It was concerning, but sadly unsurprising, to read a Guardian article reporting that UK schools are being blackmailed with AI-generated child sexual abuse images created from photos shared on school websites and social media pages (UK schools should remove pupils’ online photos as AI blackmail threat grows, say experts, 8 May). Lord Russell, in the 2024 debates on the data (use and access) bill, highlighted the potential for AI to be used to scrape images from school websites and social media. His comments were informed by research undertaken by Defend Digital Me, which found pupil data in publicly available AI training datasets.
Welsh government guidance warns schools to “exercise great caution sharing images or videos of learners publicly on social media platforms due to the potential risk of the content being misused”. It notes that social media platforms are vulnerable to web scraping, and that the large-scale collection of information posted online, and resulting loss of control over images, can expose pupils to privacy risks. The only advice that the Department for Education provides schools on pupil image use appears in its data protection guidance. This states that social media use “often requires extra care”, and that schools should “make pupils and parents or carers aware that social media involves wider sharing and may carry higher privacy risks”.
My research confirms that many education authorities provide guidance on the use of pupils’ photographs, routinely advising schools to obtain parental consent before sharing images online. However, only 7% of authorities who disclosed their guidance mentioned that posting photographs on social media may pose a risk to children’s privacy. Parents are therefore being asked to provide consent to photographs being shared online without being told of the risks that these posts may pose.
It is not only web scraping that poses a risk to children. Which school a child attends can be inferred from a school’s social media posts. Many children are identifiable to strangers even if pupil or school names are not included alongside images. By posting children’s facial images online, schools can unintentionally compromise children’s privacy, exposing them to risks of identity fraud, harassment and grooming, and to exploitation by platforms.
Dr Claire Bessant
Associate professor, Northumbria Law School, Newcastle upon Tyne