Can schools post photos of children?

What UK data protection law says

A photo in which a pupil can be identified is personal data. That brings it under the UK GDPR and the Data Protection Act 2018. The law doesn't forbid schools from using pupil photos. It sets conditions:

• Tell people up front. The ICO says pupils, or their parent or guardian depending on the pupil's age, “must be informed how the photos or videos will be used” ( ICO: taking photos in schools).
• Have a lawful basis, and say which one. The school “should explain which lawful basis they are relying on at the outset”. Consent is one option, but the ICO notes it “will not be appropriate to rely on consent in all circumstances” (ICO).
• Public schools can't lean on legitimate interests for their official tasks. The ICO says that basis “can't apply if you're a public authority handling personal information to perform your official tasks” (ICO: lawful basis). In practice most schools ask for consent for website, social media and prospectus photos.
• Offer an opt-out. The ICO recommends the school “allows pupils the opportunity to opt-out from their image being used” (ICO).

Need a form for this? Our free photo consent form for schools covers each use separately, so parents can say yes to the newsletter and no to public social media.

What about parents filming the nativity?

Data protection law “doesn't apply to the use of personal data for ‘purely personal or household activity’”. A parent posting a photo from a school event to a private account “only viewable by friends or family” is likely to be personal use. Schools can still have their own policy on whether parents may take photos at events (ICO).

What changed in 2026

On 8 May 2026 the UK Online Harms Early Warning Working Group (EWWG) published image security guidance for schools. Its members include the NSPCC, the IWF, the National Crime Agency, the Welsh Government, Education Scotland and the Safeguarding Board for Northern Ireland (UK Safer Internet Centre, Guardian).

The trigger was a real case. According to the IWF, as reported by the Guardian:

• Criminals took photos of pupils from a UK secondary school's website or social media, used AI tools to turn them into child sexual abuse material, sent them to the school and demanded money not to publish them.
• The IWF said 150 of the images from that blackmail attempt could be classified as CSAM under UK law.
• It said this was not the only such attempt it was aware of in the UK.

The EWWG said the problem is not widespread, but it is concerned it is “only a matter of time” before more schools are targeted (Guardian). In July 2026 the NCA and IWF also issued guidance cautioning parents against sharing images of their children (Tes).

Sextortion more widely is rising. The Report Remove service, where children can flag sexual images of themselves, received 394 reports from under-18s of blackmail attempts in 2025, 34% more than in 2024 (Guardian). Those cases mostly start with children being manipulated into sending images, not with school photos, but they show how the same gangs operate.

What the guidance recommends

• Remove images that show a pupil face-on, and publish images that are harder to misuse instead: pictures taken from a distance, blurred images or photos taken from behind.
• Ask “whether using imagery without children and young people's faces can still achieve your objectives”.
• Don't publish “identifiable information” such as names or faces. Avoid names or full names in captions.
• Apply privacy settings to the website and social accounts to limit who can see and share content.
• Audit images on websites, social media and promotional material regularly.
• Ask parents to re-sign image consent agreements regularly.

Source: the EWWG guidance Protecting your setting's images from AI manipulation and abuse, as summarised by the Guardian.

What Keeping Children Safe in Education says

KCSIE 2026 covers images that are “digitally altered or wholly generated using artificial intelligence, including what are sometimes described as ‘deepfakes’”, and points schools to Understanding and responding to AI-generated child sexual abuse material, guidance from the NCA's CEOP Education programme and the IWF. It doesn't set out a photo-publishing rule of its own, so a school's photo policy sits alongside its safeguarding and data protection policies.

How many schools still post pupil photos?

Most. A Teacher Tapp poll of more than 2,100 senior leaders for Tes, published in July 2026, found that 85% of primary schools share pupil photos on their websites and over half post them on social media with parental permission. Nearly 90% of secondary schools share images on their websites and over two-thirds post on public social media. More than a quarter of primaries and around a fifth of secondaries said they planned to change their policy (Tes).

“As educators we instinctively want to celebrate children's achievements … it is deeply depressing that in doing so we potentially have to contend with threats from abusers and scammers.” — Leora Cruddas, chief executive, Confederation of School Trusts (Guardian)

Your options, and what each one costs

Every route below reduces the risk. They differ in what they cost the school: in parent engagement, in staff time, or in how well the photo still tells the story.

The last option is what Safeguard Vision does for schools: you tap the children in a photo and each gets a new face of the same age and expression, so a sports day or nativity photo can go out without identifying anyone. Whatever you use, check every photo by eye before it's published.

A school photo policy checklist

Drawn from the ICO, NSPCC and EWWG guidance above:

1. Decide what you publish, where, and why: website, social media, newsletter, prospectus, press.
2. Choose and record your lawful basis for each use, and say what it is in your privacy notice.
3. Collect consent separately for each use, from parents for under-16s and from the pupils themselves where they're old enough (NSPCC). Re-collect it regularly.
4. Keep an opt-out list that staff who post photos can check quickly.
5. Default to images that don't show identifiable faces: distance shots, from behind, or faces anonymised.
6. Never put pupils' names, especially full names, next to their photos.
7. Remove location and other metadata from images before uploading (NSPCC).
8. Use school devices, not personal phones, and store images securely (NSPCC).
9. Audit the website and social accounts each term and take down anything that no longer meets the policy.
10. Write down what happens if images are misused: call the police, don't engage or pay, keep the evidence, take the originals down (Guardian, UKSIC).
11. Tell parents what you've changed and why. Most will welcome it.

Common questions

This guide is general information to help schools think about their approach. It isn't legal advice. For decisions about your school, speak to your data protection officer or a legal adviser.