Picture this. It’s sports day. Your seven-year-old crosses the finish line first, arms wide open, face flushed with joy. The school photographer snaps the moment. By Monday morning, that image sits on the school’s website, Facebook page, or Instagram grid, tagged with your child’s name and year group. It feels like community. It feels like celebration. But here in 2026, a harder conversation is finally catching up with that warm, familiar scene.
For years, primary and secondary schools across the UK and beyond have routinely published photographs of their pupils online, with little more than a tick-box consent form standing between a child’s image and the wider internet. Now, as digital safety advocates and child protection specialists grow louder in their warnings, the question is no longer just whether schools can post these photos. It’s whether they fully understand the risks of doing so. The BBC has been examining this issue closely, exploring how images shared with the best of intentions could potentially be misused in ways most parents have never considered.
The Consent Illusion
Most schools send home a media consent form at the start of the academic year. Parents tick yes or no. Job done. But the reality of how that consent holds up online is far more complicated than a single checkbox suggests.
When a school uploads an image to its website, that photo becomes publicly accessible. Search engines can index it. It can be downloaded, cropped, and shared by anyone with an internet connection. The school’s own privacy settings offer some protection, but a truly locked-down digital presence is rarer than most parents realise. Social media platforms offer even fewer guarantees. Even when schools post to closed groups, screenshots are instant, sharing is effortless, and the image quickly escapes the intended audience.
Then there is the metadata problem. Many digital photographs carry embedded information, including the time, date, and sometimes even the GPS coordinates of where the photo was taken. Most schools strip this out before uploading, but not all do. A single overlooked image could, in theory, confirm a child’s location on a routine basis.
Who Is Actually Looking?
The uncomfortable truth is that nobody really knows. The internet does not discriminate between a proud grandparent viewing a nativity play photograph and someone with far more troubling intentions. Child protection charities have spent years documenting cases where publicly available images of minors were harvested from legitimate sources, including school websites, and repurposed without consent.
Facial recognition technology has added a new layer of concern. Software that can match a face across multiple images, originally developed for law enforcement, is now commercially available and increasingly cheap to access. An image posted on a school’s Facebook page today could theoretically be cross-referenced against other publicly available images to build a profile of a child’s movements, habits, and social connections. That is not a dystopian scenario from a thriller novel. It is a technical possibility that exists right now.
The AI Dimension
Artificial intelligence has sharpened the risk further. Generative AI tools can take a photograph of a real person and manipulate it in ways that are deeply distressing. Child protection experts have flagged a rising number of cases in which images of real children, sourced from public-facing websites including schools, have been processed through these tools. The consequences for the children involved, and their families, can be severe and lasting.
This is not about blaming schools. Most are sharing photos out of genuine pride in their pupils and a desire to keep parents connected. But good intentions do not neutralise risk, and many schools are operating digital communications policies that were written years before the current technology landscape existed.
What Schools Are Getting Right, and Where the Gaps Are
Some schools have already moved to significantly tighten their approach. Password-protected parent portals, watermarked images, strict no-name policies for public-facing photos, and annual reviews of digital consent forms are among the steps more cautious institutions have adopted. A handful of schools have gone further, stopping the publication of identifiable pupil images on open websites entirely.
But practice varies enormously. In many cases, the school’s digital safeguarding policy is a document that was drafted once, filed away, and rarely revisited. The member of staff responsible for social media may have had no formal training in digital child safety. And the parents signing consent forms are rarely given enough information to make a fully informed decision about what they are actually agreeing to.
The Role Parents Can Play
Parents are not powerless here. Under existing UK data protection law, including provisions that align with GDPR principles, parents can withdraw consent for their child’s image to be used at any time. Schools are legally obliged to act on that request. It is worth asking your child’s school directly: where are photos published, how long are they kept, who has access, and what happens to older images that may still be indexed by search engines?
It is also worth searching for your child online. Type their name alongside the school’s name and see what surfaces. You may be surprised by what is publicly visible. If you find images you are uncomfortable with, you have the right to request their removal.
A Broader Cultural Shift Is Needed
The deeper issue is cultural. Schools, like many institutions, have embraced social media as a communication tool without fully reckoning with the responsibilities that come with it. Posting a photo of a child is not the same as sending a letter home in a sealed envelope. It is broadcasting to an audience that extends far beyond the school gate, and it leaves a digital trail that can persist for years.
That does not mean schools should stop celebrating their pupils. Community, pride, and connection matter enormously in education. But those values and digital safety are not mutually exclusive. With the right policies, the right training, and a more honest conversation with parents about what online sharing actually involves, schools can do both.
The photographs will keep being taken. The question is whether the systems protecting the children in them are keeping pace with the world those images are being released into. As a parent, a teacher, or simply someone who cares about child safety in the digital age, this is the moment to start asking that question out loud. What does your child’s school actually know about where their photos end up?
