The eSafety Commissioner says restrict school photos. NSW policy says schools must not.
Two current government documents in direct conflict, plus original research covering every NSW government school. Open methodology, full dataset available, both primary sources linked.
The story in three sentences
On 28 July 2026 the eSafety Commissioner published an advisory, Sharing school imagery in the age of AI, advising schools that “posting fewer images of school students and personnel – or none at all – can reduce the risk”, and that a risk-based approach helps schools decide which images are “better shared in a closed or restricted space”.
NSW Department of Education procedure PD-2011-0418-01 requires the opposite. Under the heading “Keep the school account open” it states that school accounts on public platforms “must not restrict access or be set as ‘private’ or ‘closed.’”
An audit of every NSW government school verified 1,713 (79%) operating public Facebook Pages under that instruction, covering 596,069 students, in all 93 NSW state electorates. 94% of those pages had posted within 30 days of the August 2026 verification pass.
1. The department's own procedures undercut its stated rationale. The reason given for requiring open accounts is “the main purpose for using a public platform is to reach a broader audience and build a stronger community”. The same document instructs schools “Do not use school accounts on public platforms as a primary method of communicating with parent or carers”, directing them to email, the school website and school apps instead.
2. The policy already permits what eSafety recommends. Three sentences after the prohibition: “This does not mean that a school cannot restrict access, set as private or closed, or suspend the school account from time to time if required to manage or address any risks or issues.” No school has a departmental statement that AI and deepfake risk qualifies, so no school has a clear basis to invoke it.
3. eSafety has documented the harm, named the source, and says it may be unable to remove some of it. Between January and March 2026 it received more than 100 reports about anonymous accounts targeting schools and school staff, and almost all “involved imagery harvested from school social media accounts or websites”. Where the resulting material is not sexual, eSafety says it “may be unable to seek its removal under the law”.
The fix is administrative and sits with one department. The three asks are here, and both source documents are quoted side by side here.
Key statistics
| Finding | Figure | Source |
|---|---|---|
| NSW government schools with verified public Facebook Pages | 1,713 (79%) | Original audit |
| Students attending these schools | 596,069 | Data.NSW |
| Verified Pages that had posted within 30 days of the August 2026 check | 1,613 (94%) | Original audit |
| Pages found in search but with no public posts to verify ownership against | 223 | Original audit |
| Pages under manual review because the posting account carries a different name | 78 | Original audit |
| NSW state electorates affected, of 93 | 93 | Electorate breakdown |
| Reports to eSafety, Jan to Mar 2026, about anonymous accounts targeting schools and staff | 100+ | eSafety advisory, 28 July 2026 |
| Of those, the share involving imagery harvested from school social media or websites | Almost all | eSafety advisory, 28 July 2026 |
| Increase last year in under-18 reports of digitally altered intimate images | 2× | eSafety advisory, 28 July 2026 |
| Photos scraped by Clearview AI from Facebook | 50 billion+ | Evidence page |
| Years Meta has scraped Australian public posts for AI | Since 2007 | Senate testimony |
| Australian children identified in one AI dataset | 362 | HRW report |
| Opt-out options for Australians from Meta AI training | 0 | Senate testimony |
Methodology
The audit ran in two phases. Phase 1 (April 2026) covered 2,160 of 2,210 NSW
government schools listed in the
Department of Education's public schools master dataset.
For each school we searched Google for site:facebook.com "[School Name]".
We categorised results by match quality, and a script QA'd every result for name overlap,
P&C detection, alumni detection, and URL pattern analysis. A stratified random sample of 30 results
was manually verified against Google search results: 90% confirmed correct matches.
Phase 2 (August 2026) re-verified every page the search had categorised as a school's own, by reading each page's two most recent public posts and comparing the name of the account that published them against the school's name. This checks who runs the page, not what a search snippet says. It also classified how recently each verified page had posted.
The headline figure (1,713 schools, 79%) counts only pages that passed that ownership check. A further 223 pages showed no public posts to check, and 78 are under manual review because the posting account carries a different name. Both groups sit outside the headline figure. The primary stat understates rather than overstates the finding.
At no point did we access, view, download or store a child's photo, name or personal data. Phase 1 used Google's public search index and the NSW government's published school dataset only. Phase 2 read page names, post dates and caption text, which is what it takes to confirm who runs a page and whether it is active, and nothing else. The audit is fully reproducible.
Full methodology, QA process, and limitations →
Data access
The full dataset (2,210 schools with Facebook presence classification, ownership verification, posting activity, student counts, school type, and geographic data) is available to journalists on request. The source school dataset is publicly available from Data.NSW.
Per-electorate figures. We joined the audit to current NSW state electorates, so the school count and student count for any of the 93 seats are available, along with the sitting member. Useful for a local angle. The postcode lookup on Take Action returns the same figures for one electorate at a time. Ask for the full table if you want all 93.
Email hello@algorithms.technology with "Data Request" in the subject line.
On the record
"A federal regulator has told schools to move children's photos into a closed or restricted space. A state department requires the opposite, in writing, and 1,713 NSW schools follow that instruction. Nobody has to take my word for either half of that, because both documents are public. The department can fix this without legislation, and the policy already contains the exception it would use to do it."
Ben Fitzpatrick, parent at a NSW public school and author of algorithms.technology
The audit shows that these Pages are publicly accessible and who runs them. It does not claim any particular school's photos have been scraped, or that any particular child appears in any dataset. We viewed no photograph of a child and accessed no student's personal data: the verification pass read page names, post dates and captions only. Schools and principals are following departmental policy, and the site does not attribute fault to them.
Available for interview. For quotes, background briefings, or additional data, email hello@algorithms.technology with "Media" in the subject line.
Key pages
- In the Media: What has already been reported on this, and by whom
- Conflicting Advice: the eSafety advisory of 28 July 2026 and PD-2011-0418-01, quoted side by side
- The Audit: Full findings, data tables, geographic breakdown, methodology
- The System: Legal framework, PD-2011-0418, protection levels
- AI Training: Meta's Senate testimony on scraping public posts
- Facial Recognition: Clearview AI, 50B+ photos, OAIC breach finding
- Deepfakes: Australian school incidents
- Training Datasets: HRW/LAION-5B, 362 Australian children
- The Asks: The three administrative changes, plus the top 10 state electorates by student count
- Take Action: Postcode lookup returning per-electorate figures and the sitting member
- About: Who I am, principles, independence, corrections policy
Contact
Ben Fitzpatrick
Parent at a NSW public school
hello@algorithms.technology
LinkedIn