School photo consent, and which law applies to you.

Only if you are non-government. The privacy regulator says the Privacy Act is a federal law that does not cover local, state or territory government agencies, and that most states have equivalent legislation covering their own public sector. So a state school sits under its state's privacy Act and its department's policy. A Catholic or independent school is an organisation under the Commonwealth Act and is bound by the Australian Privacy Principles, and the small business turnover exemption does not help, because the regulator's own examples of a health service provider covered regardless of turnover end with "a private school or a childcare centre".

With consent that actually covers that channel, yes. Queensland's procedure is the clearest example we read: the consent form has to name the school's actual accounts, listing the website, Facebook, YouTube, Instagram, Twitter and LinkedIn as appropriate, rather than asking for blanket permission to publish. NSW asks for a general permission that identifies each publication and lets families consent or object to each one separately. A form that says "for school purposes" and nothing more is not doing that job, whichever state you are in.

Any tool that flattens the blur into the exported file will do it, including our free browser one, which runs on your own device without uploading the photo. The NSW policy itself suggests pixelating a student's image as an option where they cannot be removed from footage. Two cautions. Blurring is the right answer for a student caught incidentally rather than for one whose family has actively declined, because a blurred student is still recognisably their child in your post. And a face is only one of the things that identifies someone: a uniform, a name in the caption, a room or a routine will do it just as well.

In secondary school, their view should count. The Commonwealth guidance says there is no age fixed in law, that capacity turns on whether the person has sufficient understanding and maturity to understand what is proposed, and that where assessing each individually is not practicable an entity may presume someone aged 15 or over has capacity and someone under 15 does not. NSW asks for the student's own permission where they live independently, where a senior student appears in something like a yearbook, and where a high school student is prominently featured and might object. Queensland lets a student under 18 living independently sign the form themselves. Build a line for it into the form rather than discovering it the week a campaign goes out.

No state we read makes it a hard requirement, and NSW puts it as "it is good practice to renew the general permission each year". The Commonwealth guidance for non-government schools does not set a period either, but it does say consent given at a particular time cannot be assumed to endure indefinitely, and that it is good practice to tell people how long you will rely on it. So the honest answer is that an annual pass is not a legal deadline, it is the cheapest way to avoid relying on a signature nobody has looked at since 2022. What genuinely does need a fresh ask is a new use, such as a platform that did not exist on the original form.

Check your own department's policy, because this is exactly the sort of thing that differs. NSW says that when staff take photographs and video at excursions and school events, they should use a school device. Note that schools are in a different position from childcare here: the rules that started on 27 February 2026 restricting personal devices apply to centre-based education and care services under the National Quality Framework, not to schools. If you run both, do not assume one rule covers the site.

NSW's position is that nothing in its privacy Act stops parents taking photographs or video at school events, but that schools need to advise them to consult the parents of other students captured in the footage before putting it on social media or anywhere else publicly accessible. That is a reasonable model regardless of state: you are not policing family photography, you are setting an expectation before the concert rather than after it. A line in the newsletter the week before does most of the work.

Ask them, and take a no seriously. Between January and March 2026 the eSafety Commissioner received more than 100 reports about anonymous accounts targeting schools and school staff, and much of that was staff headshots turned into fake videos, teacher rating accounts and memes about principals and teachers. Many of those reports went through the adult scheme, where the threshold is higher, and eSafety says plainly it may be unable to seek removal of a non-sexual fake at all. Victoria is the only state we found with a separate policy for photographing staff, which suggests most of the sector has not caught up with this yet.