Student images and children's privacy
Several reforms affecting the publication of student images are landing between now and December 2026.
Posted on
Filed under
Marketing & Advertising
29/7
The rules governing how organisations publish images of students have been changing on several fronts at once. There is no single reform driving it. Instead, a privacy code, an online safety regime, a new state privacy act and a national defamation project have all moved in overlapping ways, each with its own timetable and scope.
The result is a picture that is easy to misstate. Some obligations are already in force. Some have a registration date but no commencement date. At least one that is widely described as current law is still only a proposal.
What follows is a factual summary of each, with sources.
This article is general information, not legal advice. Obligations vary by jurisdiction and circumstance, and organisations should obtain their own advice.
The existing position
Under the Privacy Act 1988, a photograph or video from which an individual is reasonably identifiable is that individual's personal information. This is long settled and is not itself a change.
The Privacy Act applies to organisations with an annual turnover above $3 million, along with certain other categories regardless of size. Non-government schools generally fall within it as APP entities. Government schools are state instrumentalities and are governed by state privacy law rather than the Commonwealth Act.
Identifiability does not depend on a name being attached. Context can establish it, including uniforms, recognisable locations and captions identifying an event or year.
On consent, the OAIC's guidance addresses bundled consent, where multiple permissions are sought in a single request such that a person cannot agree to one without agreeing to all. The Act also treats consent as something that must be current and voluntary.
Independent Schools NSW published guidance for members in 2026 advising that the key test is whether a student is reasonably identifiable, that students may be identifiable from context even without names, and that the distinction between internal use and public publication is critical, with a general expectation that specific consent is obtained for public use.
That expectation is sector guidance and prudent practice rather than a universal statutory rule. The Privacy Act does not contain a standalone requirement that every publication of an identifiable photograph be expressly consented to. The OAIC's position is that consent is not required to collect an image of an identifiable individual unless the image records sensitive information, but that reasonable steps must be taken to make the individual aware of certain matters at the point of collection, and that using an image for a purpose the individual was not told about will probably require consent unless they would reasonably expect that use.
Whether consent is legally necessary in a given case therefore turns on the purpose for which the image was collected, what the individual was told, whether public publication is a primary or secondary purpose, and whether any exception applies.
In force: Social Media Minimum Age
The Online Safety Amendment (Social Media Minimum Age) Act 2024 took effect on 10 December 2025. It requires age-restricted platforms to take reasonable steps to prevent Australians under 16 from holding accounts. Penalties reach $49.5 million for non-compliance.
The obligation sits with platforms. There is no policing role for schools, parents or young people, and no penalty attaches to a young person who accesses a platform.
One point matters for the subject of this article. The minimum age regime governs who may hold an account on a platform. It does not determine whether an organisation may photograph a person or publish their image. Those questions remain governed by the Privacy Act and, where relevant, state privacy law.
Two developments since the start date are worth noting.
The services eSafety assessed as age-restricted as at 10 December 2025 were Facebook, Instagram, Kick, Reddit, Snapchat, Threads, TikTok, Twitch, X and YouTube. Twitch was added shortly before the start date following its own self-assessment. Services eSafety considers do not currently meet the criteria include Discord, GitHub, Google Classroom, LEGO Play, Messenger, Pinterest, Roblox, Steam, WhatsApp and YouTube Kids.
It is worth being precise about what these lists are. eSafety has stated it has no formal role in declaring which services are age-restricted, and that in the absence of ministerial rules specifying a service either way, the question is ultimately one for the courts. The obligation to self-assess sits with each platform, and eSafety has said it will not consider every service. Several platforms have since notified eSafety of their own view that they are age-restricted, including BlueSky, Lemon8, Wizz and BigoLive.
The legislative rules were also amended to narrow the definition. The Online Safety (Age-Restricted Social Media Platforms) Amendment Rules 2026 were registered on 25 March 2026 and commenced the following day. The amendment added feature-based thresholds, so that a service is only in scope if it also has a recommender feature or a logged-in feature. This sits alongside exclusions already present in the original rules made in July 2025, which covered online gaming and standalone messaging services among others.
In force since 1 July 2026: the WA privacy act
The Privacy and Responsible Information Sharing Act 2024 (WA) commenced on 1 July 2026. It applies privacy obligations to the Western Australian public sector for the first time, and can also reach private organisations in their capacity as contracted service providers to WA public entities. The notifiable information breach scheme under the Act begins on 1 January 2027.
The Act contains automated decision-making provisions that go further than the Commonwealth equivalent. Section 16 defines an automated decision-making process to include decisions materially assisted by an automated system, not only decisions made without human involvement.
Registration due 10 December 2026: the Children's Online Privacy Code
This is the reform most frequently misdescribed, in two respects.
Who it would bind. Under the exposure draft, the Code would apply to APP entities that provide a social media service, relevant electronic service or designated internet service, where the service is likely to be accessed by children or primarily concerns children's activities. Health services are excluded. It draws substantially on the United Kingdom's Age Appropriate Design Code. The final scope and obligations may change before registration.
In an education context, the draft's examples include school management systems and services that facilitate photo sharing, which suggests much of its weight falls on platforms rather than institutions. Legal analysis prepared for the school sector states that the provider is responsible for compliance and that school or parental consent does not reduce the provider's obligations.
That said, the distinction is not absolute. An institution that is itself an APP entity and is legally the provider of an in-scope online service could be covered in its own right. Whether an institution's own website falls within the definition of a designated internet service has not been resolved.
When it would start. The OAIC released an exposure draft on 31 March 2026 and consultation closed on 5 June 2026. The Code must be registered by 10 December 2026. Its commencement date has not been announced. Registration is not the same as commencement, and obligations do not necessarily begin on the registration date.
Proposed but not law: the right to erasure
Commentary occasionally states that a person withdrawing consent creates an immediate legal obligation to remove their image from all channels, with continued publication constituting a fresh breach.
The Privacy Act does not currently contain a general right to erasure. A right to be forgotten is among the proposals for the second tranche of privacy reforms. As at mid-2026, no second-tranche bill has been introduced and no commencement date has been set. The Attorney-General confirmed in February 2026 that the government is progressing a second tranche without providing a timeline.
The absence of a general erasure right does not make withdrawn consent legally irrelevant. An APP entity can no longer rely on withdrawn consent as the basis for future use or disclosure. That does not automatically require every historical copy to be destroyed, but it can mean that continued or renewed publication must stop unless another lawful basis applies.
Separately, the exposure draft of the Children's Online Privacy Code proposes a narrower, child-specific mechanism allowing a child, or a parent where appropriate, to request destruction of personal information held by a covered entity, subject to exceptions. That provision is not in force and may change before the Code is finalised.
The broader tranche 2 proposals also include tighter consent rules, an expanded definition of personal information, a fair and reasonable test, and removal of the small business exemption. None of these are currently law.
The defamation position, which differs by state
In Fairfax Media Publications Pty Ltd v Voller [2021] HCA 27, the High Court held that organisations operating public Facebook pages were publishers of defamatory comments posted by third parties beneath their content.
The Stage 2 defamation reforms responded to this, introducing exemptions for passive intermediaries and a new defence for digital intermediaries. In broad terms, an organisation maintaining an accessible complaints mechanism that takes reasonable steps to remove material within seven days of a valid written complaint may rely on that defence. It appears as section 31A in the New South Wales Act, though the numbering differs between jurisdictions.
Commencement has been uneven. New South Wales and the ACT commenced on 1 July 2024 and Victoria on 11 September 2024. The full Stage 2 Part A reforms, including the intermediary exemptions and the digital intermediary defence, are now also in force in the Northern Territory, Queensland and Tasmania.
South Australia enacted only part of the package, declining to adopt the intermediary exemptions and the new defence. Organisations there may still be found to be publishers under the principles in Voller.
Western Australia has not enacted the Stage 2 reforms, and has not enacted the Stage 1 reforms from 2021 either. The digital intermediary defence is therefore not available under WA law.
Regulatory activity on synthetic imagery
The eSafety Commissioner has taken enforcement action against services that generate explicit synthetic imagery from ordinary photographs, including imagery of Australian students.
Following action beginning in late 2025, eSafety reported in June 2026 that the seven most widely used such services in Australia had either withdrawn access or taken steps to comply with the Online Safety Act. Further enforcement was commenced in May 2026 under the Age-Restricted Material Codes. The government announced in September 2025 an intention to legislate a ban on these services.
Summary of dates
Date | What | Status |
|---|---|---|
10 December 2025 | Social Media Minimum Age obligation | In force |
25 March 2026 | Amended rules narrowing platform definition | In force |
1 July 2026 | Privacy and Responsible Information Sharing Act 2024 (WA) | In force |
10 December 2026 | Children's Online Privacy Code registration deadline | Commencement date not announced |
1 January 2027 | WA notifiable information breach scheme | Scheduled |
Not scheduled | Privacy Act tranche 2, including right to erasure | Proposal only |
Not scheduled | WA adoption of defamation reforms | Not enacted |
References
Office of the Australian Information Commissioner, Posting photos and videos. https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information/posting-photos-and-videos
Office of the Australian Information Commissioner, Consent to the handling of personal information. https://www.oaic.gov.au/privacy/your-privacy-rights/your-personal-information/consent-to-the-handling-of-personal-information
Independent Schools NSW, Publication of student images (websites and social media). https://www.isnsw.edu.au/newsroom/publication-of-student-images-websites-social-media
eSafety Commissioner, Which social media platforms are age-restricted? https://www.esafety.gov.au/about-us/industry-regulation/social-media-age-restrictions/which-platforms-are-age-restricted
Clayton Utz, Social media minimum age restrictions: the net widens, enforcement begins and gaming platforms in the frame. https://www.claytonutz.com/insights/2026/may/social-media-minimum-age-restrictions-the-net-widens-enforcement-begins-and-gaming-platforms-in-the-frame
Government of Western Australia, Privacy and Responsible Information Sharing. https://www.wa.gov.au/government/privacy-and-responsible-information-sharing
Privacy and Responsible Information Sharing Act 2024 (WA), s 16. https://www.legislation.wa.gov.au/legislation/prod/filestore.nsf/FileURL/mrdoc_47994.htm/$FILE/Privacy%20and%20Responsible%20Information%20Sharing%20Act%202024%20-%20%5B00-00-00%5D.html?OpenElement=
Office of the Australian Information Commissioner, Children's Online Privacy Code. https://www.oaic.gov.au/privacy/privacy-registers/privacy-codes/childrens-online-privacy-code
Corrs Chambers Westgarth, OAIC's Children's Online Privacy exposure draft: from consultation to code. https://www.corrs.com.au/insights/oaics-childrens-online-privacy-exposure-draft-from-consultation-to-code
Moores, Children's Online Privacy Code 2026: consequences and liability for schools. https://www.moores.com.au/childrens-online-privacy-code-2026-consequences-and-liability-for-schools/
Rules Mate, The second tranche of Privacy Act reforms: what's proposed and what's still uncertain. https://rulesmate.com.au/insights/privacy-act-second-tranche-reforms-2026-outlook
Fairfax Media Publications Pty Ltd v Voller [2021] HCA 27.
Legal Practitioners' Liability Committee, Defamation law reforms stage 2: tips and traps for practitioners. https://lplc.com.au/resources/lplc-article/defamation-law-reforms-stage-2-tips-and-traps-for-practitioners
Johnson Winter Slattery, Uniformity deadline passes as digital defamation deformation prevails. https://jws.com.au/what-we-think/uniformity-fails-defamation-deformation-prevails/
HWL Ebsworth, South Australia implements several Stage 2 defamation reforms. https://hwlebsworth.com.au/south-australia-implements-several-stage-2-defamation-reforms/
eSafety Commissioner, Twitch assessed as age-restricted social media platform. https://www.esafety.gov.au/newsroom/media-releases/twitch-assessed-as-age-restricted-social-media-platform
eSafety Commissioner, Another three 'nudifying' services go dark in Australia as regulatory pressure mounts over child safety concerns. https://www.esafety.gov.au/newsroom/media-releases/another-three-nudifying-services-go-dark-in-australia-as-regulatory-pressure-mounts-over-child-safety-concerns
The rules governing how organisations publish images of students have been changing on several fronts at once. There is no single reform driving it. Instead, a privacy code, an online safety regime, a new state privacy act and a national defamation project have all moved in overlapping ways, each with its own timetable and scope.
The result is a picture that is easy to misstate. Some obligations are already in force. Some have a registration date but no commencement date. At least one that is widely described as current law is still only a proposal.
What follows is a factual summary of each, with sources.
This article is general information, not legal advice. Obligations vary by jurisdiction and circumstance, and organisations should obtain their own advice.
The existing position
Under the Privacy Act 1988, a photograph or video from which an individual is reasonably identifiable is that individual's personal information. This is long settled and is not itself a change.
The Privacy Act applies to organisations with an annual turnover above $3 million, along with certain other categories regardless of size. Non-government schools generally fall within it as APP entities. Government schools are state instrumentalities and are governed by state privacy law rather than the Commonwealth Act.
Identifiability does not depend on a name being attached. Context can establish it, including uniforms, recognisable locations and captions identifying an event or year.
On consent, the OAIC's guidance addresses bundled consent, where multiple permissions are sought in a single request such that a person cannot agree to one without agreeing to all. The Act also treats consent as something that must be current and voluntary.
Independent Schools NSW published guidance for members in 2026 advising that the key test is whether a student is reasonably identifiable, that students may be identifiable from context even without names, and that the distinction between internal use and public publication is critical, with a general expectation that specific consent is obtained for public use.
That expectation is sector guidance and prudent practice rather than a universal statutory rule. The Privacy Act does not contain a standalone requirement that every publication of an identifiable photograph be expressly consented to. The OAIC's position is that consent is not required to collect an image of an identifiable individual unless the image records sensitive information, but that reasonable steps must be taken to make the individual aware of certain matters at the point of collection, and that using an image for a purpose the individual was not told about will probably require consent unless they would reasonably expect that use.
Whether consent is legally necessary in a given case therefore turns on the purpose for which the image was collected, what the individual was told, whether public publication is a primary or secondary purpose, and whether any exception applies.
In force: Social Media Minimum Age
The Online Safety Amendment (Social Media Minimum Age) Act 2024 took effect on 10 December 2025. It requires age-restricted platforms to take reasonable steps to prevent Australians under 16 from holding accounts. Penalties reach $49.5 million for non-compliance.
The obligation sits with platforms. There is no policing role for schools, parents or young people, and no penalty attaches to a young person who accesses a platform.
One point matters for the subject of this article. The minimum age regime governs who may hold an account on a platform. It does not determine whether an organisation may photograph a person or publish their image. Those questions remain governed by the Privacy Act and, where relevant, state privacy law.
Two developments since the start date are worth noting.
The services eSafety assessed as age-restricted as at 10 December 2025 were Facebook, Instagram, Kick, Reddit, Snapchat, Threads, TikTok, Twitch, X and YouTube. Twitch was added shortly before the start date following its own self-assessment. Services eSafety considers do not currently meet the criteria include Discord, GitHub, Google Classroom, LEGO Play, Messenger, Pinterest, Roblox, Steam, WhatsApp and YouTube Kids.
It is worth being precise about what these lists are. eSafety has stated it has no formal role in declaring which services are age-restricted, and that in the absence of ministerial rules specifying a service either way, the question is ultimately one for the courts. The obligation to self-assess sits with each platform, and eSafety has said it will not consider every service. Several platforms have since notified eSafety of their own view that they are age-restricted, including BlueSky, Lemon8, Wizz and BigoLive.
The legislative rules were also amended to narrow the definition. The Online Safety (Age-Restricted Social Media Platforms) Amendment Rules 2026 were registered on 25 March 2026 and commenced the following day. The amendment added feature-based thresholds, so that a service is only in scope if it also has a recommender feature or a logged-in feature. This sits alongside exclusions already present in the original rules made in July 2025, which covered online gaming and standalone messaging services among others.
In force since 1 July 2026: the WA privacy act
The Privacy and Responsible Information Sharing Act 2024 (WA) commenced on 1 July 2026. It applies privacy obligations to the Western Australian public sector for the first time, and can also reach private organisations in their capacity as contracted service providers to WA public entities. The notifiable information breach scheme under the Act begins on 1 January 2027.
The Act contains automated decision-making provisions that go further than the Commonwealth equivalent. Section 16 defines an automated decision-making process to include decisions materially assisted by an automated system, not only decisions made without human involvement.
Registration due 10 December 2026: the Children's Online Privacy Code
This is the reform most frequently misdescribed, in two respects.
Who it would bind. Under the exposure draft, the Code would apply to APP entities that provide a social media service, relevant electronic service or designated internet service, where the service is likely to be accessed by children or primarily concerns children's activities. Health services are excluded. It draws substantially on the United Kingdom's Age Appropriate Design Code. The final scope and obligations may change before registration.
In an education context, the draft's examples include school management systems and services that facilitate photo sharing, which suggests much of its weight falls on platforms rather than institutions. Legal analysis prepared for the school sector states that the provider is responsible for compliance and that school or parental consent does not reduce the provider's obligations.
That said, the distinction is not absolute. An institution that is itself an APP entity and is legally the provider of an in-scope online service could be covered in its own right. Whether an institution's own website falls within the definition of a designated internet service has not been resolved.
When it would start. The OAIC released an exposure draft on 31 March 2026 and consultation closed on 5 June 2026. The Code must be registered by 10 December 2026. Its commencement date has not been announced. Registration is not the same as commencement, and obligations do not necessarily begin on the registration date.
Proposed but not law: the right to erasure
Commentary occasionally states that a person withdrawing consent creates an immediate legal obligation to remove their image from all channels, with continued publication constituting a fresh breach.
The Privacy Act does not currently contain a general right to erasure. A right to be forgotten is among the proposals for the second tranche of privacy reforms. As at mid-2026, no second-tranche bill has been introduced and no commencement date has been set. The Attorney-General confirmed in February 2026 that the government is progressing a second tranche without providing a timeline.
The absence of a general erasure right does not make withdrawn consent legally irrelevant. An APP entity can no longer rely on withdrawn consent as the basis for future use or disclosure. That does not automatically require every historical copy to be destroyed, but it can mean that continued or renewed publication must stop unless another lawful basis applies.
Separately, the exposure draft of the Children's Online Privacy Code proposes a narrower, child-specific mechanism allowing a child, or a parent where appropriate, to request destruction of personal information held by a covered entity, subject to exceptions. That provision is not in force and may change before the Code is finalised.
The broader tranche 2 proposals also include tighter consent rules, an expanded definition of personal information, a fair and reasonable test, and removal of the small business exemption. None of these are currently law.
The defamation position, which differs by state
In Fairfax Media Publications Pty Ltd v Voller [2021] HCA 27, the High Court held that organisations operating public Facebook pages were publishers of defamatory comments posted by third parties beneath their content.
The Stage 2 defamation reforms responded to this, introducing exemptions for passive intermediaries and a new defence for digital intermediaries. In broad terms, an organisation maintaining an accessible complaints mechanism that takes reasonable steps to remove material within seven days of a valid written complaint may rely on that defence. It appears as section 31A in the New South Wales Act, though the numbering differs between jurisdictions.
Commencement has been uneven. New South Wales and the ACT commenced on 1 July 2024 and Victoria on 11 September 2024. The full Stage 2 Part A reforms, including the intermediary exemptions and the digital intermediary defence, are now also in force in the Northern Territory, Queensland and Tasmania.
South Australia enacted only part of the package, declining to adopt the intermediary exemptions and the new defence. Organisations there may still be found to be publishers under the principles in Voller.
Western Australia has not enacted the Stage 2 reforms, and has not enacted the Stage 1 reforms from 2021 either. The digital intermediary defence is therefore not available under WA law.
Regulatory activity on synthetic imagery
The eSafety Commissioner has taken enforcement action against services that generate explicit synthetic imagery from ordinary photographs, including imagery of Australian students.
Following action beginning in late 2025, eSafety reported in June 2026 that the seven most widely used such services in Australia had either withdrawn access or taken steps to comply with the Online Safety Act. Further enforcement was commenced in May 2026 under the Age-Restricted Material Codes. The government announced in September 2025 an intention to legislate a ban on these services.
Summary of dates
Date | What | Status |
|---|---|---|
10 December 2025 | Social Media Minimum Age obligation | In force |
25 March 2026 | Amended rules narrowing platform definition | In force |
1 July 2026 | Privacy and Responsible Information Sharing Act 2024 (WA) | In force |
10 December 2026 | Children's Online Privacy Code registration deadline | Commencement date not announced |
1 January 2027 | WA notifiable information breach scheme | Scheduled |
Not scheduled | Privacy Act tranche 2, including right to erasure | Proposal only |
Not scheduled | WA adoption of defamation reforms | Not enacted |
References
Office of the Australian Information Commissioner, Posting photos and videos. https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information/posting-photos-and-videos
Office of the Australian Information Commissioner, Consent to the handling of personal information. https://www.oaic.gov.au/privacy/your-privacy-rights/your-personal-information/consent-to-the-handling-of-personal-information
Independent Schools NSW, Publication of student images (websites and social media). https://www.isnsw.edu.au/newsroom/publication-of-student-images-websites-social-media
eSafety Commissioner, Which social media platforms are age-restricted? https://www.esafety.gov.au/about-us/industry-regulation/social-media-age-restrictions/which-platforms-are-age-restricted
Clayton Utz, Social media minimum age restrictions: the net widens, enforcement begins and gaming platforms in the frame. https://www.claytonutz.com/insights/2026/may/social-media-minimum-age-restrictions-the-net-widens-enforcement-begins-and-gaming-platforms-in-the-frame
Government of Western Australia, Privacy and Responsible Information Sharing. https://www.wa.gov.au/government/privacy-and-responsible-information-sharing
Privacy and Responsible Information Sharing Act 2024 (WA), s 16. https://www.legislation.wa.gov.au/legislation/prod/filestore.nsf/FileURL/mrdoc_47994.htm/$FILE/Privacy%20and%20Responsible%20Information%20Sharing%20Act%202024%20-%20%5B00-00-00%5D.html?OpenElement=
Office of the Australian Information Commissioner, Children's Online Privacy Code. https://www.oaic.gov.au/privacy/privacy-registers/privacy-codes/childrens-online-privacy-code
Corrs Chambers Westgarth, OAIC's Children's Online Privacy exposure draft: from consultation to code. https://www.corrs.com.au/insights/oaics-childrens-online-privacy-exposure-draft-from-consultation-to-code
Moores, Children's Online Privacy Code 2026: consequences and liability for schools. https://www.moores.com.au/childrens-online-privacy-code-2026-consequences-and-liability-for-schools/
Rules Mate, The second tranche of Privacy Act reforms: what's proposed and what's still uncertain. https://rulesmate.com.au/insights/privacy-act-second-tranche-reforms-2026-outlook
Fairfax Media Publications Pty Ltd v Voller [2021] HCA 27.
Legal Practitioners' Liability Committee, Defamation law reforms stage 2: tips and traps for practitioners. https://lplc.com.au/resources/lplc-article/defamation-law-reforms-stage-2-tips-and-traps-for-practitioners
Johnson Winter Slattery, Uniformity deadline passes as digital defamation deformation prevails. https://jws.com.au/what-we-think/uniformity-fails-defamation-deformation-prevails/
HWL Ebsworth, South Australia implements several Stage 2 defamation reforms. https://hwlebsworth.com.au/south-australia-implements-several-stage-2-defamation-reforms/
eSafety Commissioner, Twitch assessed as age-restricted social media platform. https://www.esafety.gov.au/newsroom/media-releases/twitch-assessed-as-age-restricted-social-media-platform
eSafety Commissioner, Another three 'nudifying' services go dark in Australia as regulatory pressure mounts over child safety concerns. https://www.esafety.gov.au/newsroom/media-releases/another-three-nudifying-services-go-dark-in-australia-as-regulatory-pressure-mounts-over-child-safety-concerns
Author
Steven Donald
Chief Strategist
With over 30 years of experience across all facets of digital marketing, Steven Donald brings this expertise to his role as Chief Strategist at Pure Agency. Having navigated every evolution from early digital transformation to today's AI-driven landscape, Steven possesses a unique perspective on what truly drives performance.
