One government says restrict. The other says you must not.
Australia's eSafety Commissioner has told schools to post fewer identifiable images of children and to move school imagery into closed or restricted spaces. NSW Department of Education policy tells its 2,200 schools the opposite. Both documents are quoted in full below, and both are public.
What eSafety published on 28 July 2026
The advisory is titled Sharing school imagery in the age of AI: risks, deepfakes, and how to protect students and staff. It is guidance, not law. It is also the clearest statement any Australian regulator has made about what school photos now cost.
On what public means now
“Once content is public, schools have little control over who copies it, where it is distributed or how it may be modified.”
“A staff headshot can become a fake video within minutes. A student photo can be altered or sexualised without consent.”
On how much to post
“Posting fewer images of school students and personnel – or none at all – can reduce the risk. It cannot remove the risk completely because images may still be available from other public sources.”
On where imagery belongs
“A risk-based approach helps schools decide which images belong on public channels and which are better shared in a closed or restricted space.”
On what to check before posting
The advisory sets out a pre-publication checklist. Two items speak directly to the settings on a school account:
Audience. “Is the account public? Who can view, comment or reshare the content?”
Old material. “Do archived pages or past posts still need to remain public?”
On consent
“Is consent active, informed and current? Does it cover school social media posts?”
The NSW Permission to Publish form is a single binary choice, it has no expiry, and it does not mention social media separately from newsletters or AI at all. It answers no to all three parts of that question. See the consent form in detail.
On what happens when the content is not sexual
“A non-sexual deepfake, such as a face swap, fake dance video or harmful meme, may still cause deep distress. But this content may fall outside the legal criteria for child cyberbullying, image-based abuse or adult cyber abuse because the threshold for adults is higher than for children.”
“Such material may cause real harm but eSafety may be unable to seek its removal under the law.”
This matters for the policy argument. For a large class of harm built from school photos, there is no regulator who can order it taken down. Prevention is the only control that works, and the settings on the account are the prevention.
Side by side
The same question, answered by the federal online safety regulator and by the NSW Department of Education.
| The question | eSafety Commissioner, 28 July 2026 | NSW DoE, PD-2011-0418-01 |
|---|---|---|
| Can a school account be closed or restricted? | Some images are “better shared in a closed or restricted space” | Accounts “must not restrict access or be set as ‘private’ or ‘closed.’” |
| How many identifiable images should a school post? | “Fewer – or none at all” | Encourages “sharing positive stories such as awards and achievements” |
| Should the account being public be reviewed? | Yes. “Is the account public?” is a required check | No. Setting up an account requires schools to “ensure the school account does not restrict access” |
| What about the historical archive? | Asks “Do archived pages or past posts still need to remain public?” | Silent |
| Does consent need to cover social media specifically? | Yes. “Does it cover school social media posts?” | One binary consent covers newsletters, website, Facebook and media together |
| Who should set the standard? | “Schools or school sectors can set common expectations” | Risk assessment is delegated to each school's “local context” |
Every cell in this table is a quotation or a direct paraphrase of a numbered clause. Both source documents are linked at the foot of this page. Retrieved 4 August 2026.
This is not a hypothetical risk
The advisory reports what eSafety is already receiving. The source of the imagery is named explicitly.
“Between January and March 2026, eSafety received more than 100 reports about anonymous accounts targeting schools and school staff. Almost all involved imagery harvested from school social media accounts or websites.”
This is the link that was previously missing. Until now the argument for restricting school accounts rested on what was possible. eSafety has now documented, in a single quarter, more than a hundred cases where it actually happened, and identified school social media as the source in nearly every one.
The advisory also records that the content included “AI-generated dance videos and face swaps, as well as memes using staff photographs and fabricated stories about teachers, principals and other school staff”, and that much of it appeared on TikTok and Instagram. It notes that overseas, “criminals have taken student photos from school websites and used AI to create sexually explicit images for a school extortion attempt”.
NSW Government agencies are banned from installing TikTok on government-issued devices, and the department directs schools away from YouTube for school accounts. Facebook and Instagram are the two platforms the department supports, and on those two it requires the account to be open. eSafety reports that much of the harmful material it saw appeared on TikTok and Instagram.
The contradiction is inside the department's own rules
The stated reason for requiring open accounts is community. The same document rules out using those accounts for community communication.
The reason given for the rule
“The main purpose for using a public platform is to reach a broader audience and build a stronger community, which includes extended family and friends of students and people in the local area.”
The rule that undercuts it, from the same procedures
“Do not use school accounts on public platforms as a primary method of communicating with parent or carers. Schools must use established channels on department platforms (for example, email, school website, applications from the Administration Marketplace Panel for Schools …) as the primary way to communicate with parents or carers.”
The department has already decided that Facebook is not how a school talks to its parents. Email, the school website and the school app are. So the mandatory open setting is not serving the people who chose the school.
What it adds is reach to everyone outside that community: the extended local area, anyone on the internet with or without a Facebook account, search engine crawlers, AI training scrapers, facial recognition companies, and the anonymous accounts eSafety counted more than a hundred times in three months.
The department does not need to rewrite the policy
The escape hatch is already written into the same clause that creates the prohibition.
PD-2011-0418-01, section 2.1.4, “Keep the school account open”
“School accounts on public platforms must not restrict access or be set as ‘private’ or ‘closed.’”
“Schools can create private or closed groups on public platforms, but the main channel for the school account on the public platform must be open.”
“This does not mean that a school cannot restrict access, set as private or closed, or suspend the school account from time to time if required to manage or address any risks or issues.”
The policy already permits a school to restrict access to manage a risk. What no school has is a statement from the department that AI scraping and deepfake generation is such a risk. Without it, a principal who restricts the account is departing from a written instruction on their own judgement.
The department can close that gap by issuing guidance that names the risk eSafety has now documented, and confirms that restricting a school account in response to it is within policy. That requires no policy review, no consultation and no legislation.
School Facebook accounts are created by the department's social media team on the school's behalf, and “all school accounts on Facebook must be linked to the department's Business Manager”, a system the procedures note was “previously referred to as the NSW Facebook Schools Project”.
This is a centrally administered estate of roughly 1,780 accounts, not 1,780 independent decisions. The department can change the standard once.
eSafety is not asking individual schools to work this out
The advisory twice puts the responsibility at sector level. In NSW public education, the sector is the Department of Education.
On setting the standard
“Schools or school sectors can set common expectations and share practical guidance, reducing the need for each school to build its response from scratch.”
On supporting principals
“School sectors can give principals clear guidance and shared language.”
The department currently does the reverse. Its procedures require each school to “identify and assess foreseeable risks” and develop processes “for their local context”, while the one decision that would reduce the risk most, restricting the account, is removed from local discretion and prohibited centrally. Risk assessment is devolved. The setting that follows from it is not.
A principal following departmental policy in good faith is not the problem, and a school that acts alone fixes one page out of 1,780. The instruction is centrally written, centrally administered, and can be centrally changed. That is where the pressure belongs.
What this covers in NSW
An audit of every NSW government school, run in April 2026 and reproducible from public data, establishes the size of the estate the policy governs.
Read the full audit and methodology, including what it deliberately did not do. No content was accessed from any Facebook page and no photograph of any child was viewed or downloaded.
Three things the department can do
None of them require legislation. The first requires nothing but a memo, sent under a risk exception the policy already contains.
- Sharing school imagery in the age of AI: risks, deepfakes, and how to protect students and staff – eSafety Commissioner, 28 July 2026
- Social media procedures PD-2011-0418-01 – NSW Department of Education
- School photo posts vulnerable to emerging AI threat – eSafety Commissioner media release
- Toolkit for Schools, including Prepare 4: Guidelines for social media use – eSafety Commissioner
- NSW Public Schools Master Dataset – Data.NSW
Both primary documents were retrieved and quoted on 4 August 2026. If either changes, this page will be updated and the change noted. Corrections to hello@algorithms.technology.
Follow the investigation
Get notified when the department responds, or when the policy changes.
Last reviewed: August 2026