In short
- A class total or a school's placing identifies no child, so you can publish it without asking anyone.
- A named award, a photo, a piece of work or a video identifies a child, so publish it only with agreement and the least detail needed.
- Three ideas sit behind the rule: a child's data deserves extra care, use no more than you need, and people can change their mind.
- This is general information for school staff, not legal advice, so check the rules of your own country with your own adviser.
A school wants to be proud in public. A child has a right to be left out of the picture. Most of the time they do not clash. Publish what the group did, and ask before you publish anything that points at one child. This article takes the common cases in turn, gives the ideas behind the rule, and explains what to do when a parent asks for something to come down. It is general information for school staff, not legal advice. Laws differ between countries, so check the rules of your own country with your school's own adviser.
Can a school publish student achievements online?
Yes, with one line drawn through the middle. Results that describe a group, such as a class total or the school's placing in a competition, identify no child, so you can publish them freely. Anything that identifies a child, such as a named award, a photograph, a piece of work or a video, needs agreement from the family, and often the pupil, before it goes on a public page. Then use the least detail that does the job.
| What you want to publish | Usually low-risk | Usually needs agreement |
|---|---|---|
| A class or year total ('Grade 6 finished 412 stories') | The number, the class and the term. No child is named or shown. | Nothing, if the group is big enough that no one can be picked out. |
| The school's placing in a competition | The placing, the level and the date. The subject is the school. | Nothing, unless the announcement names or shows individual pupils. |
| A named pupil's award | Inside the school: assembly, noticeboard, a letter home. | On the website or social media: the parent's agreement and the pupil's view. First name and class at most. |
| A photograph | A wide shot of a crowd, or backs of heads, with no names. | Any recognisable face. Never put a full name next to a face on a public page. |
| A piece of pupil's work | An extract with the name removed, or first name only in a newsletter that goes to families. | Public posting with a name, or work that reveals private things about the family. |
| A video | A recording kept inside the school for teaching. | Any public video with faces or voices. Keep it short, and record who agreed. |
For what belongs on a public reading page, see What to Publish About Your English Program.
Three ideas behind the rule
The table rests on three ideas, each found in an official text. The texts are cited for what they say, not as a statement of what applies to your school.
- A child's information deserves extra care. Recital 38 of the European Union's General Data Protection Regulation (GDPR) says children merit specific protection with regard to their personal data. They may be less aware of the risks, the safeguards and their rights.
- Use no more than you need. Article 5 of the GDPR says personal data must be adequate, relevant and limited to what is necessary for the purpose. The law calls this data minimisation.
- People can change their mind. Article 7 of the GDPR says consent can be withdrawn at any time, and that it shall be as easy to withdraw as to give. Article 17 gives a right to erasure where consent is withdrawn and there is no other legal ground.
The last idea matters most for children. Recital 65 of the GDPR says the right to erasure is relevant in particular where a person gave consent as a child and later wants the data removed. A photo posted when a pupil is nine is still online when they are nineteen. Steinberg (2017), writing about parents in a United States law journal, warns that the disclosures adults make online 'are sure to follow their children into adulthood'. Her subject is families, not schools, but the warning carries over.
The Council of Europe (2021) guidelines on children's data in education add a caution about consent itself. They say consent may be invalid where a power imbalance exists, and that the imbalance is even more significant where the data subject is a child. So make it clear that saying no has no cost, and mean it.
Totals, placings and named awards
A class total is the easiest thing to publish and the most useful. 'Class 5B read 96 stories in October' names no one, and every pupil is inside the number. One care: keep the group big. A total for 'the three pupils in the B2 group' is a result about three children in all but name. If a class has one pupil at a level, report the grade, not the class.
A competition placing is a fact about the school. 'We placed third among B1 schools in the spring standings' is yours to publish. If you run a reading competition between schools, check what the organiser publishes about pupils.
A named award is different. 'Reader of the term: Lina K., Grade 6' identifies one child. Inside the school, an assembly or a noticeboard is normal school life. On the website or a social media account, the audience is anyone, for as long as the page exists. Ask the parent, ask the pupil, and use first name and class at most. Certificates follow the same rule.
Photos, pupils' work and video
The United Kingdom's Information Commissioner's Office (ICO) states the starting point plainly. If someone can be recognised from a photograph, it is usually their personal data. Purely personal use, such as a parent filming a school play for the family album, is outside the law. A prospectus photo taken by the school is inside it. The ICO recommends telling pupils and parents how an image will be used and offering an opt-out. It also says a public social media account, viewable by an indefinite number of people, calls for extra care with children's images.
The UK Department for Education (2023) guidance on data protection in schools has a section on photos and videos. It says consent, where a school relies on it, must be freely given, specific, informed and unambiguous. It notes that many schools collect specific consent for social media, and that families should be told social media may carry higher privacy risks.
A piece of pupil's work
A story, a poem or a drawing can identify a child twice: through the name on it, and through what it says. A pupil's story about 'the day my parents argued' is private even with the name removed. Read the work as a stranger would before you post it.
A video
A video carries a face, a voice and often a name spoken aloud. The Council of Europe (2021) guidelines mention children's images and voice data when they discuss recorded lessons. They say consent for such processing cannot be assumed by the institution on behalf of the child. Treat a public video as the highest-care case: agreement for every pupil shown, and the shortest cut that works.
First name only, full name, or no name?
Start from the least detail.
- No name. 'A Grade 6 pupil finished all twelve B1 stories.' Enough for most public posts.
- First name and class. 'Lina, Grade 6.' Enough for a school newsletter or a noticeboard, where readers already know who Lina is.
- Full name. Only when the pupil and family want it, and never beside a face on a public page.
A first name is not always anonymous. In a school of 300, 'Lina in Grade 6' may be one child, and the class photo on the next page completes the picture.
Some pupils do not want to be named, and the wish deserves weight. The Council of Europe (2021) guidelines say children should be enabled to both give and withhold consent where they can understand the implications. The UK Department for Education (2023) guidance calls it good practice to ask pupils directly once they can understand how their image may be used, often at around 13. A quiet 'you can say no' is worth more than a form.
Livingstone, Stoilova and Nandagiri (2019) reviewed the research on children's data and privacy online. They write that children's autonomy and dignity depend on both their freedom to engage and their freedom from undue influence. A pupil who is proud to be named, and one who would rather not be, are both exercising that autonomy.
When a parent asks for something to be taken down
Take it down, thank them, and do not ask why. The UK Department for Education (2023) guidance notes that withdrawal requests often follow a change in circumstances, such as a safeguarding concern. The parent may not be able to tell you.
- Remove the post, the photo or the page the same day, and reply in writing to say it is done.
- Check every copy: the website, each social media account, the newsletter archive and the prospectus file.
- Note the request in the consent record, so that no one reposts the item from an old folder.
- If another organisation shared the item, such as a newspaper or a competition organiser, ask them to remove it too.
- Confirm to the parent that the item will not be used in future material.
Article 17 of the GDPR asks a controller to erase personal data without undue delay where consent is withdrawn and no other ground applies. Whether that article binds your school depends on your country. Make removal easy before anyone asks: put one 'please take this down' email address in the consent form, the newsletter and the website. A family that knows removal is one email away is more likely to say yes.
A short policy your school can adopt
Write the rule down in one page, share it with staff, and give the same page to parents. The example below is invented. Adapt it with your adviser; it is not a legal document.
Example policy (an invented school)
1. We publish what our classes and our school achieve as a group, with no names and no faces.
2. We publish anything that identifies a pupil only with a parent's written agreement, and after asking the pupil.
3. On public pages we use a first name and class at most, never a full name beside a face.
4. Agreement is asked for once a year, separately for the website, social media and print. Saying no has no consequence.
5. Anyone can ask for an item to be removed by emailing one address. We remove it within one school day.
6. Pupils' work is posted as an extract with the name removed, unless the pupil and family ask otherwise.
Keep the record in one place that every teacher can see, and check it before every post. The same discipline applies when you choose a platform, which is why Student Data Privacy: Questions to Ask an EdTech Vendor asks what a vendor makes public.
The limits of this article bear repeating. The GDPR is a European Union law. The ICO and Department for Education texts are United Kingdom guidance, and the Council of Europe guidelines are guidance, not law. Your country may have its own rules. Check with your school's adviser or your national data protection authority.
How iRead handles this
In iRead, a school's public page shows aggregate numbers only, never individual students. Public leaderboards in the inter-school competition show school-level results only. Appearing in the schools directory and in the competition is opt-in.
The core principle: Publish the group, ask before you publish the child, and make removal one email away.
See it in iRead: A school's public page shows aggregate numbers only, never individual students. Appearing in the schools directory and the inter-school competition is opt-in.
See public school pagesKey takeaway
Group results are yours to publish. Anything that identifies a child needs agreement and the least detail that does the job. Check your own country's rules with your own adviser.
Frequently asked questions
Can schools post photos of students on social media?
Usually only with agreement from the family, and often the pupil, with extra care on public accounts. The UK ICO says a recognisable photo is usually personal data and recommends an opt-out. Rules differ by country, so check with your adviser.
Do we need consent to publish a class total or a competition result?
Our reading is no, because a class total or a school's placing identifies no child. Keep the group large enough that no pupil can be picked out. Once a post names or shows a pupil, treat it as a named award and ask first.
What if a pupil does not want to be named but the parent agrees?
Leave the pupil out. The Council of Europe (2021) guidelines say children should be able to give and withhold consent where they understand the implications. UK Department for Education guidance calls it good practice to ask pupils directly from around 13. A pupil's no is enough.
What should a school do when a parent asks for a photo to be removed?
Remove it the same day from every copy, including social media, archives and print files, and confirm in writing. Do not ask for a reason. Note the request in your consent record so it is not reposted. Ask any third party that shared it to remove it too.
Sources
- European Parliament and Council of the European Union (2016). Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). Official Journal of the European Union, L 119, 4.5.2016, 1-88. eur-lex.europa.eu/eli/reg/2016/679/oj
- Council of Europe, Consultative Committee of Convention 108 (2021). Children's data protection in an education setting: Guidelines. Council of Europe, Strasbourg (guidelines adopted November 2020). rm.coe.int/prems-001721-gbr-2051-convention-108-txt-a5-web-web-9-/1680a9c562
- Information Commissioner's Office (n.d.). Taking photos in schools. Information Commissioner's Office, United Kingdom. ico.org.uk/for-the-public/schools/photos/
- Department for Education (2023). Data protection in schools: Taking and using photos and videos, and using CCTV in schools. GOV.UK guidance, Department for Education, United Kingdom (first published 3 February 2023). www.gov.uk/guidance/data-protection-in-schools/taking-and-using-photos-and-videos-and-using-cctv-in-schools
- Livingstone, S., Stoilova, M., & Nandagiri, R. (2019). Children's data and privacy online: Growing up in a digital age. An evidence review. London School of Economics and Political Science, Department of Media and Communications. researchonline.lse.ac.uk/id/eprint/101283/
- Steinberg, S. B. (2017). Sharenting: Children's privacy in the age of social media. Emory Law Journal, 66(4), 839 (Article 2). scholarlycommons.law.emory.edu/elj/vol66/iss4/2/