School website pupil photos have always played an important role.

They help prospective parents see the warmth, character and everyday life of a school before they visit. They show school life in a way words alone cannot. They help families understand the curriculum, the classroom environment, enrichment, friendships, values, resources and the wider community around the school.

Good pupil photos can make a school website feel human, current and welcoming.

But the risk around pupil photos has changed.

Recent related news has warned that criminals are using images taken from school websites and social media accounts to create explicit images with AI tools. The Guardian reported that experts and UK authorities are urging schools to remove or limit identifiable photos of pupils from websites and social media as the AI blackmail threat grows. The article reports that a UK secondary school was recently targeted, with the Internet Watch Foundation involved after images were assessed as child sexual abuse material. The National Crime Agency is reported to be among those advising schools to reduce the use of pupils’ names and faces in public material.

The UK Safer Internet Centre has described this as an emerging AI threat from blackmailers and says schools have been given advice on the risks of sharing images and videos of pupils on websites and social media platforms.

The Times has reported similar concerns, saying the Internet Watch Foundation and the Online Harms Early Warning Working Group are advising schools to remove or obscure student images, avoid names in captions and apply stronger privacy controls.

This is a deeply worrying emerging threat.

It does not mean every school should immediately remove every photo of school life.

It does mean every school website should now have a clear, careful and regular process for reviewing pupil photos.

Why this matters for schools

The concern is simple.

Photos posted online can be copied. Images from school websites, social media pages and other online platforms can be taken out of context. AI models can then be misused to generate sexually explicit images, intimate images or other criminal images. In some reported cases, those images are then used in blackmail attempts.

For schools, this creates safeguarding risks, data protection risks and child protection concerns.

It is no longer enough to ask:

“Do we have consent?”

Schools now need to ask:

“Does this image still need to be public?”

“Could this pupil be identified?”

“Is any identifying information shown nearby?”

“Is this image being used on a public-facing school website or social media account?”

“Would this be better behind a parent portal?”

“Does this photo still support the purpose it was uploaded for?”

School website pupil photos are not wrong in themselves. Good school photos can still show learning, care, creativity and joy. But recognisable images of children need stronger review, clearer rules and better governance.

What has changed?

Schools have used photos for years in newsletters, prospectus photography, websites, social media, display boards, promotional material and school prospectus content.

Historically, most conversations focused on permission and presentation.

Now schools face a new risk: images that appear harmless on a school website can be copied and misused using AI tools.

The Internet Watch Foundation’s 2025 data highlights concern around AI-generated child sexual abuse material and states that action is needed from legislators and major technology platforms to stop AI technology being exploited in this way.

The Internet Watch Foundation’s Annual Data & Insights Report says it assessed 451,210 reports in 2025, with 311,610 confirmed to contain or lead to child sexual abuse material.

This does not make a school responsible for criminal misuse by others.

It does mean schools should reduce avoidable exposure where they can.

What are schools being advised to do?

The reported advice is to remove pupils’ online photos where they are clearly identifiable, or at least reduce the number of recognisable images published on websites and social media.

That does not mean removing every picture.

It means schools should remove recognisable images where they are not needed, remove pictures from old galleries, avoid pupil names beside photos, reduce close-up portraits, and use safer alternatives.

For example, schools can still show school life through:

• wider classroom images
• pupils shown from behind or from the side
• hands-on learning
• books, displays, equipment and resources
• group work from a distance
• outdoor learning
• staff teaching
• school buildings and spaces
• curriculum activity shots
• event images where children are less identifiable
• branded graphics or illustrations

This keeps the school website warm and useful for prospective parents, without relying heavily on close-up pupil photos.

Consent still matters, but consent is not the whole answer

Schools should obtain clear, written parental consent before uploading pupil photos to a public school website.

Consent for pupil photographs should be clear, granular and actively given. Schools should avoid pre-ticked boxes. Consent should usually be reviewed at the start of each academic year, then refreshed periodically.

Under UK GDPR, schools must identify a lawful basis for processing photos and videos. For promotional material, school prospectus content, websites and social media, consent is often used. But schools still need to be clear about the lawful basis they rely on and how the images will be used.

The Department for Education’s data protection guidance says schools should identify a lawful basis, manage consent and opt-outs, use images responsibly, store and share images securely, and make sure their actions are transparent.

The ICO says data protection law is likely to apply when photos or videos are taken for official use, such as inclusion in a prospectus or promotional material. Pupils, parents or guardians must be told how the photos or videos will be used.

That means schools should distinguish between:

• parents taking photos for personal use at an event
• a school taking photographs for official use
• a school posting images on a public website
• staff sharing photos on social media platforms
• images used in print or school prospectus material
• images uploaded behind a secure parent portal

Data protection law does not usually apply to photos taken by families for purely personal use. But school photos used for official use are different.

Personal use, official use and school rules

There is often confusion about taking photos at school events.

A parent taking photos at a nativity, sports day or awards event for personal use is different from the school taking photos for official use.

The school may still set rules about taking photos and sharing photos, especially where there are child protection concerns or pupils who must not be photographed. But from a data protection point of view, personal use is treated differently from official use.

Official use includes school website pupil photos, social media content, school prospectus photography, promotional material, ID cards, newsletters and print.

For official use, schools need:

• a lawful basis
• clear privacy information
• current consent records where consent is used
• an opt-out process
• secure storage
• clear rules for staff
• a review process for older images

Why full names and recognisable images are a problem

The safest approach is to avoid putting names beside pupil photos.

A photo on its own may carry risk.

A photo with a full name, class, year group, award, club, location or event detail adds identifying information.

Schools should avoid:

• full names in captions
• full names in file names
• named awards beside close-up portraits
• detailed personal stories beside pupil images
• public galleries linked to year groups
• old posts naming children
• social media posts linking names and faces
• downloadable PDFs with photos and personal context

The issue is not just the image. It is the combination of the image and identifiable information.

What about private schools, school trusts and educational institutions?

This applies to all educational institutions.

Maintained schools, academies, school trusts, independent schools, private schools, pre school settings, colleges and specialist settings should all review how they use pupil photos.

A trust-level approach is helpful where multiple school websites are managed centrally.

School trusts should consider:

• trust-wide guidance on posting images
• shared rules for social media accounts
• a standard consent process
• a clear approach to prospectus photography
• audit schedules for school websites
• staff training
• template wording for parent communications
• agreed rules for vulnerable pupils
• a reporting route for concerns

More schools are likely to be asked by parents what they are doing in response to the latest threats. A calm, well-documented review process will help.

What should schools review first?

Most schools will have hundreds, sometimes thousands, of public images across their websites and social media.

Start with the highest-risk areas.

1. Homepage

The homepage is the most visible part of the school website.

Check large banners, welcome images, feature panels and video thumbnails. Replace close-up pupil photos with wider school life images where possible.

2. Admissions and prospectus pages

Admissions pages are designed for prospective parents and are usually public. They need warmth and trust, but they do not need to rely on close-up pupil portraits.

Review every photo used in admissions content and the school prospectus.

3. News and galleries

News posts and galleries often hold the greatest number of pupil photos.

Review:

• trips
• residentials
• sports days
• performances
• music events
• award ceremonies
• classroom activities
• charity events
• leavers events
• transition days

Remove older images that no longer need to be public.

4. Social media accounts and embedded feeds

Many school websites display feeds from social media platforms.

Check whether posts from social media accounts are being pulled into the school website automatically.

A post on social media can become website content too.

5. Downloadable PDFs

Newsletters, event programmes, prospectuses and celebration documents may include pupil photos and personal context.

Review public PDF archives.

6. Vulnerable pupils

Avoid using images of vulnerable pupils unless there is a clear, specific approval process.

General consent should not be treated as enough in every case.

Practical steps to reduce risk

Schools can take sensible steps without making their websites look empty.

Use less identifiable photography

Choose photos that show learning, movement, resources and school life rather than close-up faces.

Reduce image resolution

Use lower-resolution files on public pages. Avoid uploading original camera files.

Strip EXIF data

Photos can contain hidden metadata. Schools should strip EXIF data before upload.

Use generic file names

Use names such as:

year-4-science-lesson.jpg

Avoid names that include pupil names.

Remove names from captions

Where possible, describe the activity rather than naming the children.

Limit old galleries

Large public galleries are hard to manage and easy to forget.

Use secure access for sensitive images

Some photos may be better placed behind a password-protected parent portal rather than on the public school website.

Train staff

Teachers, office staff and website editors need clear rules for taking photos, posting images and sharing photos.

Review annually

Photo and video content should be reviewed at least once each academic year.

What should a Safe Use of Pupil Images policy include?

Schools should create or update a Safe Use of Pupil Images policy.

This should cover:

• lawful basis
• consent
• opt-outs
• public website use
• social media use
• school prospectus use
• print use
• official use
• personal use
• taking photographs at events
• taking photos in lessons
• staff responsibilities
• use of professional photographers
• pupil vulnerability
• image storage
• file names
• EXIF data
• image resolution
• image review dates
• removal requests
• reporting concerns
• child protection escalation

This policy should be shared with staff and reviewed regularly.

What about professional photographers?

Professional photography can still be incredibly useful.

A skilled photographer can help a school capture natural, engaging images that show school life without relying on close-up portraits.

For a safer school photography session, brief the photographer before the shoot.

Set clear expectations:

• focus on learning and activity
• avoid unnecessary close-up portraits
• use groups from a distance
• include hands, resources, displays and classroom detail
• avoid pupils who do not have consent
• confirm storage and deletion arrangements
• check image file names
• clarify who owns and stores the final images
• review all images before use

Prospectus photography should be planned with the same care. The school prospectus is often downloaded, printed, shared and kept for years.

What if parents want to post photos?

Schools should give parents clear guidance.

Parents taking photos for personal use is one thing. Posting images online, especially where other people’s children appear, creates different concerns.

Schools can ask parents not to post photos or videos of other children on social media. Many schools already do this at performances, concerts and sports days.

This is a sensible child protection measure.

What if a school receives a threat?

If a school receives a threat linked to pupil images, blackmail attempts or AI-generated images, it should treat it as a safeguarding and incident response matter.

Schools should:

• involve the DSL and senior leaders
• preserve the message as evidence
• avoid forwarding any illegal imagery
• contact the police
• follow local safeguarding procedures
• report suspected child sexual abuse material to the Internet Watch Foundation
• take advice before communicating widely
• record all decisions and actions

The Internet Watch Foundation provides a route for reporting suspected child sexual abuse imagery online.

UK law and AI-generated abuse material

UK law is developing in response to these risks.

The UK Government has set out measures in the Crime and Policing Bill relating to child sexual abuse material, including AI-generated content and tools. The Guardian has reported that planned legal changes would criminalise possessing AI models designed to create such material, alongside other related offences.

Jess Phillips has spoken publicly about the need for action in this area as part of wider Home Office work on AI and child protection.

Schools do not need to become legal experts in AI.

But schools do need to understand that the public use of pupil photos now sits in a different risk environment.

Schools checklist: pupil photos, AI risk and website review

Use this checklist to review school website pupil photos and reduce avoidable risk.

Further guidance and useful sources

Schools may wish to review further guidance from:

• Internet Watch Foundation
• UK Safer Internet Centre
• Department for Education data protection guidance
• ICO school photography guidance
• National Crime Agency updates
• Education Scotland, Welsh Government and Northern Ireland safeguarding guidance where relevant
• Local safeguarding board guidance
• Trust or local authority data protection teams

The key point is to take action now without panic.

How Schudio can help

At Schudio, we help schools manage school website content with clarity, care and ongoing support.

School website pupil photos should now be part of regular website compliance and safeguarding review. They sit alongside child protection content, safeguarding pages, SEND information, curriculum content, admissions information, governance, policies and other core website requirements.

We recommend that schools complete a pupil image review across their website and social media accounts, then repeat that review each year.

The aim is not to remove the heart from your website.

The aim is to show school life in a safer, more thoughtful way.

Final thought

Schools should still be able to show joy, learning, friendship, creativity and community.

Prospective parents need to see what school life feels like. Current parents value seeing the work, events and experiences their children take part in.

But public pupil photos now need stronger care.

A safer school website can still be warm, personal and full of life.

It simply needs fewer recognisable images, less identifying information, stronger consent processes, better staff guidance and a regular review cycle.

The best next step is simple:

Review your school website pupil photos, remove anything that no longer needs to be public, avoid names beside images, and make pupil image safety part of your regular school website review process.