Photos of children on your website and socials: the rules

On This Page

Which rules apply to you
What the device law means for marketing photos
What consent should cover
Photos that don’t identify a child
Can I post this?
Publish your photo policy
Photo-ready checklist
My view
Questions I get asked

Search for a photos of children policy and you'll find other services' policy PDFs, an American consent form template, a British charity page and early childhood Facebook groups trying to work out whether parents can still take photos. None of it tells an Australian owner what you can put on your website and Instagram, what the new device law means for marketing photos, and what a consent form actually has to ask. That's this page. It's for childcare centres, preschools, OSHC and family day care, private schools, and anyone running classes or clubs for children: tutoring, dance, swimming, music and sport. I build websites for these businesses, and everything below comes from the National Law, the Privacy Commissioner, eSafety, Sport Integrity Australia and the state education departments.

The short answer

Childcare, preschool, OSHC and family day care: service devices onlyThe National Law now says images of children at the service may only be taken, stored or sent on a device the service supplies. Uploading to social media counts as sending. A personal phone never touches a child's photo.
Everyone: written consent for each useLearning records, newsletters, the website, social media and paid ads are separate uses. Ask about each one, and ask again before any new use.
No names, no routines, no locationsA face with a name, a class time or a location tag can help someone find a child. Hands, backs of heads and wide shots sell a service just as well.

Which rules apply to you

Four different sets of rules touch children's photos, and which ones bind you depends on what kind of business you run.

Childcare, preschool, OSHC and family day care

Device law: Part 6A of the Education and Care Services National Law. Images of children being educated or cared for may only be captured, stored or transmitted on a service-supplied device (in family day care, also a service-authorised one). Breaches are offences for the provider, the nominated supervisor, staff and volunteers.
Written policy: The National Regulations require a policy on the safe use of digital technologies that covers taking, using, storing and destroying images of children, and getting parents' authorisation. You must take reasonable steps to follow it.
Privacy Act: A private centre is usually covered, even if it's small, because it supplies a health service and holds health information: medication records, first aid, medical conditions. Council-run centres come under state privacy law instead.
Child safe standards: In every state with a scheme, your photo rules sit inside your child safety policy and code of conduct.

Private schools

Device law: Part 6A doesn't apply to a school as a school, but it does apply to any approved OSHC or preschool service the school runs.
Privacy Act: The Privacy Commissioner says a private school is usually covered: because of its size, because it's connected to a larger body, or because it supplies a health service and holds health information.
Child safe standards: Schools are covered by the schemes in Victoria, NSW and the other states that have them.
Reference points: The state education departments' own policies for government schools are a good model: consent before images go public, a choice to withhold or withdraw it, and contract clauses for photographers.

Tutoring, dance, swim, music and other classes

Device law: Doesn't apply, unless you run an approved education and care service.
Privacy Act: Many small businesses are exempt under a turnover threshold, but not if they provide a health service. If you keep allergy, asthma or medical notes and give first aid, the safe course is to assume you're covered. The exemption may not last, either.
Child safe standards: Victoria's standards name coaching or tuition services for children and sport or recreation services for children; Queensland's scheme names swim schools. Check your state.
Either way: Get written consent. Parents expect it, and consent is also your defence under the newer privacy tort.

Sports clubs

Your sport's policy: For sports under Sport Integrity Australia's integrity framework, its photography practices marked "required" are mandatory under the sport's safeguarding policy, including written parent or carer consent.
Privacy Act: The Privacy Commissioner says clubs that help members with injuries or fitness are probably providing a health service and should assume they're covered.
Public places: No law stops people photographing in a public park, so your policy can't bind spectators. It can bind your officials, coaches and club accounts.
Child safe standards: Sport and recreation bodies are covered in most states with a scheme.

One law reaches everyone. The statutory tort for serious invasions of privacy now applies to businesses whether or not the Privacy Act covers them, and a child has until their 21st birthday to sue. An ordinary consented class photo is a long way from a serious invasion of privacy, and consent is a defence, which is one more reason to have it in writing.

What the device law means for marketing photos

For childcare, preschool, OSHC and family day care, this is the part that changed. ACECQA's information sheet says transmitting includes sharing a photo by text, email or USB, and "uploading to any social media or information sharing platform". So:

Take marketing photos on a service device. A tablet or camera the service supplies, set up to follow your policy, never used for anything personal. An educator's own phone, own Instagram or own cloud backup must never hold a child's image.
Post from the service's systems. If the person running your social media works from home on their own laptop, that's a problem. Give them a service device and service accounts.
Plan marketing as its own photo session. The law allows images for the purposes of, or in connection with, providing education and care. Nobody has said in writing whether marketing counts. The safe reading is a separate, consented session, handled only on service equipment.
Parents aren't covered by the law, but your policy can cover them. People who aren't employed or engaged at the service can use their own phones there. ACECQA says you can still adopt a policy asking parents and visitors not to. Victoria's regulator suggests banning parent photos at events and sharing photos from a service device afterwards.
Professional photographers are a grey area. I couldn't find a regulator statement on whether a photographer engaged for photo day counts as staff under the device law. Victoria's regulator says photographers must use business-issued devices, and the state education departments want contract clauses on handling, storage and deletion. Do both.

The Privacy Commissioner's advice is to get express consent after telling people "in as much detail as possible" what the picture will be used for and who will see it, and to talk to the parent first for a younger child. Sport Integrity Australia says consent must state what images can be taken, how they'll be used, who can access them, how they're stored, when they're deleted, and that consent can be withdrawn at any time. Put together with the state forms, a good consent form does these things:

A yes or no for each use. Learning records, newsletters and family emails, website, social media, paid ads, print and news media, livestreams. Consent for one doesn't stretch to another: Sport Integrity Australia says images consented for skill development must not be used for marketing.
No name by default. First name only if the parent chooses it. Never a surname.
A choice about faces. Some parents are happy with hands and backs of heads but not faces.
Storage, access and deletion in plain words, including that social media and some website hosts store images overseas.
How long it lasts and how to withdraw. South Australia's education department form runs until consent is withdrawn in writing; NSW calls renewing it each year good practice. Do both: until withdrawn, confirmed at each re-enrolment.
The child's own say. There's no fixed age in the Privacy Act. The Privacy Commissioner says you may assume someone over 15 has capacity unless you're unsure. Ask every child on the day and respect a no; have teenagers sign too.
A confidential question about orders. Some children must not be identified for safety or legal reasons, and Sport Integrity Australia says a child under a care order needs the relevant Minister's consent.

Fill this in to draft the wording for your own form.

Photo consent wording

A consent form should name your business and a contact; say who takes photos and on what devices; give a yes or no for each use (learning records, newsletters, website, social media, paid ads, livestreams); offer no name or first name only, and face or no face; explain storage, overseas hosting and yearly deletion; say consent lasts until withdrawn and is confirmed each year; explain how to ask for removal; promise to ask again before any new use; ask the child too; ask confidentially about orders; and link to your full photo policy.

This is a starting point, not legal advice. Your sport's own form, your state's rules or your lawyer may ask for more.

Photos that don't identify a child

eSafety's advice to schools on sharing images is the best checklist I've found for any business: before publishing, think about the purpose, consent, audience and identifying details. Its point is that the details around a photo matter as much as the face. "A uniform can identify a school. A caption may name the student." Location tags, timetables and event details can show where a child will be. eSafety has also seen a rise in reports of anonymous accounts harvesting photos from school websites and social media, and warns that ordinary photos can be altered with AI tools.

What that means in practice:

Never pair a face with a routine. "Our Tuesday 4pm junior class" under a close-up tells a stranger where that child will be next Tuesday. For a centre or studio, your logo on a shirt is the point of the photo; the routine is what to leave out.
Turn off location on the camera, and don't location-tag posts that show identifiable children.
Shoot hands, backs and distance. Early Learning Victoria's own policy asks educators to avoid children's faces where possible and focus on hands and actions. Sport Integrity Australia suggests action shots without faces, and for swimming and gymnastics, children in the water or from the shoulders up.
Show the adults. Your educators, coaches and teachers can consent for themselves, and parents choosing a service want to see who'll be looking after their child.
Show the place. A room set up for the day, the pool before the lesson, the studio floor. Empty spaces photograph well and carry no risk.
Review old posts. eSafety asks whether archived pages and past posts still need to be public. Check old blog posts, Google Business Profile photos and Facebook albums once a year.

Stock photos of children with a commercial licence remove the risk to real children, and Sport Integrity Australia suggests them. Just don't caption them as your children. I'd avoid AI-generated children for the same reason: I found no Australian guidance on it, and an invented room full of invented children could mislead parents about the real thing. Never put a real child's photo into an AI tool.

Can I post this?

Tap a card to see the verdict.

Publish your photo policy

Victoria requires its government schools to put their photo policy on the school website, and child safe regulators want your child safety commitments public. Whatever your business, a short "How we use photos" page linked from your footer and your enrolment pages answers one of the first questions careful parents ask. The Privacy Commissioner's survey of parents found most rate protecting their child's personal information as a major concern, so a clear policy reads as care, not red tape.

Keep it short: what you photograph and why, the devices you use, the uses families can say yes or no to, no names and no location tags, how long you keep images, and one person and one email for removal requests. If you're an approved service, it should match the policy the National Regulations already require you to have.

Photo-ready checklist

Your ticks save in this browser.

Ten steps

Write a short photo policy and publish it on your website.
Collect consent for each use at enrolment or registration, with no name as the default.
Approved services: service devices only, set up to your policy, with somewhere to lock personal phones away and a register of any written authorisations, kept at least three years.
Keep a current "no photos" list where photographers and staff can see it, and use a discreet marker at events, such as a coloured wristband.
Turn off camera location, and don't location-tag posts showing identifiable children.
Prefer hands, backs, distance and adults for public marketing.
Contract photographers on handling, storage, deletion and no reuse of the images, with business devices only.
Ask the child on the day, and have teenagers sign.
Name one person for removal requests, act the same day, and review old posts and pages every year.
Delete originals you no longer need, and keep consents with each child's records.

My view

The best early learning, school and club websites I've seen use fewer photos of children than you'd expect. They show the educators, the rooms, the gear, children's hands at work and the occasional wide shot from families who said yes to everything. That's partly the rules, but mostly it's what reassures parents: a service that's careful with other people's children online is one they trust with their own. If you're an approved service, sort out the devices first, because the law is strict and the offences apply to individual staff. Then get the consent form right, and the website follows.

Questions I get asked

Is it illegal to post a photo of a child without permission in Australia?

There's no single law against it, and taking photos in public places is generally allowed. But a business that posts an identifiable child without consent can breach the Privacy Act if it's covered, its sport's safeguarding policy, and, for childcare, preschool, OSHC and family day care, the National Law's device rules. Always get written consent.

Can childcare educators use their own phones to take photos?

No. At approved services, images of children may only be taken, stored or sent on devices the service supplies, or in family day care, devices the service authorises. Breaches are offences for providers, supervisors, staff and volunteers.

Can parents take photos at childcare?

The National Law doesn't stop parents using their own phones at a service, but the service can set a policy asking them not to. Many now ban parent photos at events and share photos taken on service devices afterwards.

What should a photo consent form include?

A yes or no for each use, a choice about names and faces, who takes the photos and on what devices, storage and deletion, how long consent lasts, how to withdraw it, a promise to ask before any new use, the child's own say, and a confidential question about orders.

At what age can a child consent to their own photo being used?

The Privacy Act sets no fixed age. Organisations decide case by case, and the Privacy Commissioner says they may assume someone over 15 has capacity unless unsure. Get the parent's consent and ask the child as well.

About this guide

Written by Joseph Alzein, founder of bdog. bdog builds websites for early learning services, schools, and classes and clubs for children. The rules come from the Education and Care Services National Law, the Privacy Commissioner, eSafety, Sport Integrity Australia, Play by the Rules and the state education departments and regulators. Sources were checked on 12 October 2026. This is general information, not legal advice. Your service's policy, your sport's policy and your state's rules come first.

Main sources:

Photos of children on your website and socials: the rules

Which rules apply to you