Childcare photo consent, and what makes it valid.

If the Privacy Act covers the service, it needs to have told you what it collects images for and, for a public use like social media, it is expected to seek your express consent. The regulator's guidance is direct about the change-of-purpose case: if a service uses a picture for something it did not tell you about, it will probably need your consent, unless you would reasonably expect that use. A form signed for a daily learning journal is not a form that covers a public page. If you are a parent reading this, the practical move is to ask for the consent form and ask which channels each tick covers.

The regulator calls that bundled consent and says the practice has the potential to undermine the voluntary nature of the consent, because the family gets no opportunity to choose which uses they agree to. It also fails the "specific" element, since a single tick cannot be specific about five different destinations. Beyond the law, it produces worse outcomes for everyone: families who mind about one channel end up refusing all of them. Splitting the decision by use is about ten minutes of form design.

There is no legal expiry, and nobody should tell you there is twelve months. What the guidelines say is that consent given at a particular time "cannot be assumed to endure indefinitely", and that it is good practice to tell people how long you intend to rely on it. So the real rule is: do not treat an old signature as permanent, and say up front what period you are working to. We build our templates around an annual re-confirmation because it is cheap and defensible, not because a law requires it.

Withdrawal stops you relying on that consent for any future use or disclosure. It is forward-looking, so it does not automatically make everything already published unlawful. What it should mean in practice is that you stop using those images, and you take down what is still within your control, which is your page, your website and your newsletter archive. Be straight with the family about the rest: anything shared, screenshotted or reposted is outside your reach, and saying so is better than promising a clean sweep you cannot deliver.

Treat the disagreement as a no for public channels until they tell you together that it has changed. This is not a privacy question and the Privacy Act does not answer it: who can consent for a child sits in family law and in whatever court orders exist, and a service is not the body to interpret those. Ask for any orders and keep them on file so the decision is made against a document. Do not adjudicate between the parents and do not carry messages between them. Write the position into your policy before you need it, because deciding it with a parent in front of you goes badly.

No, and the guidelines are unusually blunt about it: it will be difficult to establish that an individual's silence can be taken as consent, and consent cannot be inferred simply because you gave someone notice. Using an opt-out to infer consent is described as appropriate only in limited circumstances, because the person's intention in not opting out may be ambiguous. Treat a form that never came back as a no. It is also the single easiest thing on this page to fix, because it costs nothing but a follow up.

The Privacy Act does not set an age. The guidelines say capacity is assessed case by case, and that a child under 18 has capacity when they have sufficient understanding and maturity to understand what is being proposed. Where assessing each child individually is not practicable, a service may presume that someone aged 15 or over has capacity and that someone under 15 does not. In a childcare setting that means the parent or guardian decides. In a secondary school it means the student's own view starts to count, which is why our school form has a line for it.

Yes, treat a new channel as a new use. The guidelines say that where consent did not cover a proposed use, a service should seek consent at the time of that use. A form signed for "our newsletter and website" does not stretch to a platform that did not come up, and paid advertising is a bigger step again because the audience is people who did not choose to follow you. Add the channel as its own row and ask. Most families say yes to more than you expect once they can say no to the one thing they mind about.