News: UK schools should remove pictures of pupils’ faces from websites

“UK schools should remove pictures of pupils’ faces from their websites and social media accounts because blackmailers are using them to create sexually explicit images, experts have said.” [The Guardian, May 8, 2016]

News reports that UK schools are being blackmailed with AI-generated child sexual abuse images built from ordinary photos lifted off school websites and social media accounts should be an urgent call to action for the sector. The Internet Watch Foundation has confirmed at least one secondary school targeted, with 150 manipulated images classified as CSAM under UK law. The Early Warning Working Group — which includes the NSPCC, IWF, Welsh Government, Education Scotland, the Safeguarding Board for Northern Ireland and the National Crime Agency — has now issued formal guidance telling schools to remove identifiable, face-on photos of pupils.

This is not new. We have warned for years that schools are the largest open repository of children’s faces in the country. Every prospectus, every Twitter post, every results-day photo is training data for somebody. Once an image is online, it cannot be recalled. Faces, like fingerprints, are biometric ID for life.

We repeat our own ask from January 2024 on the education sector to stop posting children’s faces online and support for the Early Warning Working Group call — however we also note the same Early Warning Working Group includes the NSPCC. Their “Number Day” encouragement of schools posting children’s facial photos on social media was most recently only in February this year, and we wrote to them at the time. We hope that same message will be acted upon internally across the charity to end it before 2027.

The risks are not hypothetical. Published misuse of children’s photos includes that by sextortion gangs, AI marketplaces offering “bounties” for deepfakes of real people, Clearview-style scraping into law-enforcement databases, and state-level facial recognition systems used to target minorities abroad. Reuses of UK school children’s images for any of this does not need a child to do anything wrong, to be of a certain age, to have a social media account — all the government’s recent focus of “online safety”. It only requires a school to publish their face.

We are calling on the Department for Education, the devolved administrations and the teaching unions, and have written to them, to act on three things before the summer term ends: stop publishing identifiable pupil photos; abandon biometric readers for cashless catering and library systems; and — most urgently — end the annual ritual of exam results-day photographs on social media in 2026.

Let’s make 2026 the first school admissions’ cohort whose faces, their digital identities, are not exposed online by their teachers in over twenty years.

Children are not your cash cows to turn their images into AI training data and products, or to use for marketing your schools. Children are in your care while in education and that should not jeopardise their digital identity for life, through misuse or worse. Schools must stop compromising children’s safeguarding.