No Consent | algorithms.technology

The form

NSW Department of Education "Permission to Publish" form. One choice. Consent to all public publishing or none of it. School website, newsletter, Facebook Page, newspapers, external media. All or nothing.

There is no option to say "yes to the school newsletter, no to Facebook." There is no option to say "yes to the website, no to social media." There is no option to consent to private channels but not public ones.

The scale of the gap

An audit of all 2,160 NSW government schools verified that 79% operate public Facebook Pages under this consent framework. That is 1,713 schools and 596,069 students. The Permission to Publish form predates every risk documented on this site.

What the form covers vs what actually happens

What the consent form covers	What actually happens to public photos
School website and newsletter	AI model training by Meta (confirmed under oath, September 2024)
May be "discoverable online"	Scraped into 50B+ photo facial recognition database (Clearview AI)
May be "cached by search engines"	Included in AI training datasets (362 AU children found in one dataset)
Facebook, newspapers, external media	Used as source material for deepfake generation (Melbourne, 2024)
No mention of AI	Patterns learned from faces persist permanently in trained models

The binary trap

Say yes and your child's photo goes on a public Facebook Page accessible to anyone on the internet. Accessible to Meta's AI training systems. Accessible to Clearview AI's facial recognition scrapers. Accessible to anyone building an AI training dataset. Accessible to anyone with a "nudify" tool.

Say no and the school leaves your child out of newsletters, the school website, community communications, event photos. Your child becomes the one left out. The one whose face is pixelated. The one who has to step aside during group photos.

The form forces parents to choose between public exposure and social isolation. That is not informed consent. It is a forced choice.

No AI disclosure

The form warns that online content "can be discoverable online" and may be "cached by search engines." That is the extent of the risk disclosure.

Nothing about AI training. Nothing about facial recognition databases. Nothing about training datasets containing 5.85 billion images. Nothing about deepfakes. Nothing about the impossibility of removing data once it has been used to train a model.

The form was written before any of this technology existed. The risks it discloses bear no resemblance to the risks that actually exist.

No expiry

Consent remains effective "until I advise the school otherwise." No annual renewal. No periodic review. No prompt for parents to reconsider as the landscape changes.

A form signed in 2019 still governs a child's digital exposure in 2026. In 2019, Meta had not confirmed AI training on Australian posts. Clearview AI's database had not been documented. Human Rights Watch had not found 362 Australian children in a training dataset. The deepfake incidents at Australian schools had not occurred. The threat landscape has fundamentally changed. The consent has not.

Children have no voice

The children in the photos get no say. A parent, carer or guardian signs the form. The child is not consulted. A five-year-old has no input on whether their photo appears on a public Facebook Page. A ten-year-old who understands the internet better than most adults still has no input.

A 2024 peer-reviewed study found that these practices violate Article 12 of the UN Convention on the Rights of the Child, which guarantees children the right to express views on matters affecting them. Australia ratified that Convention in 1990.

The contradiction

In December 2025, Australia banned children under 16 from social media. The Online Safety Amendment (Social Media Minimum Age) Act required platforms to prevent under-16s from holding accounts. Platforms removed 4.7 million of them. As a country, we decided social media is not safe for children.

We still allow schools to publish children's photos on those same platforms. With consent forms that do not disclose the actual risks. On accounts that policy requires to stay public.

The law protects children from being on social media. Nothing yet protects them from being published on it.

What informed consent would look like

Separate consent for different channels

Newsletter, website, social media, external media. Each channel has a different risk profile. Parents should be able to consent to low-risk channels (password-protected website, emailed newsletter) without consenting to high-risk ones (public social media).

Explicit disclosure of AI risks

The form must state plainly that photos posted on public social media may be scraped for AI training, incorporated into facial recognition databases, included in training datasets, and used to generate synthetic images including deepfakes. If parents are not told, consent is not informed.

Default to private

The default should be private, with specific opt-in required for social media publication. Not the other way around. Not all-or-nothing. The current default exposes children to the highest level of risk unless parents actively refuse.

Children consulted

Schools should consult older primary and secondary students on decisions about their own images. This is consistent with Article 12 of the UN Convention and with basic respect for the people in the photos.

Annual renewal

Consent should expire and need renewing every year, because the risk keeps moving. A form signed in one year should not govern exposure in a year when the risks are materially different.

The department can update the consent form without legislation

The NSW Department of Education can revise the Permission to Publish form administratively. It needs no new law and no parliamentary process. One administrative decision could update the form to reflect current risks and offer granular consent. This is one of the three changes this investigation recommends.

Sources

← Training Datasets · All evidence