Dr Leon Furze

I don’t usually give parenting advice on this blog. But this conversation has come up so often lately that I thought it was worth a post, both from my perspective as an educator and as a parent of three young children.

I work with schools all over Australia, and many of them are wrestling with how they share photos of students online and on social media. It’s a complex topic, and there are some pretty strong opinions out in the media and school car parks across the country. There are also some proposed law changes on the way: some could take effect as early as December this year, and others will probably roll out in 2027.

In this post, I’ll explain why my wife and I opt our children out of social media and online photo sharing. I’ll also look at what schools are doing, how the issue connects to artificial intelligence and image generation, and what’s coming down the line in Australian privacy law.

One of those parents

When I was a school leader, I remember the trials and tribulations of sending out excursion forms, medical information forms, and media consent forms at enrolment and at the start of every year. Over the 15 years I worked in schools, that process changed a lot: from paper forms sent in the mail, to paper forms sent home with the eldest child, to digital forms on a learning management system, to the online forms usually delivered by text message today.

Chasing those forms was hard enough. Actually putting them into practice and adhering to them as a school was a nightmare. When one of those parents opts their child out of media consent, it affects everything from swimming and athletics carnivals to performances, assemblies, award ceremonies, and general day-to-day marketing. Students needs to have their faces blurred, can only be photographed with faces hidden or turned away, or have to be carefully edited out of finished photos.

There are all kinds of reasons why parents opt their children out of media sharing. Sometimes there is a genuine child safety concern. Other times it comes down to the parents’ personal attitudes towards photo sharing and digital consent.

And now, I am one of those parents. My reasons are, of course, influenced by my work, which intersects with both social media and artificial intelligence.

Why we opt out

My wife was filling out one of those forms recently, and they’re pretty complicated. There were options for sharing within the school and outside of it, online and in print, in groups and individually, and so on. I don’t need to imagine how difficult it is for a school to implement all of those fine-grained conditions about who can be photographed when and where, because I’ve been there.

But there are very good reasons for opting children out of photo sharing in certain online spaces.

The first, and the one most in my wheelhouse, is AI-enabled image-based abuse. Since around 2018, AI image generation has developed at an incredibly fast pace. Creating a deepfake used to require hundreds of thousands of photos of the person being faked. Now it takes one image.

I created the abomination above in Google Gemini. Gemini is a reasonably safe platform, with guardrails that stop you generating explicit or violent images, and the mainstream image generators, including ChatGPT, Midjourney, and the image generation built into platforms like Canva, are generally safe in this sense. Even so, Gemini didn’t ask for any proof that this was a photo of me before I manipulated it. There was no authentication process. Anyone could have uploaded that photo and edited it.

What’s more problematic is the sheer volume of applications out there with no guardrails at all. Openly released image generation models mean that anybody can copy them and build their own image generation apps, with none of the protections the big companies put in place. (If you think you’d be able to tell the difference, have a go at spotting an AI-generated image.)

Can You Spot an AI Generated Image?

And the data these models learn from is far from clean. Image generators are trained on enormous collections of images scraped from the internet, and the internet is, of course, full of pornography. Many models draw on the same handful of open datasets, and at least one has been shown to contain child sexual abuse material. In December 2023, Stanford Internet Observatory researchers found 3,226 suspected instances of child sexual abuse material in LAION-5B, a dataset of more than five billion images used to train models including Stable Diffusion. More than a thousand were confirmed by external organisations, and LAION took the dataset offline.

The same dataset also contained ordinary family photos of real children. In 2024, Human Rights Watch reviewed a tiny fraction of LAION-5B (less than 0.0001%) and found 190 identifiable photos of Australian children, from newborns to students dressed up for Book Week. One caption gave two children’s full names, their ages, and the name of their preschool. Some of the images came from school and family pages that weren’t easily found through public search. A parallel investigation in Brazil found 170 more. LAION removed the photos it was told about, but models that have already been trained on them can’t unlearn them.

A technology trained on explicit material can be used to generate explicit material, and it’s now capable of doing so with a single photo. So my main reason for not posting images of my children online is simple: once those images are out there, anyone can use them in any way they choose.

I’m not suggesting for a second that someone in my local community, or in my children’s school communities, would definitely do this. But in terms of risk mitigation, the easiest way to avoid it is to limit exposure to the risk in the first place.

Real or Fake? The AI Deepfake Game

Social media and privacy

There’s another reason we keep our children’s photos offline. Social media companies, and in particular Meta, which owns Facebook, Instagram, WhatsApp, and a growing host of AI tools, are notoriously cavalier about users’ privacy.

Facebook spent years running facial recognition on users’ photos. It only shut the system down in 2021, deleting the face templates of more than a billion people, after a US$650 million settlement under Illinois’ biometric privacy law. In September 2024, Meta’s global privacy director told an Australian Senate inquiry that the company uses Australians’ public Facebook and Instagram posts, going back to 2007, to train its AI models. Accounts belonging to under-18s are excluded. But under questioning, Meta conceded that photos of children posted by adults are included. European users were offered an opt-out. Australians were not.

Meta isn’t alone. Here are a few more examples of what has happened to people’s photos, sourced by a very quick Claude research task:

• In 2019, the New York Times traced family photos of children uploaded to Flickr in the mid-2000s into MegaFace, a dataset of millions of images that companies downloaded to train facial recognition systems. Researchers valued children’s faces precisely because they are harder for these systems to recognise.
• In 2021, the Australian Information Commissioner found that Clearview AI breached Australians’ privacy by scraping billions of images from social media and the web for its facial recognition tool.
• Also in 2021, the US Federal Trade Commission ordered the photo storage app Ever to delete the facial recognition models it had built from users’ photos without proper consent.
• Photobucket is currently facing a class action over plans to license its archive of more than 13 billion user photos for AI training. The plaintiffs include people pictured in those photos who never had an account, and so could never opt out.

Edtech has its own record with children’s data more broadly. In 2023 the FTC found that the learning platform Edmodo used children’s personal information for advertising without parental consent. And a 2022 Human Rights Watch investigation found that 145 of the 163 learning products that governments endorsed during COVID sent children’s data to third parties, mostly advertising technology companies.

My children are mostly too young to grasp concepts like image scraping or the training of machine learning models, so they can’t knowingly consent to their images being used that way. In my opinion, that means the default position should be to opt out.

What schools are doing

Among the parents I talk to, there’s a growing sentiment that the default for sharing images of children online should be: just don’t. But there’s also a big community of parents who love seeing photos of their kids and their peers at sport, productions, and everything else schools do. Schools are stuck in the middle. They want to do the right thing from a child protection perspective, but they also want to build spaces where the community can see the school doing what it does best.

Several Australian schools have now publicly changed their position.

I’ve had the pleasure of working in the past with St Hilda’s Anglican School for Girls in Perth, and they have been very proactive about artificial intelligence and digital technologies more broadly. From the start of 2026, St Hilda’s removed identifiable images of students from its public social media channels. Instead, the school uses side profiles, silhouettes, the backs of heads, distant group shots, creative filters, and stock photography, and families can see the full set of photos in secure, password-protected galleries. The school pointed to cases where images taken from schools’ public social media had been altered with AI into harmful deepfakes, and Principal Fiona Johnston told 6PR the change was a response to that growing threat. This was a precaution, not a reaction to an incident involving its own students.

In April, the ABC reported that an independent girls’ school in Brisbane had moved to sharing only unidentifiable shots of students, from the side or behind, because of concerns that generative AI could be used to turn ordinary photos into child exploitation material. Criminologist Danielle Harris welcomed the move. eSafety’s response was more measured: schools were right to be cautious, a spokesperson said, but that didn’t mean they couldn’t celebrate their communities online. Sharing in a controlled way, such as on private platforms, was one option.

In Canberra, one school has removed all student photos from its website, and others are reviewing theirs. Principals there have floated some quite different ideas, including using AI-generated images of children, or paying child models to appear in promotional material, while at least one school has said it isn’t making drastic changes.

It’s not a hypothetical risk, either. Between January and March this year, eSafety received more than 100 reports of anonymous accounts targeting schools and school staff, almost all of them using images harvested from school social media accounts and websites. In July, eSafety issued an Online Safety Advisory asking schools to review how they collect, approve, post, and store images, using a risk-based approach rather than a blanket ban. In the UK, the Internet Watch Foundation and the National Crime Agency have reported criminals lifting photos from school websites to create sexually explicit deepfakes for blackmail.

There’s no easy solution. These conversations need to be driven by what each community wants, but first and foremost by what’s best for the children.

Pending changes to the law

Some of these decisions will also be taken out of our hands, perhaps in ways that help schools, parents, and children.

The biggest change is the Children’s Online Privacy Code, being developed by the Office of the Australian Information Commissioner (OAIC). It’s separate from the under-16 social media minimum age that came in last December, although the two are related: the age limit decides whether young people can have accounts at all, while the Code governs how online services must handle children’s personal information, including their photos. The exposure draft was released in March and consultation closed in June. Here’s what the draft would do:

• It would apply to social media, apps, websites, and other online services likely to be used by children, including family photo-sharing apps and online school management systems. Photos and videos of a child count as personal information.
• For children under 15, a parent would need to consent before a child’s personal information is collected, used, or shared, and the service would have to take reasonable steps to check that the person consenting actually has parental responsibility. From 15, young people could consent for themselves.
• Even with a parent’s consent, the child’s own agreement would be needed for some uses, such as sensitive information, direct marketing, or using information for a purpose other than the one it was collected for.
• Consent would expire after 12 months. Bundled consents, “nudges”, and repeated prompts would not be allowed.

The final wording could still change, and the start date and any transition period haven’t been confirmed. MinterEllison has a good explainer on what to expect for businesses, including those (like schools) that work specifically with children. For schools, the biggest effect will probably come through the platforms they already use, such as parent apps, learning management systems, and photo-sharing tools, as their consent processes change.

Further out is the second tranche of Privacy Act reform. The exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026 was released in August and hasn’t yet been introduced to Parliament, so 2027 is the earliest it’s likely to apply. It would require any collection, use, or disclosure of personal information to be “fair, reasonable and lawful”, and where children are involved, their best interests would be a primary consideration. Importantly, ticking a consent box wouldn’t automatically make a practice “fair”.

And one change is already in force. Since June 2025, people have been able to sue for serious invasions of privacy, including misuse of information. Unlike the Privacy Act, that applies to individuals as well as organisations, and anyone who was under 18 at the time has until their 21st birthday to bring a claim.

Who should be responsible for the risk?

Ultimately, there’s a tension between what’s best for young people, how well informed parents are about the risks, and what schools can reasonably do to mitigate them.

I don’t think it should be only the parent’s responsibility to understand the implications of posting images of children online. Nor do I think the default position should be opt in. And although schools have turned to platforms like Pixevety to help with the administrative burden of media consent, I don’t think there’s a simple technological solution either.

Some of the upcoming legal changes may make it easier to avoid the risks for young children who can’t consent to their images being used online. But without clear, transparent communication, the changes may create new problems for schools, who will be the ones explaining them to parents. As usual, education is the answer. That means making sure parent communities understand the potential risks and harms as well as the benefits of sharing images online, schools following consent requirements to the letter of the law, and perhaps schools providing safer spaces to celebrate students within their own communities.

Want to learn more about GenAI professional development and advisory services, or just have questions or comments? Get in touch: