Walk past almost any primary school’s website today and you will find a gallery. Smiling faces at a science fair. A football team squinting into the sun. A class of seven-year-olds dressed as historical figures. For the schools themselves, these images serve a clear purpose: they build community, attract prospective families, and celebrate pupil achievements. For parents scrolling through at work, they offer a small, warm window into their child’s day. Nobody posts those pictures expecting harm.
But harm, as digital safety researchers and child protection advocates have been arguing with increasing urgency, does not always announce itself. The same image that delights a grandmother can, under different circumstances and in different hands, become something far more troubling.
A Habit That Pre-Dates Modern Awareness
Schools began putting photographs online well before most institutions had any coherent policy on digital privacy. Social media was young, data protection law was not yet fit for the internet age, and the dominant instinct was to share freely. That instinct has not entirely changed. A large number of schools across the UK and beyond still publish images of identifiable children without robust frameworks governing how long those photos stay up, who can download them, or what metadata is attached.
Metadata is a detail worth pausing on. Many photographs uploaded directly from a camera or smartphone carry embedded information including the precise location where the shot was taken. Even when a school crops or resizes an image, that data can survive. A bad actor with basic technical knowledge can extract it in seconds.
The Specific Risks Experts Point To
The misuse of children’s images online takes several forms, and not all of them are the most obvious ones. Yes, there is the risk of images being harvested by predators, and that risk is real and documented. But there are other angles that receive less public attention.
Image-based grooming is one. When an adult has access to a library of photographs showing a specific child, including what the child looks like now, what school they attend, what sports kit they wear and what their friendship group resembles, building a false sense of familiarity becomes significantly easier. The photos themselves do not cause the harm, but they lower the friction for those who intend it.
There is also the issue of consent, which the BBC’s Tech Life podcast has examined as part of a wider conversation about how schools handle pupil data in the digital age. Children cannot meaningfully consent to their image being published publicly, and while parents sign permission forms, many do so without fully understanding what that permission covers or for how long it applies. A form signed when a child starts school at four could technically authorise their image appearing online until they are eleven.
The Problem With “Just Remove It”
One response schools often reach for is simple: if a parent objects, the image comes down. That sounds reasonable. In practice, it is often already too late. Once an image is indexed by a search engine, shared to a parent WhatsApp group, or screenshotted by anyone who happened to visit the page, it escapes the school’s control permanently. Deletion from the source does not equal deletion from the internet.
This is a structural problem, not a human error problem. The architecture of the modern web was not built with child protection as a foundational principle. It was built for sharing.
What Good Practice Actually Looks Like
Some schools have moved to password-protected platforms where only verified parents can view images. Others use closed apps rather than public websites. A smaller but growing number have adopted a policy of never photographing children’s faces at all, opting instead for hands-on-work shots, classroom scenes shot from behind, or illustrations. These approaches are not without their own complications, but they reflect a more honest reckoning with the risks.
Regulators have also started paying closer attention. Data protection authorities in several European countries have issued guidance specifically addressing how schools should handle images, and the UK’s Information Commissioner’s Office has made clear that publishing identifiable photos of children constitutes processing of personal data under existing law, with all the obligations that entails.
The Wider Question of Children’s Digital Footprints
School photos are one piece of a much larger picture. Many children today have a digital footprint that stretches back to before they were born, with parents posting scan images, birth announcements, and early childhood moments across social platforms. By the time a child is old enough to understand what a digital footprint is, they already have years of documented, searchable history they never agreed to create.
This is sometimes called “sharenting,” and the debate around it has been running for several years without reaching any real resolution. What makes the school context distinct is the institutional dimension. When a parent shares a photo of their own child, that is a private decision with private consequences. When a school publishes a photograph, it does so in an official capacity, with an implicit suggestion of trustworthiness and authority. The reputational weight of that context can make parents less likely to question it.
What Parents Can Do Right Now
If you have a child at school, there are a few practical steps worth taking today. Request a copy of your school’s photography and image policy, if one exists, and ask specifically where images are published and for how long they are retained. You are entitled under data protection law to request that existing images of your child be removed. Most schools will respond cooperatively.
It is also worth searching your child’s school name in Google Images to see what is already publicly visible. The results can be surprising, and sometimes alarming, for parents who assumed school photos lived only on a closed section of the school website.
None of this is about manufacturing panic. Schools are not adversaries. Most are doing what they have always done, which is celebrate their pupils’ lives. The problem is that the world those practices evolved in no longer exists. The internet of 2026 is a fundamentally different place from the internet of 2006, and habits formed in one era carry different consequences in another.
The real question worth sitting with is this: if your child, at eighteen, could see every photograph their school ever published of them online, would they feel their privacy had been respected, or would they feel they never had a say in their own story?
