Before You Post: What’s Changed About Sharing Photographs of Children Online

Author: Marcelina Horsefield

By the time a child turns 13, roughly 1,300 photographs and videos of them have been posted online, according to the Children's Commissioner for England. Parents take family photographs for all the normal reasons - to show relatives who live far away, to keep a record of sentimental moments, and sometimes because the child insisted on wearing a dinosaur costume to the shops.

This isn’t necessarily an argument that parents should stop. It’s a choice that’s affected by values, circumstances and how much risk a family is willing to carry. However, it’s worth knowing the specific risks that now exist and did not, or barely did, ten years ago, so the decision can be made with the best information.

Photographs That Don’t Go Away

The first thing to understand about any photograph posted to a public or semi-public platform is that deleting it does not necessarily remove it. By the time a parent changes their mind, the image may have been screenshotted, cached by a search engine, saved by another user or archived by a third party. The Internet Archive's Wayback Machine routinely captures publicly accessible web pages. A crawler (one of the automated programs search engines use to scan and record web pages) may have indexed an image's address long before the account was made private.

Many parents opened their social media accounts before privacy settings became granular, and some opened them before they had children at all. A photograph of a baby posted publicly in 2015 could still potentially exist somewhere, outside the control of the person who posted it, and despite locking down privacy settings in the years since.

Misuse of AI Image Tools

The biggest change in child image safety in recent years is the arrival of AI tools that can generate and alter photographs.

In 2023 the Internet Watch Foundation found AI-generated child sexual abuse material on the open internet for the first time. Some of it was entirely synthetic, but the rest came from what the IWF calls "nudification", software that alters real photographs of clothed children. In many cases the source images were ordinary family photographs taken from public social media accounts like a school sports day or a birthday party.

The tools involved are free or cheap and require no technical skill. A photograph of a child's face on a public account is, in the wrong hands, usable source material. The IWF has therefore said any image of a child online has the potential to be misused.

What Photographs Reveal

Open-source intelligence, usually shortened to OSINT, is the business of assembling information about a person from publicly available material. Journalists, investigators and security professionals do it for legitimate reasons, but so do people with worse intentions.

For families with a public profile, this is a serious concern. A photograph of a child in school uniform can confirm which school they attend in under a minute, and a determined person could establish the school’s address and a reasonable guess at the route the child takes each morning just from that photograph.

Any single post looks harmless, but the problem is accumulation. Ten photographs posted over a few years can together describe a child's week in some detail.

Metadata is also a consideration. Photographs taken on a smartphone carry EXIF data, a small record written into the file itself, which can include the make of the phone, the date and time, and the GPS coordinates of the spot where the shutter was pressed.

In 2014 an American art professor, Owen Mundy, built a site called I Know Where Your Cat Lives, which gathered publicly posted photographs of pet cats and plotted each one on a map of the world using the coordinates inside the image file. Very cute, but none of the owners had set out to publish their address.

Most social media platforms now strip this data on upload, but not all do, and not always. Messaging apps vary. An image sent by email or another application may arrive complete with its location data.

For families who already think about physical security, whether because they have protection arrangements or because they work in industries that attract threats, a child's digital footprint deserves the same attention as any other part of that assessment.

The Child's View

Alongside the technical questions is one that safeguarding professionals now raise more often: what does it mean for a child to acquire a public identity they had no hand in building?

A child photographed from birth and documented through adolescence has had a great deal of their life published before they were old enough to have an opinion about it. Some will reach their teens and find an online presence waiting for them that they never chose. The consequences bear on the child's long-term autonomy and, in some cases, on their safety.

The IWF's guidance for parents and carers recommends bringing children into conversations about consent as they grow, and returning to those conversations as the child's own use of the internet changes.

What Can You Do?

There are some practical steps you can take to reduce risk that don’t require in depth technical knowledge.

Check your privacy settings

Most applications group these in a section called Privacy, Safety or Account. If you do share photographs of your child, the IWF suggests restricting them to a close friends list or a selected group of contacts. Internet Matters keeps platform-specific instructions at internetmatters.org/parental-controls.

Audit

The IWF parent guide recommends going back through old posts and asking of each image: can my child's face, body or school uniform be seen; am I still comfortable with this being online; and can it be deleted or made private?

It is also worth checking whether friends and relatives have posted pictures of your child without asking, particularly around special occasions, school events and family gatherings.

Revisit who has consent

Most parents have had some version of this conversation with extended family, and with schools and clubs. The IWF recommends having it again periodically, and involving children themselves as they get older, so they understand that declining to be photographed is a legitimate thing to do. When a consent form comes home, the questions are whether you are still comfortable with how your child's images might be used, whether your preferences have changed, and whether you want to limit or withdraw permission.

Asking an organisation not to post photographs or video of your child online is entirely reasonable.

Reporting

The Online Safety Act 2023 requires platforms to identify and remove illegal content, including AI-generated abuse material. However, legislation tends to trail the technology it regulates, so these decisions shouldn’t wait for regulation to catch up.

CEOP takes referrals from parents, schools, platforms and the public about online child exploitation. Anyone who suspects a child's images have been misused can report it to CEOP.

Keeping It In Proportion

These risks sit on a spectrum. The right response depends on a family's circumstances, its security position, the ages of the children and what the parents judge the benefits of sharing to be, but the steps the IWF recommends are worth taking.

The tools that can process images will be considerably more capable in five years than they are today. The photographs posted now will still be online when those tools arrive. Have the needed conversations now, while the decisions are still yours to make.

If you would like a clearer picture of what your family's photographs reveal, we would be happy to talk it through with you in confidence. Get in touch today.

About the author   

Marcelina is a Cyber Security Advisor specialising in supporting public figures navigate their digital security with confidence. She has over a decade of experience in legal operations at a major international law firm, combined with hands-on work in digital resilience, cyber threat analysis and incident response. Her approach is practical and measured, focused on translating complex risks into clear, actionable steps.