Keep a child's photos close. What to do about deepfakes

Deepfakes are in the news a lot this year. Most of the stories are about celebrities, politicians and high school students. Childcare rarely comes up. But it should.

A deepfake is a fake image, video or voice made with AI that looks real. The Australian eSafety Commissioner says it "receives reports of digitally altered images, including sexualised deepfakes that appear to use publicly available photos as source material". That's why this matters for childcare. Centres take photos of children every day. Most stay between the centre and the family, and carry very little risk. Some end up on public pages, where anyone can copy them, and AI tools can change them in minutes.

So my conclusion is simple: if a photo of a child under six is ever public, the reason for it being public should be very clear. Here's why.

Where childcare photos get out

Many childcare centres, even schools, have public Facebook or Instagram accounts. In July 2026 eSafety warned schools that "[…] once content is public, schools have little control over who copies it, where it is distributed or how it may be modified". By the very nature of social media platforms, sharing photos of children on public accounts means they’re … public. Everyone can see them. Everyone can find them.

Photos also get out through the childcare app. It's a closed space, run by a separate company (we talk about it in detail here). But such an app is only as closed as that company makes it. Safer Footprint started when we found childcare apps storing children's photos without proper security, documents that opened without a login, and children's details turning up in search engines. Even a well-built app leaks when someone takes a screenshot, or when a parent re-posts a group photo with other children in it. One large provider says it has worked with its app provider on new measures so photos cannot be copied via screen shot in the app. I'm not sure how many other apps do this.

And then there's us. Parents. We have good intentions, even when we proudly post a photo of our child with their first painting or drawing on social media. What we might not have noticed, is that the photo bears the centre's name in the caption, our child’s name in the accompanying post, or even mentions that our child is there every Tuesday. That tells strangers a lot.

How the wrong people find them

A public page is open to anyone, and finding those pages in bulk is now cheap and quick. The Sydney Morning Herald reported on a parent finding almost 2,000 public Facebook pages of schools in New South Wales. It took him a few minutes. And it’s very likely that these pages contain photos of children. Here, the parent stopped short of downloading children's photos. His test showed how easily anyone could find children's images in bulk. In that same article, another parent called schools posting photos "a disaster waiting to happen".

Public pages also draw attention we'd never want. In September 2026 a Victorian court heard that a man facing child abuse charges had looked at childcare websites while on bail. Because indeed, that cute marketing photo of a child on the website is another public resource.

What the wrong people can do with a photo

Once a photo has been accessed, downloaded or copied by someone else, a family can't take it back. The most obvious thing that the wrong people can do with photos, is to simply collect and store them. They might keep them to themselves, share them with others, or even use them as data points to build more comprehensive profiles of children as they grow older.

With artificial intelligence, the risks grow exponentially. eSafety says some AI tools can now remove clothing from an image or generate sexually explicit material from an ordinary photograph. There are also reports that scraped school photos are being run through AI to make sexualised, mocking or damaging images of children.

What some centres are doing

Some centres have started taking photos without faces. Their educators photograph children at a distance, or from alternate angles rather than up close. One large provider has gone further and paused commercial class photos until it can be sure every photographer has strict controls on how children's photos are stored and kept secure. As of October 2026 they had not come back.

I think these centres ask the right question. Who stores this photo, who can get to it, and for how long, and what are the blind spots the sector hasn’t previously recognised? A ban on class photos is a start. It doesn’t help much if the same centre or school shares dozens of photos a day through an app that isn’t secure

Photos still matter

A daily photo helps a working parent feel close to their kid. A class photo is a keepsake. I love both. And I get it.

Sharing is always risky, but if it happens under the right conditions, it can be okay. Remember that there is only no risk if no sharing occurs at all. But if it does need to happen, I'd do so privately with a child's family. A photo from behind, or of small hands busy with a painting, still tells a parent what their child got up to today.

Most of what lowers the risk is a few simple habits. I'd like centres to keep children's faces off public pages and make sure their incident plan covers a fake image. App companies should make screenshots harder. Parents, me included, should ask before we post other people's kids and leave out the centre's name and our routines. I'd also like eSafety and regulators to publish guidance on AI and public posting for early childhood.

More generally, as parents we need to ask ourselves the question whether we really need these photos.