What the eSafety Commissioner said about school photos and AI in 2026.

On 28 July 2026 the eSafety Commissioner, Julie Inman Grant, published an Online Safety Advisory for schools: Sharing school imagery in the age of AI. It followed a meeting with education sector leaders about, in her words, “the challenges they face in balancing the benefits of celebrating the achievements of their school communities with taking appropriate precautions to keep staff and students safe.”[1]

That balance is the whole subject. The advisory opens with it: “A photo from a school assembly. A teacher’s profile picture. Australian schools share student and staff photos online every day to connect families, build community and showcase school life.” And it closes with it: “A school photo can still celebrate a moment and bring a community together. The decision to post it now deserves more care.”[2]

Her advisory goes further than the media release, with nine things to consider before posting: purpose, consent, identification, audience, alternatives, settings, governance, old material and storage.[2] Every one of them is a decision a school can make this term.

If a school shares a photo anywhere, it involves a level of risk. How many people can see it, how easily, whether a bot could scrape it, etc. The photo itself changes the risk profile too: is there an identifiable face, a school logo, a name, etc.

The advisory says it plainly: “A risk-based approach helps schools decide which images belong on public channels and which are better shared in a closed or restricted space.”[2]

There are two kinds of communication channels a school typically uses.

Closed, internal channels, like a parent portal or LMS. They are inherently locked down and that makes them an excellent tool for safe communication. Schools should be pushing these systems more and more.

Open, external channels, like a website, social media or OurNews. These channels are public for a purpose: they intend to reach beyond the closed walls of the school. To grandma and grandpa, to a prospective family, alumni, or to the local community.

The types of information and imagery shared on closed vs open channels must be different.

OurNews is built as an external communication tool. It’s meant to complement your internal communication by providing a significantly safer alternative to social media, a typical PDF newsletter or a website. Stories on OurNews aren’t searchable via Google, there’s no public directory of schools or stories, and a story goes only where you send it, not pushed out via an algorithm.

Who misuses school photos? eSafety says the anonymous accounts are “often believed to be current or former students from the targeted school”, and adds: “People outside the school community may also misuse images.”[2] The 2024 deepfake cases at Bacchus Marsh Grammar and Salesian College were students.[6][7] The UK extortion case was strangers who took photos from a school website.[2] A school can’t pick which one it gets, so we’ve built for both.

For strangers scraping at scale, the aim is to be a poor target. Stories on OurNews aren’t indexed or searchable, there’s no public directory, and when a story asks for an email, a stranger’s browser only ever gets the title. The photos aren’t on the page to take. We refuse AI crawlers that identify themselves and tell every other crawler the pages are not for indexing or AI training. A scraper posing as an ordinary browser still gets through. Nobody can 100% promise that a site can’t be scraped, but we can make it as difficult as possible.

For someone who already has a way in, our aim is to create behavioural friction. We want to make misuse the hard path, not the easy one. For OurNews, that means a reader must sign the visitors’ book with an email once every 90 days on each device if they want to see specific stories the school has marked. Once they’ve signed, the reader’s email gets stamped directly onto every image on the story, unless a story anyone can read shows that image too.

Research on deterrence has said the same thing for a long time: what stops impulsive behaviour is feeling sure you’d be identified, more than how harsh the penalty is or how strong the lock is.[8] In one trial, a “we’re watching” sign that anyone could walk past cut bike theft by 62 per cent.[9]

Think of it as a front-door camera. It won’t stop someone determined, but it changes what people do when they know they’ve been seen, and the one who tries anyway can be more easily identified.

Each layer makes the wrong thing a bit harder, and together they change who’s willing to try.

That’s what we’re replicating in the digital space.

A step forward is better than no step at all.

Pick one surface. Your website, or your Instagram, or the newsletter. Ask the advisory’s question of it: who can view, comment or reshare this?[2] If the honest answer is “anyone, for as long as the internet exists”, that’s the dial turned all the way up, and turning it down for that one surface is a real reduction in risk this term, before a single policy is rewritten.

Then write down why. A paragraph is enough. When the board, a parent or the regulator asks how the school is thinking about this, that paragraph is the answer, and it’s a better answer than any platform is.

And then keep telling your stories. Her advisory ends the same way: “A school photo can still celebrate a moment and bring a community together.”[2]