Should schools still put pupil photos online?

What does the new guidance ask schools to do?

The UK Online Harms Early Warning Working Group has updated its image security guidance. It did so after reports of criminals targeting schools and using AI tools on pupil images.

The guidance is for education settings and other organisations that work with children. It shares best practice and points to consider, to address the risk of AI image manipulation.

It covers how photos and videos of children are managed, shared and protected. That includes images on school websites, social media and other digital spaces.

It sets out practices to protect pupils' images, the risks of using them online, and a checklist of actions to consider.

It also explains what to do if images are misused, altered or abused. Further resources include a guide to removing EXIF metadata and an example risk management template.

Page 1 of the guidance for education settings, from the UK Online Harms Early Warning Working Group.

What happened at the school behind the warning?

Images of children were taken from a secondary school's website and altered using AI tools. UK police asked the Internet Watch Foundation, a member of the working group, to help block their spread.

The blackmailers sent the material to the school. They threatened to share it more widely unless the school paid them money.

Incidents like this do not yet appear to be widespread. The working group's concern is that more schools will be targeted in the same way.

Pupils are not the only people at risk. Adult staff at schools and pupils over 18 can also be targeted in this way.

What should a school do if it is targeted?

Do not engage with anyone who tries to blackmail the school, and contact the police straight away. Paying a ransom demand can be illegal in certain circumstances.

The guidance gives staff a checklist to recognise and respond to image based abuse. It puts pupils' safety, dignity and emotional wellbeing first.

Removal tools can help. The guidance highlights the IWF and Childline's Report Remove tool for under 18s, among other measures.

The law is clear on the images themselves. In the UK, images and videos of child sexual abuse are illegal whether they were made with AI or not.

How does this fit the data protection rules you already follow?

The data protection rules have not changed. If someone can be recognised in a photo, it is usually their personal data.

Data protection law is likely to apply to photos taken for official school use, such as a prospectus. You need a valid lawful basis before taking, using or sharing them.

Department for Education guidance lists public task, consent and legitimate interests as lawful bases. The ICO expects most publicly funded schools to be looking at public task.

Tell pupils, or a parent or guardian, how the photos will be used. Explain at the outset which lawful basis you rely on.

People can still say no. The ICO recommends an opt out whatever the lawful basis, and pupils or parents can opt out even under public task.

A photo may need to come down from the website if a pupil objects. Existing paper copies of a prospectus do not necessarily have to be destroyed.

Some existing steps sit close to the AI risk. Check that permissions cover new ways of sharing images, including AI tools, and carry out a DPIA for new systems.

The ICO's page on photos in schools is under review, because of changes made by the Data (Use and Access) Act.

An AI example of a safer team photo. Not a real school or real pupils.

What are parents being told?

The IWF and the National Crime Agency have also issued guidance for parents and carers. It aims to help them share children's images safely.

It includes advice on talking to children about AI, deepfake nudes and image consent. It also covers what to do if a child is targeted.

The NCA asks parents to review privacy settings and think about who can see their children's images. It also asks them to talk with schools and clubs about image sharing and consent.

So expect questions from parents. The ICO suggests sharing your photo policies at the start of the academic year, including how to opt out.