Every school is about to need a position on AI and images.
A brief for school communications.
What changed
For a long time now, the prevailing advice of school communication was more : more channels, more posts, more photography, more content: build the brand, tell the story.
Not in 2026. Access to generative AI has rewritten the rules. Any public photo of a child can now be altered, convincingly, in seconds, by anyone.
High-profile cases of abuse using Australian school images have been in the media since 2024.
It’s time to be more intentional about how we share images and stories online.
Three lenses for improving privacy and eSafety in how schools use images.
Infrastructure
Where images are stored, filed, and retrieved — and who can reach them.
Image mis-use
A risk to be mitigated, not removed entirely — deterrence and accountability, not a vault.
Policy
Clear positions on consent, image-taking, and how images are stored.
Risk is a dial, not a switch.
Most schools have the dial turned all the way up, by default.
Owned, access-controlled
Locked to your community. Not searchable, not given to crawlers.
Owned, access-controlled
Locked to your community. Not searchable, not given to crawlers.
Where today’s options sit
Every channel trades reach against exposure.
The ways schools share today run from owned-and-locked to pushed-to-the-public — each buys reach at the cost of control.
Owned + access-controlled
Intranet, LMS, SIS
Good for — Keeping things to people with an account.
The cost — Everyone needs a login; grandparents, alumni and prospective families are shut out — high friction, so often nobody reads it.
Closed group
Private Facebook group, school app
Good for — A known, approved community.
The cost — Constant moderation; all-or-nothing (you can’t show a prospective family a taste); usually a platform you don’t own — your stories and data in someone else’s silo.
Public website
School news page
Good for — Discoverability and sharing — prospective families.
The cost — Indexable, crawlable, downloadable; visible to anyone, anonymously; effectively permanent and hard to retract.
Social media
Facebook, Instagram
Good for — Reach and new audiences.
The cost — Fully open and pushed to strangers by an algorithm; no control once posted; you own neither the platform, the audience, nor the data.
Lowering the risk of misuse, without going silent
In most documented Australian cases, the person responsible was a student of the same school. An insider, known to the victims, often unaware they were breaking the law.
We see deterrence as a primary lever for schools to pull, to balance the power of telling the important stories without introducing unacceptable risk.
In external communication, our deterrence model runs on the perceived certainty of being identified, not an unbreakable lock.
Our model is a front-door camera: it changes behaviour when people know they’ve been seen and logged, and makes the one who tries anyway identifiable.
Giving control back to schools.
You’re in control; not Mark Zuckerberg. The same story, turned up to the whole world or down to just your families, set per post and changed whenever you like.
Mitigating risk, not eliminating it.
Nothing on a screen can be made un-copyable. If a photo can be seen, it can be captured. What you can control is the audience, the searchability, and whether your images sit on a platform engineered to be scraped.
This is deterrence and accountability, not a vault. The schools that handle it well will have made deliberate choices and be able to show their reasoning.
Our goal is to empower schools to do exactly that.
How our model answers the common threats schools are facing.
The opportunistic insider
A student, known to the victims, sometimes unaware it’s illegal. To see a protected photo you verify an email, the view is logged, and your name marks the image. It won’t stop someone determined; it changes how an impulsive person behaves. A front-door camera, not a lock.
Automated scraping
Bots harvesting the web at scale for all kinds of uses. On the protected tiers, photos and names are withheld at the server level — so they aren’t in the page a bot receives.
A family offender
Where a child is being protected from a family member, the verified link on the closed tier can be withheld — effectively preventing access, unless that link is directly shared with them.
The evidence
Why this is on the agenda now. Sources below.
Why now
- eSafety reports of AI-altered intimate images of under-18s more than doubled in 18 months, against the seven years prior. Four in five target girls. (eSafety, June 2025)
- A child can be targeted from an ordinary photo, a selfie or a school portrait. It never has to start as an explicit one. (eSafety)
- Bacchus Marsh Grammar, June 2024: ~50 students targeted with AI-manipulated images built from social-media photos. The perpetrator was a student of the school. (CNN)
The legal stack
- Statutory tort for serious invasions of privacy, in force 10 June 2025, actionable without proof of damage. (OAIC)
- Children’s Online Privacy Code, to be registered 10 December 2026; may capture school websites and comms platforms “likely to be accessed by children”. (OAIC)
- Under-16 social media ban commenced 10 December 2025, shifting the calculus of public posting. (eSafety)
- Criminal Code Amendment (Deepfake Sexual Material) Act 2024, commenced 3 September 2024. (Federal Register of Legislation)
- Private schools aren’t exempt from the Privacy Act where they provide a health service, and the Tranche 2 reforms (2026–27) are set to remove the small-business exemption entirely. (OAIC)
The consent reality
- Opt-out consent “often leads to unwitting, and ultimately invalid expressions of consent”; consent bundled into enrolment undermines voluntariness; a thirteen-year set-and-forget consent isn’t current. (Moores, Nov 2024)
- Student assent is already policy in VIC and QLD: consent from the student, not only the parent, where they’re mature enough to understand.
Why deterrence is the right model
- Perpetrators of image-based abuse are predominantly insiders: known to the victim, low in sophistication, often unaware it’s illegal. (Powell et al.; eSafety)
- Deterrence runs on the perceived certainty of being identified, not the severity of the punishment. (US NIJ)
- A symbolic, fully bypassable “we’re watching you” sign cut bicycle theft 62% in a field study. (Nettle et al., PLOS ONE 2012)
- The model is built on the Five Safes framework, used by the Australian Bureau of Statistics and written into federal data-sharing law. (ABS; Office of the National Data Commissioner)
A more deliberate way to share your school’s stories.
What OurNewsletter is
OurNewsletter is a storytelling newsletter platform your school owns: where you publish your stories to the people who care about them, in a space you control.
Teachers contribute in a couple of taps. The platform handles the layout and design. Families get a newsletter that works on a phone.
We don’t plug into your student information system, on purpose: no student database to leak, and Grandma still gets to stay up to date with her grandkids.