School photo consent policy template: what to include (US, UK & EU)

A consent form asks a parent to tick a box. A consent policy tells the parent — and every teacher — exactly what that box permits, what it forbids, how to change their mind, and what happens to the photos afterwards. Without the policy, the form is a liability dressed as protection.

Below is a structure that works across daycares, preschools, nurseries, kindergartens and K-12 schools, with regional notes. Copy it, delete what doesn't apply, and make the language yours.

Section 1: Purpose

“We photograph and film children to share their learning with their own families, to document development, and — only with separate permission — to tell the story of our school publicly. This policy explains how we do that safely.”

Section 2: Definitions (the part most policies skip)

• Family-only sharing — a photo or video shown only to the child's own parents or guardians through the school's approved channel.
• Group sharing — content shown to the families of other children who appear in the same photo.
• Public use — website, social media, prospectus, press, or any audience outside enrolled families.
• Documentation — use for assessment, learning journals, portfolios or inspection evidence, not shared beyond staff and the child's family.
• Approved channel — the specific app or system the school has vetted (for example Oyku), as distinct from personal phones, WhatsApp groups or personal social media.

Section 3: Consent tiers

Offer parents separate, independent choices rather than one blanket box. Most families say yes to family-only sharing and are far more cautious about public use; a single tick-box forces them to refuse everything or accept everything.

1. 1Tier A — Family-only: I consent to photos/videos of my child being shared with me through the approved channel.
2. 2Tier B — Group: I consent to my child appearing in group photos shared with other families in the same class.
3. 3Tier C — Public: I consent to my child's image being used on the school website and social media (specify platforms).
4. 4Tier D — Print & press: I consent to use in printed materials and local media.

State clearly that Tier A alone is a complete, respected choice, and that a child with only Tier A still receives their own moments privately.

Section 4: Opt-out and the ‘impossible by design’ rule

The strongest sentence in any consent policy: ‘Consent status is recorded on each child's profile in our approved system, which prevents sharing beyond the consented tier.’ Consent that lives in a spreadsheet and a teacher's memory will fail on a busy Friday. Consent that the software enforces will not. If your current tool can't do this, that's a buying criterion — see how to choose a daycare app.

Section 5: Withdrawal

“You may change or withdraw consent at any time by [method]. We will apply the change within [2 school days] to future sharing, and will remove existing public content featuring your child within [10 school days]. Family-only content already delivered to you remains yours.”

Section 6: What we never photograph

• Toileting, changing, or any state of undress
• Children in distress or conflict without resolution
• Any child who asks not to be photographed, regardless of consent status
• Children whose consent status is unknown (new starters before forms are returned)
• Medical or safeguarding situations

Section 7: Devices and channels

“Staff may only capture children's images using [school devices / the approved app on personal devices, which stores nothing locally]. Staff may not share children's images through personal messaging apps, personal social media or personal cloud storage. Group chats with parents are not permitted.”

Section 8: Approval

“All photos and videos are reviewed and approved by [role] before they are visible to any parent. Public use requires additional approval by [role] and Tier C consent for every identifiable child.”

Section 9: Retention and deletion

“Family-only content is retained in the approved system for [the duration of enrolment plus X months], after which it is deleted from our systems; families may export their own child's content at any time. Public content is reviewed annually and removed on request or when the child leaves.”

Section 10: Third-party apps

Name the vendor. State what data they hold, where, under what agreement, and link to their trust documentation. Parents are entitled to know that ‘the app’ has a name and a contract. For Oyku, that page is our Trust Center.

Regional notes

United States (COPPA, FERPA, state law)

• FERPA: photos can be ‘directory information’ that parents may opt out of sharing; your policy should reference the school's directory-information notice and opt-out process.
• COPPA: applies to online services collecting personal information from children under 13. Tools with no child accounts (children never log in) sit in a simpler position; the school remains the party controlling consent. The FTC's amended COPPA rule reached its compliance date in April 2026 and tightened requirements for disclosures to third parties — check your vendor's stance.
• State laws: several states add student-privacy statutes and biometric restrictions (e.g. facial recognition). If your tool offers face-matching, treat it as a separate, explicit consent.

United Kingdom (UK GDPR, DPA 2018, ICO guidance)

• Photos of identifiable children are personal data. Identify your lawful basis (consent for sharing/public use is the norm; documentation may rest on public task or legitimate interests depending on setting type).
• Consent must be specific, informed, freely given and as easy to withdraw as to give — tiers, not a blanket box.
• Put a data-processing agreement in place with any app vendor and record it in your ROPA.
• Ofsted expects to see partnership with parents and safeguarding around images; a timestamped, approved record helps.

European Union (GDPR)

• Same principles as UK GDPR. Some member states and municipalities (notably in the Nordics and DACH) apply stricter norms on public images of children; default public sharing to off.
• Consider a DPIA for any new photo-sharing system in a setting with many children.
• Your vendor must offer an Art. 28 data-processing agreement (Germany: AVV) and, ideally, EU hosting.

UAE, India and Asia-Pacific

• UAE PDPL and India's DPDP Act both treat children's data with heightened care; verifiable parental consent is the safe default.
• Regulators such as KHDA and ADEK look for evidence of parent engagement and safeguarding; approved, timestamped sharing supports both.