Publishing images of children at school on websites, social media or video platforms requires special care. Photos and videos of pupils are personal data and often involve vulnerable individuals. Schools must therefore rely on a valid legal basis, provide clear information and respect withdrawal or removal requests.
The Spanish Data Protection Agency fined a school 3,000 euros for publishing images and videos of a child without properly handling the parents’ removal request. The case shows that a generic authorisation collected at enrolment is not enough: consent must be managed, updated and capable of being withdrawn.
In this article we will discuss...
Why images of children are personal data
A photograph or video can identify a person, so it is personal data. Where a child appears, the level of diligence must be higher because of their special protection. Processing must comply with the GDPR, Spanish data protection law and, where applicable, education and child protection rules.
Online publication increases risk: an image uploaded to a website, social network or video platform may be downloaded, shared, indexed and remain accessible for a long time.
Consent to publish photos of pupils
Many schools collect authorisation at the beginning of the school year or during enrolment. This may be valid if the information is clear, specific and separate from other consents. Generic formulas authorising any future use without explaining channels, purposes and withdrawal options should be avoided.
Consent should state which images may be published, for what purpose, in which media, for how long and how consent can be withdrawn. It should not condition ordinary education services.
What happens if parents withdraw consent?
Withdrawing consent must be as easy as giving it. If parents or guardians request removal of a child’s images, the school should review the request and act without undue delay where the publication depended on consent.
The school should have an internal process to locate images on websites, social media, newsletters, videos, digital signage or external platforms. Lack of control over where content was published may increase risk.
Social media and YouTube publication
Social networks and video platforms increase exposure. Before publishing images of school activities, trips, festivals or competitions, schools should assess whether identifiable faces are necessary or whether general shots, back-facing images, blurring or less identifiable resources can be used.
If external platforms are used, their terms, privacy settings, removal options and third-party reuse risks should also be reviewed.
Good practices for schools
- Use separate authorisations for websites, social media, videos and promotional material.
- Avoid generic or indefinite consent forms.
- Keep a record of which pupils are authorised and which are not.
- Train teachers and administrative staff before publishing images.
- Review old publications when consent is withdrawn.
- Apply minimisation: publish only what is necessary.
- Configure privacy settings and limit downloads where possible.
- Respond quickly to removal requests.
Frequently asked questions
Can a school publish photos of pupils on its website?
It may do so if it has a valid legal basis, provides proper information and respects the limits of consent or the applicable purpose. In many cases, specific consent will be required.
Is an authorisation signed at enrolment enough?
It may be enough if it is clear, specific and informed. But it should not be a generic clause allowing any publication without distinguishing channels or purposes.
What should the school do if parents request removal?
It should assess the request, locate the content and remove it where appropriate. It should also document the response and check whether copies exist in other channels controlled by the school.
Can group photos of pupils be published?
They may still be personal data if the children are identifiable. Appearing in a group does not automatically remove data protection obligations.
Conclusion
Images of children in schools must be managed with care, transparency and control. A good consent system, authorisation register and fast response to withdrawal requests helps avoid disputes, fines and unnecessary risks for pupils.