Student images and children's privacy
Several reforms affecting the publication of student images are landing between now and December 2026.
Posted on
Filed under
Marketing & Advertising
29/7
A permission form signed at enrolment in 2014 described a fairly small world. There was a newsletter, probably printed. There was a website that changed a few times a year. There may have been a Facebook page, run by whoever in the front office had volunteered.
The same form is often still being relied on. In the meantime the school has acquired an Instagram account, a YouTube channel, a rebuilt website with an image-heavy homepage, a parent notification app, a learning management system that stores photographs, and a marketing function that produces campaign material for enrolment periods. The images move between all of them.
That distance, between what was disclosed when permission was given and where the image now travels, is the actual compliance problem in school imagery. It is not new, and no single reform created it. But almost every change arriving between now and the end of 2026 either widens that gap or makes it more consequential.
Understanding what is coming means starting with what the law has always said, because that part is commonly misdescribed.
This article is general information, not legal advice. Obligations vary by jurisdiction and circumstance, and organisations should obtain their own advice.
The baseline is about purpose, not permission
A photograph or video from which a person is reasonably identifiable is that person's personal information under the Privacy Act. Identifiability does not require a name. A uniform, a recognisable building and a caption naming an event and year can identify a student who was never named.
What follows from that is less absolute than the sector conversation often suggests. There is no standalone rule in the Privacy Act requiring express consent for every publication of an identifiable photograph. The OAIC's position is that consent is not needed to collect an image of an identifiable person unless it records sensitive information, but that reasonable steps must be taken to make the person aware of certain matters at the point of collection, and that using an image for a purpose they were not told about will probably require consent unless they would reasonably expect that use.
The operative concept is purpose. What was the image collected for, what was the person told, and is the current use the thing that was described or something else. Independent Schools NSW guidance to members in 2026 reflects that emphasis, treating identifiability as the key test and the distinction between internal use and public publication as critical, with a general expectation of specific consent for public use. That is sector guidance and prudent practice rather than a statutory rule, but it is pointed at the right question.
This is why the consent gap matters more than the consent form. A permission that described a newsletter is not obviously a permission covering a public Instagram account, because the second use is not the thing the person was told about and arguably not something they would have reasonably expected in 2014.
Two patterns make the gap worse. Bundling several permissions into a single request, so that the newsletter, the website, the annual report, news media and social media are agreed to or refused together, undercuts whether consent was meaningfully given for any of them. And consent has a shelf life: the Act treats it as something that must be current and voluntary, which sits awkwardly against a signature intended to cover the following thirteen years.
None of that is a coming change. It is the existing position, and it is the ground on which everything else lands.
What is actually arriving
The Children's Online Privacy Code, in draft. This is the reform most often described as landing new obligations on schools in December 2026, and the description is misleading in both halves.
The OAIC released an exposure draft on 31 March 2026 and consultation closed on 5 June. The Code must be registered by 10 December 2026, but its commencement date has not been announced, and registration is not commencement. The text may still change.
More importantly, the draft would apply to APP entities that provide a social media service, relevant electronic service or designated internet service likely to be accessed by children or primarily concerned with children's activities. It draws on the United Kingdom's Age Appropriate Design Code. The examples in the draft include school management systems and services facilitating photo sharing, which suggests its weight falls on the platforms a school buys rather than on the school as an institution. Legal analysis prepared for the sector puts it directly: the provider carries responsibility for compliance, and school or parental consent does not reduce the provider's own obligations.
The practical effect, then, is less about a school's marketing and more about its procurement. The systems holding student photographs would acquire obligations of their own. Whether a school's own website falls within the definition of a designated internet service is unresolved, and a school that is itself the provider of an in-scope service could be covered in its own right.
The draft also proposes something that speaks directly to the consent gap: a mechanism allowing a child, or a parent where appropriate, to request destruction of personal information held by a covered entity, with a response required within thirty days. That is not in force and may change. But it points at where the direction of travel is.
The WA privacy act, already in force. The Privacy and Responsible Information Sharing Act 2024 (WA) commenced on 1 July 2026, applying privacy obligations to the Western Australian public sector for the first time and reaching private organisations acting as contracted service providers to WA public entities. Its notifiable information breach scheme begins on 1 January 2027.
The consequence for this state is structural rather than dramatic. Non-government schools were already APP entities under the Commonwealth Act. Government schools are state instrumentalities and were governed by state arrangements. From July, both sectors have enforceable privacy obligations, under different instruments, making decisions about materially the same photograph. The WA Act also goes further on automated decision-making than its Commonwealth counterpart, with section 16 capturing decisions materially assisted by an automated system rather than only those made without human involvement.
Tranche 2, proposed and unscheduled. The second tranche of Commonwealth privacy reform would close much of the ambiguity described above. Its proposals include a right to erasure, tighter consent rules, an expanded definition of personal information, a fair and reasonable test, and removal of the small business exemption.
None of it is law. No bill has been introduced and no commencement date has been set, with the Attorney-General confirming in February 2026 that the tranche is progressing without providing a timeline. This matters because commentary in this area frequently describes the erasure right as though it already exists, asserting that withdrawal of consent triggers an immediate obligation to remove an image from every channel.
It does not, at least not yet. What withdrawal does do is remove the basis for future reliance: an entity can no longer point to withdrawn consent to justify continuing or renewed use and disclosure. That is a narrower obligation than erasure, but it is not nothing, and it is the one currently in effect.
The change that is not a privacy law
Running alongside all of this is something that gets almost no attention in education sector discussion, and it has a sharper edge in Western Australia than anywhere else.
In Fairfax Media Publications Pty Ltd v Voller [2021] HCA 27, the High Court held that organisations operating public Facebook pages were publishers of defamatory comments posted by third parties beneath their content. Any organisation running a public page is potentially the publisher of what appears under a post, including material it did not write. For a school posting images of students, the comment thread is part of the publication.
The Stage 2 defamation reforms responded to this with exemptions for passive intermediaries and a new defence for digital intermediaries. Broadly, an organisation with an accessible complaints mechanism that takes reasonable access-prevention steps within seven days of a valid written complaint can rely on it. It appears as section 31A in the New South Wales Act, though numbering differs between jurisdictions.
New South Wales and the ACT commenced on 1 July 2024 and Victoria on 11 September 2024, with the full Part A reforms now also in force in the Northern Territory, Queensland and Tasmania. South Australia adopted only part of the package, declining the intermediary exemptions and the defence.
Western Australia has enacted neither the Stage 2 reforms nor the Stage 1 reforms from 2021. The digital intermediary defence is not available under WA law. A school in Perth managing comments beneath a post about its students is therefore working without the statutory protection its counterparts in most of the country now have.
Why practice is moving ahead of the law
There is one further development that changes the calculation regardless of what any statute requires.
The eSafety Commissioner has taken sustained enforcement action against services that generate explicit synthetic imagery from ordinary photographs, including imagery of Australian students. Following action beginning in 2025, eSafety reported in June 2026 that the seven most widely used such services in Australia had either withdrawn access or taken steps to comply. Further enforcement was commenced in May 2026 under the Age-Restricted Material Codes, and the government announced in September 2025 an intention to legislate a ban.
The significance for anyone producing school content is not the enforcement itself. It is that the risk attaching to publicly published close-up identifiable imagery of young people is now documented by the regulator rather than speculative. That changes what a careful organisation can be said to have known when it decided what to publish and where.
Worth noting, since the two are often conflated: the social media minimum age regime that commenced on 10 December 2025 does not bear on this. It governs who may hold an account, sits entirely with platforms, carries penalties reaching $49.5 million, and imposes no obligation on schools, parents or young people. It says nothing about whether a school may photograph a student or publish the image.
What the gap looks like when it is closed
The schools in the strongest position are not the ones with the most elaborate documentation. They are the ones that can answer three questions quickly.
The first is what a given permission actually covers. Where permissions are separated by channel rather than bundled, and refreshed against something that already happens annually, the answer is available. Where a single signature from enrolment is doing all the work, it is not.
The second is where a particular image has been published. This is the question that determines whether a withdrawal request, whether or not the law compels a response, is a retrieval task or an excavation. A decade of social media archives with no record connecting images to the permissions they were published under cannot produce the answer at all.
The third is who is watching the channel. Given the WA defamation position, the presence of a monitored complaints route and someone specifically responsible for the page is the difference between managing an incident and discovering one.
The common feature of all three is that none of them requires waiting for the Code to be registered, or for tranche 2 to be introduced, or for any question about designated internet services to be resolved. They are answerable now, and they are the same questions each of the coming changes will eventually ask in a more demanding form.
The through-line
Four separate reforms are moving: a draft code aimed mostly at platforms, a new state act creating parallel regimes, a proposed tranche that would introduce erasure, and a defamation project this state has sat out. They have almost nothing in common as instruments.
What they share is a direction. Each one narrows the space in which an organisation can publish an identifiable image of a child on the basis of a permission given years earlier, for a smaller set of channels, in a different information environment. The consent gap is the exposure, and it has been widening for a decade while attention has been on the dates.
References
Office of the Australian Information Commissioner, Posting photos and videos. https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information/posting-photos-and-videos
Office of the Australian Information Commissioner, Consent to the handling of personal information. https://www.oaic.gov.au/privacy/your-privacy-rights/your-personal-information/consent-to-the-handling-of-personal-information
Independent Schools NSW, Publication of student images (websites and social media). https://www.isnsw.edu.au/newsroom/publication-of-student-images-websites-social-media
University of Wollongong, Schools need parent permission to put students' photos on social media. https://www.uow.edu.au/media/2025/schools-need-parent-permission-to-put-students-photos-on-social-media.php
Office of the Australian Information Commissioner, Children's Online Privacy Code. https://www.oaic.gov.au/privacy/privacy-registers/privacy-codes/childrens-online-privacy-code
Corrs Chambers Westgarth, OAIC's Children's Online Privacy exposure draft: from consultation to code. https://www.corrs.com.au/insights/oaics-childrens-online-privacy-exposure-draft-from-consultation-to-code
Moores, Children's Online Privacy Code 2026: consequences and liability for schools. https://www.moores.com.au/childrens-online-privacy-code-2026-consequences-and-liability-for-schools/
Government of Western Australia, Privacy and Responsible Information Sharing. https://www.wa.gov.au/government/privacy-and-responsible-information-sharing
Privacy and Responsible Information Sharing Act 2024 (WA), s 16. https://www.legislation.wa.gov.au/legislation/prod/filestore.nsf/FileURL/mrdoc_47994.htm/$FILE/Privacy%20and%20Responsible%20Information%20Sharing%20Act%202024%20-%20%5B00-00-00%5D.html?OpenElement=
Rules Mate, The second tranche of Privacy Act reforms: what's proposed and what's still uncertain. https://rulesmate.com.au/insights/privacy-act-second-tranche-reforms-2026-outlook
Fairfax Media Publications Pty Ltd v Voller [2021] HCA 27.
Legal Practitioners' Liability Committee, Defamation law reforms stage 2: tips and traps for practitioners. https://lplc.com.au/resources/lplc-article/defamation-law-reforms-stage-2-tips-and-traps-for-practitioners
HWL Ebsworth, South Australia implements several Stage 2 defamation reforms. https://hwlebsworth.com.au/south-australia-implements-several-stage-2-defamation-reforms/
Johnson Winter Slattery, Uniformity deadline passes as digital defamation deformation prevails. https://jws.com.au/what-we-think/uniformity-fails-defamation-deformation-prevails/
eSafety Commissioner, Another three 'nudifying' services go dark in Australia as regulatory pressure mounts over child safety concerns. https://www.esafety.gov.au/newsroom/media-releases/another-three-nudifying-services-go-dark-in-australia-as-regulatory-pressure-mounts-over-child-safety-concerns
eSafety Commissioner, Social media age restrictions. https://www.esafety.gov.au/about-us/industry-regulation/social-media-age-restrictions
A permission form signed at enrolment in 2014 described a fairly small world. There was a newsletter, probably printed. There was a website that changed a few times a year. There may have been a Facebook page, run by whoever in the front office had volunteered.
The same form is often still being relied on. In the meantime the school has acquired an Instagram account, a YouTube channel, a rebuilt website with an image-heavy homepage, a parent notification app, a learning management system that stores photographs, and a marketing function that produces campaign material for enrolment periods. The images move between all of them.
That distance, between what was disclosed when permission was given and where the image now travels, is the actual compliance problem in school imagery. It is not new, and no single reform created it. But almost every change arriving between now and the end of 2026 either widens that gap or makes it more consequential.
Understanding what is coming means starting with what the law has always said, because that part is commonly misdescribed.
This article is general information, not legal advice. Obligations vary by jurisdiction and circumstance, and organisations should obtain their own advice.
The baseline is about purpose, not permission
A photograph or video from which a person is reasonably identifiable is that person's personal information under the Privacy Act. Identifiability does not require a name. A uniform, a recognisable building and a caption naming an event and year can identify a student who was never named.
What follows from that is less absolute than the sector conversation often suggests. There is no standalone rule in the Privacy Act requiring express consent for every publication of an identifiable photograph. The OAIC's position is that consent is not needed to collect an image of an identifiable person unless it records sensitive information, but that reasonable steps must be taken to make the person aware of certain matters at the point of collection, and that using an image for a purpose they were not told about will probably require consent unless they would reasonably expect that use.
The operative concept is purpose. What was the image collected for, what was the person told, and is the current use the thing that was described or something else. Independent Schools NSW guidance to members in 2026 reflects that emphasis, treating identifiability as the key test and the distinction between internal use and public publication as critical, with a general expectation of specific consent for public use. That is sector guidance and prudent practice rather than a statutory rule, but it is pointed at the right question.
This is why the consent gap matters more than the consent form. A permission that described a newsletter is not obviously a permission covering a public Instagram account, because the second use is not the thing the person was told about and arguably not something they would have reasonably expected in 2014.
Two patterns make the gap worse. Bundling several permissions into a single request, so that the newsletter, the website, the annual report, news media and social media are agreed to or refused together, undercuts whether consent was meaningfully given for any of them. And consent has a shelf life: the Act treats it as something that must be current and voluntary, which sits awkwardly against a signature intended to cover the following thirteen years.
None of that is a coming change. It is the existing position, and it is the ground on which everything else lands.
What is actually arriving
The Children's Online Privacy Code, in draft. This is the reform most often described as landing new obligations on schools in December 2026, and the description is misleading in both halves.
The OAIC released an exposure draft on 31 March 2026 and consultation closed on 5 June. The Code must be registered by 10 December 2026, but its commencement date has not been announced, and registration is not commencement. The text may still change.
More importantly, the draft would apply to APP entities that provide a social media service, relevant electronic service or designated internet service likely to be accessed by children or primarily concerned with children's activities. It draws on the United Kingdom's Age Appropriate Design Code. The examples in the draft include school management systems and services facilitating photo sharing, which suggests its weight falls on the platforms a school buys rather than on the school as an institution. Legal analysis prepared for the sector puts it directly: the provider carries responsibility for compliance, and school or parental consent does not reduce the provider's own obligations.
The practical effect, then, is less about a school's marketing and more about its procurement. The systems holding student photographs would acquire obligations of their own. Whether a school's own website falls within the definition of a designated internet service is unresolved, and a school that is itself the provider of an in-scope service could be covered in its own right.
The draft also proposes something that speaks directly to the consent gap: a mechanism allowing a child, or a parent where appropriate, to request destruction of personal information held by a covered entity, with a response required within thirty days. That is not in force and may change. But it points at where the direction of travel is.
The WA privacy act, already in force. The Privacy and Responsible Information Sharing Act 2024 (WA) commenced on 1 July 2026, applying privacy obligations to the Western Australian public sector for the first time and reaching private organisations acting as contracted service providers to WA public entities. Its notifiable information breach scheme begins on 1 January 2027.
The consequence for this state is structural rather than dramatic. Non-government schools were already APP entities under the Commonwealth Act. Government schools are state instrumentalities and were governed by state arrangements. From July, both sectors have enforceable privacy obligations, under different instruments, making decisions about materially the same photograph. The WA Act also goes further on automated decision-making than its Commonwealth counterpart, with section 16 capturing decisions materially assisted by an automated system rather than only those made without human involvement.
Tranche 2, proposed and unscheduled. The second tranche of Commonwealth privacy reform would close much of the ambiguity described above. Its proposals include a right to erasure, tighter consent rules, an expanded definition of personal information, a fair and reasonable test, and removal of the small business exemption.
None of it is law. No bill has been introduced and no commencement date has been set, with the Attorney-General confirming in February 2026 that the tranche is progressing without providing a timeline. This matters because commentary in this area frequently describes the erasure right as though it already exists, asserting that withdrawal of consent triggers an immediate obligation to remove an image from every channel.
It does not, at least not yet. What withdrawal does do is remove the basis for future reliance: an entity can no longer point to withdrawn consent to justify continuing or renewed use and disclosure. That is a narrower obligation than erasure, but it is not nothing, and it is the one currently in effect.
The change that is not a privacy law
Running alongside all of this is something that gets almost no attention in education sector discussion, and it has a sharper edge in Western Australia than anywhere else.
In Fairfax Media Publications Pty Ltd v Voller [2021] HCA 27, the High Court held that organisations operating public Facebook pages were publishers of defamatory comments posted by third parties beneath their content. Any organisation running a public page is potentially the publisher of what appears under a post, including material it did not write. For a school posting images of students, the comment thread is part of the publication.
The Stage 2 defamation reforms responded to this with exemptions for passive intermediaries and a new defence for digital intermediaries. Broadly, an organisation with an accessible complaints mechanism that takes reasonable access-prevention steps within seven days of a valid written complaint can rely on it. It appears as section 31A in the New South Wales Act, though numbering differs between jurisdictions.
New South Wales and the ACT commenced on 1 July 2024 and Victoria on 11 September 2024, with the full Part A reforms now also in force in the Northern Territory, Queensland and Tasmania. South Australia adopted only part of the package, declining the intermediary exemptions and the defence.
Western Australia has enacted neither the Stage 2 reforms nor the Stage 1 reforms from 2021. The digital intermediary defence is not available under WA law. A school in Perth managing comments beneath a post about its students is therefore working without the statutory protection its counterparts in most of the country now have.
Why practice is moving ahead of the law
There is one further development that changes the calculation regardless of what any statute requires.
The eSafety Commissioner has taken sustained enforcement action against services that generate explicit synthetic imagery from ordinary photographs, including imagery of Australian students. Following action beginning in 2025, eSafety reported in June 2026 that the seven most widely used such services in Australia had either withdrawn access or taken steps to comply. Further enforcement was commenced in May 2026 under the Age-Restricted Material Codes, and the government announced in September 2025 an intention to legislate a ban.
The significance for anyone producing school content is not the enforcement itself. It is that the risk attaching to publicly published close-up identifiable imagery of young people is now documented by the regulator rather than speculative. That changes what a careful organisation can be said to have known when it decided what to publish and where.
Worth noting, since the two are often conflated: the social media minimum age regime that commenced on 10 December 2025 does not bear on this. It governs who may hold an account, sits entirely with platforms, carries penalties reaching $49.5 million, and imposes no obligation on schools, parents or young people. It says nothing about whether a school may photograph a student or publish the image.
What the gap looks like when it is closed
The schools in the strongest position are not the ones with the most elaborate documentation. They are the ones that can answer three questions quickly.
The first is what a given permission actually covers. Where permissions are separated by channel rather than bundled, and refreshed against something that already happens annually, the answer is available. Where a single signature from enrolment is doing all the work, it is not.
The second is where a particular image has been published. This is the question that determines whether a withdrawal request, whether or not the law compels a response, is a retrieval task or an excavation. A decade of social media archives with no record connecting images to the permissions they were published under cannot produce the answer at all.
The third is who is watching the channel. Given the WA defamation position, the presence of a monitored complaints route and someone specifically responsible for the page is the difference between managing an incident and discovering one.
The common feature of all three is that none of them requires waiting for the Code to be registered, or for tranche 2 to be introduced, or for any question about designated internet services to be resolved. They are answerable now, and they are the same questions each of the coming changes will eventually ask in a more demanding form.
The through-line
Four separate reforms are moving: a draft code aimed mostly at platforms, a new state act creating parallel regimes, a proposed tranche that would introduce erasure, and a defamation project this state has sat out. They have almost nothing in common as instruments.
What they share is a direction. Each one narrows the space in which an organisation can publish an identifiable image of a child on the basis of a permission given years earlier, for a smaller set of channels, in a different information environment. The consent gap is the exposure, and it has been widening for a decade while attention has been on the dates.
References
Office of the Australian Information Commissioner, Posting photos and videos. https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information/posting-photos-and-videos
Office of the Australian Information Commissioner, Consent to the handling of personal information. https://www.oaic.gov.au/privacy/your-privacy-rights/your-personal-information/consent-to-the-handling-of-personal-information
Independent Schools NSW, Publication of student images (websites and social media). https://www.isnsw.edu.au/newsroom/publication-of-student-images-websites-social-media
University of Wollongong, Schools need parent permission to put students' photos on social media. https://www.uow.edu.au/media/2025/schools-need-parent-permission-to-put-students-photos-on-social-media.php
Office of the Australian Information Commissioner, Children's Online Privacy Code. https://www.oaic.gov.au/privacy/privacy-registers/privacy-codes/childrens-online-privacy-code
Corrs Chambers Westgarth, OAIC's Children's Online Privacy exposure draft: from consultation to code. https://www.corrs.com.au/insights/oaics-childrens-online-privacy-exposure-draft-from-consultation-to-code
Moores, Children's Online Privacy Code 2026: consequences and liability for schools. https://www.moores.com.au/childrens-online-privacy-code-2026-consequences-and-liability-for-schools/
Government of Western Australia, Privacy and Responsible Information Sharing. https://www.wa.gov.au/government/privacy-and-responsible-information-sharing
Privacy and Responsible Information Sharing Act 2024 (WA), s 16. https://www.legislation.wa.gov.au/legislation/prod/filestore.nsf/FileURL/mrdoc_47994.htm/$FILE/Privacy%20and%20Responsible%20Information%20Sharing%20Act%202024%20-%20%5B00-00-00%5D.html?OpenElement=
Rules Mate, The second tranche of Privacy Act reforms: what's proposed and what's still uncertain. https://rulesmate.com.au/insights/privacy-act-second-tranche-reforms-2026-outlook
Fairfax Media Publications Pty Ltd v Voller [2021] HCA 27.
Legal Practitioners' Liability Committee, Defamation law reforms stage 2: tips and traps for practitioners. https://lplc.com.au/resources/lplc-article/defamation-law-reforms-stage-2-tips-and-traps-for-practitioners
HWL Ebsworth, South Australia implements several Stage 2 defamation reforms. https://hwlebsworth.com.au/south-australia-implements-several-stage-2-defamation-reforms/
Johnson Winter Slattery, Uniformity deadline passes as digital defamation deformation prevails. https://jws.com.au/what-we-think/uniformity-fails-defamation-deformation-prevails/
eSafety Commissioner, Another three 'nudifying' services go dark in Australia as regulatory pressure mounts over child safety concerns. https://www.esafety.gov.au/newsroom/media-releases/another-three-nudifying-services-go-dark-in-australia-as-regulatory-pressure-mounts-over-child-safety-concerns
eSafety Commissioner, Social media age restrictions. https://www.esafety.gov.au/about-us/industry-regulation/social-media-age-restrictions
Author
Steven Donald
Chief Strategist
With over 30 years of experience across all facets of digital marketing, Steven Donald brings this expertise to his role as Chief Strategist at Pure Agency. Having navigated every evolution from early digital transformation to today's AI-driven landscape, Steven possesses a unique perspective on what truly drives performance.
