Our children's photos are training AI. Nobody asked us.
Photos of students sit on school Facebook pages that anyone on the internet can open, search engines index, and any AI scraper can copy. NSW Department of Education policy requires those pages to stay open. 1,780 schools. 637,818 students. Australia's eSafety Commissioner now tells schools to move student imagery into “a closed or restricted space”. The policy has not caught up.
We checked every NSW government school. 1,780 run a public Facebook Page.
We searched for a Facebook presence for 2,160 NSW government schools. 1,780 run public Pages: open to anyone on the internet, listed by search engines, reachable by AI scrapers and facial recognition systems. 637,818 students attend those schools, in every one of the 93 NSW state electorates.
The pattern holds across the state: 83% of metro schools, 81% of inner regional, 82% of outer regional. That is not 1,780 separate decisions. It is what one sentence of policy produces when it says accounts must not be private or closed.
The audit accessed no Facebook page and viewed no photograph of any child. It relies only on Google's public index, which is the point: if a search engine can list these Pages, so can everything else that crawls the web.
One department. Three changes. No legislation.
This campaign asks nothing of your school. A principal following the policy is not the problem, and one school changing its settings fixes one page out of 1,780. The instruction is written by the department, run by the department through its own Facebook Business Manager, and can be changed by the department.
Tell schools that AI scraping counts as a risk
The department's social media procedures, PD-2011-0418-01, tell schools to keep the account open. The same clause then says: “This does not mean that a school cannot restrict access, set as private or closed, or suspend the school account from time to time if required to manage or address any risks or issues.”
So a school is already allowed to close its page to manage a risk. What no school has been given is a statement from the department that AI scraping and deepfake generation is one. Until that exists, a principal who follows the eSafety advice is going against a written instruction on their own judgement.
The department can close that gap with guidance. No policy review, no consultation, no legislation. eSafety has already said whose job it is: “schools or school sectors can set common expectations and share practical guidance, reducing the need for each school to build its response from scratch.”
Rewrite the clause that says "Keep the school account open"
Change it so that a closed or restricted setting is allowed, and is the starting point, for any account that publishes photos of children. Victoria's education department already encourages restricted access. NSW is the outlier in requiring open accounts.
Rebuild the form parents sign
Permission to Publish is one yes or no covering the newsletter, the website, Facebook and the media together. It never expires and it mentions none of these risks. eSafety asks schools whether consent is “active, informed and current” and whether it covers social media specifically. This form fails all three tests.
Whatever brought you here, there's something for you
I'm not sure this is real
Straight answers to honest questions. Common doubts, addressed with evidence.
I want to push for the change
Enter your postcode, see the schools in your state electorate, and send your local member a letter in two minutes.
I need to explain this to someone
The regulator's words and the department's words, side by side. One minute to read, and neither of them is an opinion.
Show me the evidence
Senate testimony, Human Rights Watch reports, regulatory findings. Every claim sourced. Judge for yourself.
What happens to a photo once the page is public
Five things, all of them already documented. Meta said one of them under oath. A regulator found another. Human Rights Watch counted the children in the third. None of this is a prediction.
AI Training
Meta confirmed under oath to the Australian Senate that it scrapes every public post since 2007 to train AI. Children's photos are included. Australians have no opt-out.
Facial Recognition
Clearview AI scraped 50 billion+ photos from Facebook. The Australian Information Commissioner found it breached the Privacy Act. The database grew after the order to delete.
Deepfakes
AI-generated explicit images of 50+ schoolgirls at a Melbourne school. Created from their social media photos. Deepfake reports to the eSafety Commissioner are doubling year on year.
Training Datasets
Human Rights Watch found 362 identifiable Australian children in a single AI dataset, from less than 0.0001% of the data. Some photos came from school uploads.
No Consent
The NSW consent form is binary: all public publishing or nothing. It makes no mention of AI training, facial recognition, or deepfakes. It was written before any of this existed.
We banned children from social media. We're still publishing their photos on it.
In December 2025, Australia's Online Safety Amendment (Social Media Minimum Age) Act took effect. Platforms must prevent under-16s from holding accounts. 4.7 million accounts were removed. As a country, we decided social media is not safe for children.
Schools are still posting identifiable photos of those same children on those same platforms. Every week. On pages that are public by policy. Accessible to anyone on the internet. Scraped by the systems we just decided children need protection from.
The law protects children from being on social media. Nothing yet protects them from being published on it.
There is a second contradiction, and it sits inside the department's own procedures. The stated reason for requiring open accounts is to “reach a broader audience and build a stronger community”. A few pages earlier, the same document instructs schools not to use those accounts “as a primary method of communicating with parent or carers”, and to use email, the school website and school apps instead.
So the department has already decided Facebook is not how a school talks to its parents. The open setting is not serving the school community. What it adds is reach to everyone outside it.
“Posting fewer images of school students and personnel – or none at all – can reduce the risk. It cannot remove the risk completely because images may still be available from other public sources.” eSafety Commissioner, Sharing school imagery in the age of AI, 28 July 2026
“School accounts on public platforms must not restrict access or be set as ‘private’ or ‘closed.’” NSW Department of Education, Social media procedures PD-2011-0418-01, current
Stay informed. Help this spread.
The advisory is new. The policy has not changed yet. Sign up to follow the investigation and get told when new evidence, data or tools go up.
A photo already scraped cannot be unscraped. One sentence of policy can stop the next one.
The federal regulator has put in writing what schools should do. The state department still requires the opposite. That gap is not a technology problem and it is not a school problem. It is a sentence in a procedures document, and departments change those when enough people ask.