Why it's different
- Under GDPR/UK GDPR, biometric data used to identify a person is special category data with stricter conditions and, typically, a DPIA.
- Several US states regulate biometric identifiers directly, and COPPA's 2026 amendments tightened third-party disclosure.
- Once a face template exists, it is a new category of risk that a photo alone never was.
If you use it anyway
- ✓Separate, explicit, opt-in consent — not bundled with photo consent
- ✓Off by default
- ✓A DPIA covering the vendor's model, storage and deletion of templates
- ✓Clear withdrawal that deletes the template
- ✓No use for anything beyond in-app tagging
The alternative
Teacher tagging. A teacher taps the children in the photo — the same ten seconds — and the family sees exactly what a person, not a model, decided to share. This is how Oyku works: per-child tagging by the teacher, an optional parent-uploaded reference photo that never leaves the family's own profile, and no facial recognition model applied to the school's photos.
See it live
Want this for your classrooms?
Book a 20-minute call. We'll show the parent feed, teacher capture and approvals — then set up a free pilot classroom. Under $10 per child, per month.
