captain America, Cyclops, Green Goblin, Rogue, Storm, Wolverine, "and lots more if you include stores and dining," a Uni exec tells me.
Paramount tells me Iron Man and Thor also are included.
According to other sources, here are the characters by Attractions, Walk Around, and Shop:
Attractions (Characters licensed for the attraction use, but not necessarily for walk-around. Some in the attractions list are also licensed for walk-around, but not all.): Spider-Man, Doc Oc, Scream, Electro, Hydro-Man, Hobgoblin, J. Jonah Jameson, Hulk/Bruce Banner, Dr. Doom, Fantastic Four (as a group, not individually), Storm, Magneto, Professor X.
Walk around and/or Shop: Green Goblin, Cyclops, Rogue, Wolverine, Fantastic 4 (restaurant / walk around), Captain America (restaurant / walk around), Kingpin (shop / walk around), Merch (shop)