Every school I have worked in has loved its sports day photos: a beaming Year 4 runner crossing the line, posted on the website with a first name and a proud caption. This autumn, artificial intelligence (AI) has turned that photo into a safeguarding question. The latest evidence on school photos and AI suggests many schools are already changing what they post, and for good reason.

In short: criminals have used AI to turn photos from a secondary school’s website into child sexual abuse images and then tried to blackmail the school. Almost half of headteachers in one United Kingdom (UK) survey say their school has dealt with some form of pupil image misuse, and fresh Teacher Tapp data shows rules on sharing photos tightening fast. You do not have to stop celebrating pupils online. You probably do need to stop publishing clear, named faces by default.

The case that changed the advice

In May, the UK Safer Internet Centre published updated image guidance for education settings from the UK Online Harms Early Warning Working Group, whose members include the Internet Watch Foundation (IWF), Childnet, the National Crime Agency’s education team and several children’s charities. The trigger was a real incident. Police called in the IWF after blackmailers took pictures from a secondary school’s website, altered them with AI tools and sent the sexual images to the school, threatening to share more widely unless it paid.

IWF analysts assessed around 150 confirmed images of child sexual abuse in that one case. The announcement is careful to say such incidents do not yet appear to be widespread. It is also clear about the direction of travel. “We feel it is only a matter of time before more schools are targeted in this manner,” said IWF Hotline Manager Tamsin McNally, adding that girls are usually the primary victims of image abuse. School staff and pupils over 18 are vulnerable in the same way.

What 500 headteachers said

The bigger numbers come from In Plain Sight, a report published in September by Aidos, a company that sells software to anonymise faces in school photos. Read it with that in mind. The fieldwork was done by the research firm Censuswide, which surveyed a representative sample of 500 primary and secondary headteachers across the UK between 5 and 11 June 2026.

Almost half (49%) said their school had experienced an incident in which pupil images were misused, manipulated or used in an extortion or blackmail attempt. That category is wider than AI blackmail, but it is still striking. A further 54% had personal worries that their published images could be vulnerable, and 45% had received a complaint from a parent about the misuse or potential misuse of a pupil’s image.

The gaps are in the detail. Some 93% of heads knew criminals were using AI on school photos, yet only 43% would feel very confident about what to do if a ransom demand arrived tomorrow. Most (85%) risk assess photos before publication, but just 43% said their consent process fully covers AI misuse, and 16% had no AI or deepfake policy at all. Old images linger as well: only 34% of schools refresh their published photos every year, while 52% do so every two to three years.

Leaders are torn. More than half (54%) are actively considering removing identifiable photos from their website and social media, while 94% say photography matters to their school’s culture, identity and reputation.

Schools are already tightening their rules

Independent data from Teacher Tapp, published on 13 October, shows the shift in practice. In the summer term, 54% of primary leaders and 71% of secondary leaders said their school shared photos of pupils on public social media accounts.

By September, 56% of primary and 69% of secondary leaders said their school shared images with faces fully visible. Only 13% of primary and 8% of secondary leaders shared photos but never faces, and 7% and 6% shared no photos at all. The trend is the interesting part: 43% of primary and 32% of secondary leaders said their rules had become more restrictive since last year. Teacher Tapp predicts more schools will stop sharing photos online.

A photo can still tell a family that their child belongs here. It no longer needs a clear face and a full name to do it.

A sensible policy on school photos and AI

The working group’s guidance starts with a blunt question: are images of children needed at all? Often they are not. A shot from behind of the Year 6 choir, hands on a relay baton, muddy boots after the cross-country or a science practical filmed over the shoulder all tell the story without giving a stranger a clean face to work with. Where you do use pupils, the guidance suggests photos taken from a distance or blurred, no full names, and closed groups rather than open platforms.

Two technical steps are easy to miss. Strip the Exchangeable Image File Format (EXIF) metadata, which can reveal location, device and time, and therefore routines such as when a team trains. Publish lower resolution images, which are harder to misuse. Ask your website provider whether both can happen automatically.

Here is what I would put on the next senior leadership agenda:

• Audit the website, social media and prospectus for identifiable pupil photos, and repeat the audit termly or twice a year, as the guidance suggests.
• Remove photos of pupils who have left. Years of old galleries are the easiest pickings.
• Rewrite consent forms so parents are told plainly about AI manipulation, re-sign them annually or at key transition points, and ask older pupils for their own consent too.
• Make faceless or distant shots the default for public channels, and keep clear faces for closed parent groups where they are needed.
• Train all staff to recognise and respond to image-based abuse, including everyone who posts on the school’s behalf.

None of this means a joyless website. The shift is from “do we have permission?” to the question the Aidos report puts well: could this image be used to harm this child?

If the email arrives

Agree the response steps now, because nobody thinks clearly while reading a blackmail message. Do not engage with the sender or pay. The guidance warns that paying a ransom can be illegal in certain circumstances. Do not delete or forward the material either. Keep it securely, take the original photos offline straight away and tell your designated safeguarding lead (DSL), then report to the police, calling 999 if a child is at immediate risk.

Under-18s can use Report Remove, run by Childline and the IWF, to report sexual images of themselves, including AI-generated ones, and try to get them removed. Over-18s, staff included, can use StopNCII.org. The guidance also reminds leaders that staff who see this material may need wellbeing support themselves. When you talk to pupils, the Aidos advice is simple and right: use age-appropriate language, never show or describe the images, and make sure every child knows they have done nothing wrong.

The threat is in pupils’ pockets too

Website photos are only one route. A Guardian report on 19 October described research by the Tech Transparency Project, a digital advocacy group, which used test accounts set up as 13-year-olds and was able to download 135 apps that can strip clothing from images or swap faces on to nude bodies. Many were rated as suitable for minors, so parental controls did not stop them. That research was in the United States, but the UK Safer Internet Centre cites research showing that 60% of eight to 17-year-olds worry that AI could be used to create sexual content of them or their friends.

So the photo policy needs a teaching partner. Personal, Social, Health and Economic education (PSHE) lessons and e-safety assemblies should now cover what nudify apps are, that making a sexual image of a child is illegal even when it is fake, and exactly who a pupil can tell. That builds on older work around digital footprints, with one uncomfortable update: a footprint can now be faked. And it belongs alongside the wider conversation about AI and pupil privacy that every school should be having with parents.

My own view is that schools should not panic and strip every photo by Friday. They should treat image security the way they treat fire drills: boring, regular, owned by named people and checked before anything goes wrong.

Frequently asked questions

Has your school changed what it posts this year, or are you still weighing it up? I would really like to hear how other schools are balancing celebration and safety, so please share your approach in the comments.