Protecting Student Images from Exploitation

Schools photograph students to celebrate school events and achievements, communicate with families, and promote their programs. However, these images of children, often hosted on your website or social media accounts, also may become material for extortion, identity-based abuse, or artificial intelligence (AI) deepfakes.  

Bad actors may copy publicly available photographs and use AI to create realistic, sexually explicit images that falsely depict students (or threaten to do so). In early 2026, photos were taken from a school’s public website in the United Kingdom, resulting in schools reconsidering publishing photos that easily identify a student.  

Failure to protect student images could result in allegations of negligence. Students also may seek your help removing doctored school images from covered platforms under the federal Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks (TAKE IT DOWN) Act (see below). 

Treat Images as Sensitive Information 

A photograph may reveal more than a student’s appearance. Combining the image with a name, age, team, uniform, location, or schedule can help criminals identify and target a child. Ordinary photographs can be manipulated into explicit content and used for harassment or extortion, or can be posted on websites without a subject knowing. 

Take student image governance seriously. Consider creating a small group including members of school leadership, communications, and information technology, along with employees tasked with child protection and risk management, to review your use of student images. Survey digital spaces where student images are found, including:  

• Public websites and social media
• Parent portals and classroom applications
• Yearbook and photography vendors
• Athletics, arts, camp, and travel platforms
• Shared drives, cloud accounts, and employee devices 

Determine who on staff is authorized to photograph students as well as upload, download, share, or delete images. Once these rules are in place, designate someone (likely from your Communications department) to monitor posting of student images.  

Reduce Public Exposure 

Before publishing a photograph or video to a publicly facing space, try to select one without an identifiable face. Consider these alternatives:  

• Group photos and videos taken from a distance
• Photographing students from behind
• Cropped images of activities 
• Facilities, performances, or events without faces
• Lower-resolution images 

Even if a photo or video does not include a student’s face, you still should avoid attaching their full name, age, grade, travel itinerary, or real-time location to any photographs. Review and remove location metadata when possible. Delay posting photos of off-campus activities to social media until the event is over and students have left the location. 

Inform Parents and Guardians 

Many schools include a photography and video image release in their enrollment contract or parent and guardian handbook. While permission is important, a signed release does not prevent someone from copying or manipulating an image you post. Nor does it prevent parents or guardians from pursuing a claim on a student’s behalf if an image is stolen or manipulated.  

Work with legal counsel on your release language and be sure to note foreseeable online risks when seeking photography permission. You may wish to note and distinguish when photos will be taken for internal use, family-only communications, and public marketing. 

If a family does not sign the photo release, do not post images of that student.  

Secure Images and Review Vendors 

Store original, high-resolution images only in school-approved systems that use multifactor authentication, role-based access, and system logging. Follow all security updates. Consider setting up a system to prompt removal of employees’ system access once someone leaves your school’s employment. 

Prohibit employees and official school volunteers from storing student photographs in personal cloud accounts or posting them through personal social media profiles. 

Many student photographs are taken by or transmitted to third-party vendors. Compile a list of outside parties authorized to photograph students or store the images. The list might include photographers, yearbook companies, and classroom support applications.  

Review terms of contracts with these vendors to be sure they address: 

• Permitted uses of student photographs
• Prohibitions on using images to train AI systems
• Security and access controls
• Breach notification
• Retention and secure deletion
• Cooperation with investigations and takedown requests
• Indemnification and appropriate insurance 

As part of their contracts, require your vendors to disclose any subcontractors and where and how images and metadata will be stored. Include, when possible, a contract clause requiring notification if storage or security conditions change during the contract term.  

Update Policies and Training 

Your policies must adequately address the use and protection of student images. Review, and update if needed, policies addressing image capture consent and acceptable image use. Train your employees on these policies.  

In addition, address unauthorized use of student images. Your policies should expressly prohibit non-school-related use of student images as well as creating, requesting, possessing, or distributing manipulated sexual images of another person. Train employees to report suspected misuse of student images as well as suspected deepfakes immediately, including not forwarding or sharing the image.  

Work with legal counsel to understand your legal obligations in the event of image misuse or a deepfake created from a photo on your website or social media accounts. Understand applicable privacy, security breach notification, child protection, and mandatory reporting laws in your state.  

Prepare an Incident Response 

Include image misuse or exploitation in your crisis response plans. In the event of an incident, identify who will contact law enforcement, legal counsel, insurer, forensic specialists, affected families, and relevant online storage or publishing platforms, including social media. 

Have a plan in place and adjust your response according to the circumstances. Take these basic steps: 

• Do not let individual employees negotiate with an attacker.
• Contact law enforcement.
• Preserve demands, usernames, URLs, time stamps, emails, and system logs.
• Do not ask anyone to download or circulate explicit images.
• Remove compromised source photographs from public view without destroying evidence.
• Determine whether legal, insurance, or child protection reports are required.
• Designate a school contact for affected students and provide appropriate support. 

Keep gossip and speculation to a minimum and communicate only verified facts. 

The federal TAKE IT DOWN Act requires covered platforms to provide a removal process and respond to valid requests within 48 hours. Work with legal counsel and assist families with these requests when possible if a school image was used.

More From UE 

Reducing Harm to Students from Deepfakes  

Avoid Unfavorable Indemnity Provisions in Institution Contracts  

Additional Resources 

National Center for Missing & Exploited Children: Take It Down 

GovInfo: TAKE IT DOWN Act