School Photo Consent in Australia: What the Privacy Act Actually Requires in 2026

Monique Marani

— 7 min read
Share

It's 8:40am and there's an email in the ICT inbox with the subject line "Please explain." It seems a parent has found a photo of their child in last term's swimming carnival gallery, posted to the school's Facebook page. However, the parents never agreed to it, and they reasonably want to know how it got there, who else can see it, and what your school is going to do about it.

If you're the person who has to answer that email, you already know the sinking feeling that comes with it. It's rarely about the photo itself. It's about not being able to say, with confidence, exactly what your school promised parents and whether the photo in question was covered by it. This guide is designed to remove that uncertainty. In it, we walk you through what Australian privacy law actually requires for student photography, where schools most commonly get it wrong, and what a genuinely compliant, low-risk approach looks like in practice.

Do schools need written consent to publish student photos in Australia?
In most cases, yes — schools need to give parents or carers clear notice of how photos will be collected and used, and should obtain specific, informed consent before publishing recognisable student photos outside the school's core educational purposes (such as on public social media or an unsecured website). Exactly which rules apply depends on whether the school is a government or non-government school, since that determines whether the federal Privacy Act or a state-based privacy law governs it — which is exactly why so many schools get their school photo consent policy wrong.

Strip away the legal language and the core idea is simple: a photo or video that shows a student clearly enough to identify them is treated as that student's personal information. Once it's personal information, a school can't collect it, use it, or share it however it likes — it has to be upfront about why it's collecting the photo, and in many cases needs permission before using it for anything beyond that original purpose.

A few plain-English facts worth knowing:

  • Which law applies depends on the school type. Independent and Catholic (non-government) schools are generally covered by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Government schools are typically governed by state or territory privacy legislation instead, which covers similar ground but isn't identical from state to state. If your school hasn't confirmed which regime applies to it, that's worth checking before you finalise any policy.
  • A photo doesn't need a name attached to count as personal information. If a student is reasonably identifiable — by face, by a name tag in shot, by context — the image itself is treated as their personal information, regardless of whether it's captioned.
  • Valid consent has to be genuinely informed, current, specific, and freely given. Legal guidance in this space generally points to four elements: the person understood what they were agreeing to, they agreed to that specific use (not a vague catch-all), the agreement is up to date, and it wasn't a condition they had no real choice about. A single tick-box at enrolment, never revisited, is unlikely to hold up as "current" consent three years later.
  • Capacity depends on the student, not a fixed cut-off. Guidance from the Office of the Australian Information Commissioner (OAIC) suggests schools assess a young person's capacity to consent on their own behalf case by case, and where that's not practical, treat students aged 15 and over as generally having that capacity unless there's reason to think otherwise. This matters for senior students who may be able to consent — or withhold consent — independently of a parent.
  • A code specifically addressing children's online privacy is still being finalised. The OAIC has been developing a Children's Online Privacy Code, which is expected to add more specific obligations for services (including edtech platforms) that handle children's data. Schools and vendors in this space should watch for the final version rather than treating today's guidance as the last word.

None of this means schools can't share photos of their students — plenty of proud, well-run galleries and newsletters exist. It means the permission needs to be real, specific, and something the school can actually point to if asked.

Most schools aren't being careless on purpose. The mistakes tend to come from forms and processes that were designed years ago for a much smaller footprint — a print newsletter, maybe a noticeboard — and never fully updated for searchable galleries, social media, and AI-powered photo platforms.

The most common gaps:

  1. Blanket consent forms. One tick at enrolment is treated as covering the newsletter, the website, the school app, social media, and third-party photography platforms — often for the student's entire time at the school. That's a lot of ground for a single, one-time signature to cover.
  2. No real opt-out mechanism. Parents can say yes at enrolment, but there's no simple, visible way to change their mind later without emailing the front office and hoping someone updates a spreadsheet.
  3. No granularity between contexts. "Photos of my child at school" doesn't distinguish between a small, secure parent gallery from a sports carnival and a public Facebook post — even though the privacy risk is very different.
  4. Unclear retention and redaction practices. Photos accumulate for years in shared drives, old galleries, and photographer archives, often with no defined point at which they're reviewed, restricted, or removed — and no reliable way to actually redact a specific student if a parent withdraws consent.
  5. No documented process for withdrawal. Even schools with an opt-out box rarely have a clear internal workflow for what happens operationally once a parent uses it — who actioned it, by when, and how it's confirmed.

Each of these is a plausible answer to "how did that photo get published?" — and none of them are a comfortable one to give a parent, or a regulator.

Good practice tends to share a few features, regardless of which system a school uses to manage it:

  • Consent is specific to context, not one blanket agreement — a parent might consent to a secure, password-protected class gallery but not to public social media, and a well-designed system lets them say so.
  • Consent is current, refreshed at sensible intervals (commonly at enrolment and then reviewed annually), rather than assumed to hold indefinitely.
  • Opt-out is genuinely easy to find and use — a parent shouldn't need to email three different staff members to have their child excluded from a public gallery.
  • Redaction is operationally real, not just a policy line. If a parent withdraws consent, the school needs a practical way to make sure that student doesn't keep appearing — including in photos taken by an external event photographer, which is where a lot of schools quietly lose control.

This is the point where photography and gallery technology genuinely matters, separate from the policy itself. Platforms like GeoSnapShot support this in practice through smart photo matching (AI face detection that groups photos by student) combined with consent filters and redaction controls, so a school — or its photography partner — can honour an opt-out at the point a gallery is built, not after a complaint arrives. The technology doesn't replace the school's consent policy; it's what makes the policy enforceable at the scale of thousands of event photos.

A practical compliance checklist for schools

  • Confirm whether your school sits under the Privacy Act or state/territory privacy law — this determines which specific obligations apply to you.
  • Split your consent form by context (secure gallery, newsletter, website, social media, third-party platforms) — avoids relying on one blanket "yes" for very different privacy risks.
  • Add a clear, easy-to-use opt-out option, reviewed at least annually — keeps consent current and gives parents real control.
  • Document what happens operationally when a parent opts out — turns a policy line into an enforceable process.
  • Confirm your event photographer or gallery platform can technically honour opt-outs and redactions — closes the most common compliance gap, which is third-party photo galleries.
  • Set a retention and review point for stored images — avoids indefinite, unreviewed accumulation of student photos.
  • Brief front-office and event staff on the process — most breaches happen at the point of collection or upload, not policy design.

Consequences vary by circumstance, but generally range from a parent complaint handled internally, through to a formal complaint to the OAIC or the relevant state privacy regulator if it isn't resolved to the parent's satisfaction. Reputational impact — the loss of parent trust — is often the more immediate cost schools feel, well before any regulatory step is involved.

There's no single fixed retention period set out for this in black-letter law, so most schools set their own policy based on general records-management guidance — commonly reviewing and refreshing consent annually and retaining records for as long as the student is enrolled, plus a defined period afterward. It's worth confirming your specific retention period against your school sector's record-keeping obligations, as these can differ between government and non-government schools.

A Gold-Standard Approach to Student Privacy

Getting your consent policy right is only half the equation — the other half is having a platform that can actually honour it at scale, across every gallery, every event, and every opt-out request, without relying on someone remembering to manually pull photos. That's the gap GeoSnapShot is built to close: smart photo matching and consent controls that work together, so redactions and opt-outs are enforced automatically rather than chased down after the fact. If you're reviewing your platform alongside your policy, here's our approach to school photo privacy.

Read more