Should a childcare app scan your child’s face to tag photos?
In 2018 I built a machine that judged faces. Biometric Mirror was a research project at the University of Melbourne. It took your photo and within seconds told you how attractive, aggressive or emotionally stable you seemed. It was deliberately flawed. Its judgements came from a small set of crowd-sourced ratings of strangers' faces.
I built it to raise questions about consent, data storage and bias in facial recognition (same source). At the time I said that capturing this kind of information without consent "makes it impossible to know if a prediction is based on correct data".
I've thought about that project a lot this year, because face recognition is arriving in childcare.
What's being proposed
When your child goes to childcare, the centre usually records their day in an app, including photos, notes, attendance and health details. That app is made by a separate company, and that company stores your child's information on its own systems.
At least one of these apps is now adding face recognition to tag photos. Tagging means the app labels which child is in each photo, so the photo goes to the right family. Educators often do this by hand. It takes time, and I understand the appeal of automating it.
Here's how it works. To find one child in a group photo, the software has to scan every face in it. Scanning a toddler whose parents said yes means scanning the toddler beside them whose parents said no.
Why a face is different
A password can be changed after a leak. A face can't. Biometric data stays tied to a person for life.
Children add two more problems. Their faces change quickly as they grow. And face recognition works less well on young children. In a major 2019 study of face recognition algorithms, the US National Institute of Standards and Technology, a government standards agency, found more false matches for children, with the largest effects in the youngest. In an app, a false match sends one family a photo of someone else's child.
And more broadly, there’s a risk that children’s faces will end up in large datasets that global technology companies might use for commercial benefit.
What Australian law says
Australian law doesn't ban face recognition. But it does set a high bar.
Under the Privacy Act, some biometric information is sensitive information (a legal category that gets extra protection). A business can generally collect sensitive information only if it's reasonably necessary and the person consents. The OAIC says a collection that is "merely helpful, desirable or convenient" isn't reasonably necessary, and that a face scan held for a fraction of a second still counts.
The retail cases show where that bar sits. Even Bunnings, which scanned faces to protect staff from violence, only cleared the bar on review. Privacy Commissioner Carly Kind said facial recognition "is a highly privacy-invasive tool" that "must meet a high bar to be considered lawful under the Privacy Act". Retailers, she said, "should view the decision as a useful case study, rather than a green light for deployment of biometric technologies".
In 2024 she found Bunnings breached the Privacy Act by scanning the faces of everyone entering 63 stores. In early 2026 a tribunal allowed Bunnings to rely on an exception for a limited purpose: combatting serious retail crime and violence in stores full of products that can be used as weapons. She made a similar finding against Kmart in 2025, over face recognition to detect refund fraud. As of October 2026 that case is still under review, with hearings set for early 2027.
Compare the purposes. One is protecting people from violence in a hardware store. The other, in childcare, is saving an educator a few minutes of labelling a photo (arguably, a photo that might not even need to be taken, legally speaking). I find it hard to see how photo tagging clears the bar that now applies to Bunnings and related retail purposes.
What experts and other countries say
In 2022 the Human Technology Institute at UTS proposed a model law for facial recognition in Australia. I supported them in the work by delivering a version of Biometric Mirror they could use to gauge experts’ opinions. Their model law requires a check of the risks before use, with stricter rules as the risk to human rights rises. Its co-author, former Human Rights Commissioner Edward Santow, told The Monthly that face recognition in daycare is not appropriate from a human rights view. Because children can't give informed consent, it must come from parents, and "that alone makes it a high bar". Speeding up photo tagging, he said, was not a strong justification.
Europe starts from the same place. Under its privacy law, using a face to identify someone is banned unless an exception applies, such as explicit consent.
Where I land
I'm not against technology in childcare. I believe it has a real place in education, and that it should be safer for children and their families. That’s what Safer Footprint stands for, too. Apps can save educators time, and that time belongs with children.
Face recognition on toddlers is a different kind of tool. It turns every group photo into a scan of every child in it, including the family that says no. It's less accurate for the youngest children, and it collects data a child can never change. Convenience is a fair goal for software. In my view it can't justify that trade.
If your centre's app offers face recognition, ask the director whether it's on. If it is, say no in writing, and ask the centre to turn it off for everyone, because your child can still be scanned in other children's photos while it's on.
