Student image policy for schools in 2026: three problems, not one.

This is the infrastructure problem. Whose phone took the photo, and where does it sync? Where are the photos stored, and who can open that folder? Are they filed so you could find one particular child? When someone pulls a photo out, is there a record?

This problem is the responsibility of ICT. Thankfully, it’s more black and white, because best practice and policy guidelines typically exist (depending on your particular jurisdiction).

Here’s one test. If a family withdrew consent today, could you find every photo of their child by Friday?

The Australian eSafety Commissioner’s July 2026 advisory poses three specific questions about this problem: whether original images are “stored securely and handled in line with school or sector policies for data retention and disposal”, who “may post, approve and moderate content”, and whether “archived pages or past posts still need to remain public”.[2]

This is a behavioural problem, which means it’s a little more grey. We think about this as risk reduction, not risk elimination. eSafety agrees: “Posting fewer images of school students and personnel – or none at all – can reduce the risk. It cannot remove the risk completely because images may still be available from other public sources.”[2]

It’s tempting to imagine this kind of threat as a shadowy figure in a basement; but we know that isn’t the reality most of the time. The eSafety advisory describes an overseas case where criminals took student photos from a school website to build an extortion attempt.[2] But the same advisory says who is usually behind the anonymous accounts it gets reports about: “Those running the accounts are often believed to be current or former students from the targeted school. People outside the school community may also misuse images.”[2]

In the Australian deepfake cases that reached the news in 2024, Bacchus Marsh Grammar and Salesian College, the person responsible was a student of the school.[6][7]

So the question isn’t only how to keep strangers out. It’s also what makes misuse harder for someone who already has a way in.

Three questions to help you wrestle with this problem:

What level of risk is acceptable to us on the different platforms that we communicate via? What have we done to reduce it? And how do we explain that to parents, staff and students?

This problem is all about consent. We think about consent being given by both parents/carers AND students. Queensland’s state school consent procedure already asks the student to sign too, where they are old enough to give and understand the consent.[5]

Consent has to be specific. Your different channels/surfaces each should have specific consent based on their inherent risks and exposures. Think social media, vs website, vs a prospectus, vs an internal LMS. The eSafety advisory asks “Is consent active, informed and current? Does it cover school social media posts?”[2] Moores, a law firm that advises schools, has written that opt-out boxes “often lead to unwitting, and ultimately invalid expressions of consent”, and that a set-and-forget consent gathered at enrolment years ago isn’t current.[3] The draft Children’s Online Privacy Code, if it is legislated, would cap how long a consent stays ‘live’ at 12 months.[4]

The advisory lists nine things to consider before posting.[2] Here they are, mapped to our three problems: