What government can do
Seven specific recommendations. Most don't require new legislation. The biggest wins are administrative changes that could happen this year.
Australia has already demonstrated it can act on children's online safety. The under-16 social media ban passed in November 2024 and took effect December 2025, removing 4.7 million accounts. The Children's Online Privacy Code is in development. The capacity to act is not in question.
An audit of every NSW government school found that 1,780 (82%) operate public Facebook Pages. 637,818 students attend these schools. Every federal electorate and every state electorate in NSW is affected.
What follows are specific, numbered recommendations directed at the NSW Department of Education, state and territory education departments, and the Federal Government. Several of the most impactful changes are administrative policy updates that require no new legislation.
NSW Department of Education
Three administrative changes. No legislation required. Immediate effect across every public school in NSW.
Update PD-2011-0418 to allow private or restricted settings
The current policy states that school social media accounts "must not restrict access or be set as 'private' or 'closed'." The stated rationale is to "reach a broader audience and build stronger community." This rationale was written before:
- Meta confirmed under oath that it scrapes all public posts for AI training (September 2024)
- Facial recognition companies scraped 50 billion+ photos from Facebook (confirmed by OAIC)
- 362 Australian children were found in AI training datasets (Human Rights Watch, July 2024)
- Explicit deepfakes of Australian schoolgirls were generated from publicly accessible photos (June 2024)
The policy needs to be updated to allow, or require, private or restricted settings on school social media accounts. Victoria's education department already encourages restricted access. NSW is an outlier in mandating public exposure.
Implementation: Administrative policy update. No legislation required.
Update the Permission to Publish form
The current form offers a single binary choice: consent to all public publishing (website, newsletter, Facebook, media) or none. It makes no mention of AI training, facial recognition, data scraping, or deepfakes. The consent is indefinite with no renewal requirement.
The updated form should include:
- Granular consent by channel. Separate options for school newsletter, school website, social media, and external media.
- AI and data risk disclosure. Explicit statement that photos posted on public social media may be scraped for AI training, included in facial recognition databases, and used to generate synthetic images.
- Annual renewal. Consent should expire and require renewal each year, reflecting the rapidly changing risk landscape.
- Default to private. Social media publishing should require specific opt-in, not be bundled with general publishing consent.
Implementation: Form update. No legislation required.
Issue guidance on AI-era social media risks
Schools follow Department guidance in good faith. The current guidance does not address:
- The specific risks of public social media publishing in 2026
- Meta's confirmed AI training practices and the absence of an Australian opt-out
- Facial recognition scraping from public Facebook Pages
- The pipeline from public school photos to deepfake generation
- Alternative communication platforms (password-protected portals, school apps, private groups)
Updated guidance would immediately change practice across every NSW public school. Schools want to do the right thing. They need the Department to tell them what the right thing now looks like.
Implementation: Departmental guidance. No legislation required.
The data for every electorate
An audit of every NSW government school found public Facebook Pages in every federal electorate and every state electorate in NSW. No electorate is unaffected. The question is not whether this affects your constituents. It is how many.
Top 10 federal electorates by student exposure
| Federal electorate | Schools with public Pages | Students |
|---|---|---|
| Fowler | 37 | 20,332 |
| McMahon | 29 | 17,369 |
| Greenway | 26 | 17,285 |
| Parkes | 102 | 17,041 |
| Chifley | 34 | 16,822 |
| Berowra | 35 | 16,517 |
| Hughes | 40 | 16,495 |
| Parramatta | 30 | 16,455 |
| Hume | 30 | 16,382 |
| Bennelong | 24 | 16,035 |
All 46 NSW federal electorates contain schools operating public Facebook Pages. Data: NSW Public Schools Master Dataset (Data.NSW), cross-referenced with audit results. April 2026.
Every NSW member of federal parliament represents families affected by this gap. The data for each electorate is available. The question is whether the policy will be updated before the Children's Online Privacy Code takes effect in December 2026.
State and territory education departments adopt consistent national standards
Every state and territory has different social media policies for schools. None were designed for the AI era. The Education Council should coordinate minimum national standards including:
- No public posting of identifiable student images on social media
- Granular, informed consent for digital publication of student images
- Mandatory private or restricted settings on school social media accounts
- Guidance on alternative communication platforms
Every Australian child should receive the same level of protection regardless of which state they live in or which school they attend.
Federal Government
Structural reforms that close the gaps enabling children's photos to be exploited at scale.
The Children's Online Privacy Code must address children's images in AI systems
The Code is due for registration by December 2026. The exposure draft was released March 2026 with consultation closing June 2026. It must explicitly address:
- The use of children's images scraped from public social media in AI training datasets
- Facial recognition scraping of children's images
- Obligations on organisations (including schools) that publish children's images publicly
- The right to request deletion from AI training datasets
Close the consent gap in the Privacy Act
Parents consent to "publishing" their child's photo in a school newsletter or on a website. That consent was never intended to extend to AI training, facial recognition databases, or synthetic media generation. The Privacy Act should clarify that:
- Photographs of children constitute personal information in all contexts
- Public availability does not imply consent for AI training or biometric processing
- NSW government schools should have the same privacy obligations as private schools
Require Meta to offer Australians an opt-out from AI training
Europeans can opt out of Meta's AI training under GDPR. Australians cannot. Meta's position is that it only provides protections "in response to a very specific legal framework."
"Meta made it clear today that if Australia had these same laws, Australians' data would also have been protected." Senator David Shoebridge, September 2024
Legislation should grant all Australian users and organisations the right to opt out of AI training on their public content. Until that protection exists, keeping content private is the only defence.
Enforce the Clearview AI deletion order
The Australian Information Commissioner found Clearview AI breached the Privacy Act and ordered it to stop collecting Australian data and delete what it had. Clearview's database has grown from 30 billion to over 50 billion images since that order. Global fines exceed $100 million. None have been collected. The OAIC must actively pursue enforcement rather than allow the order to remain dormant.
What's already in motion
The biggest wins don't require new legislation
Updating NSW DoE policy PD-2011-0418. Revising the Permission to Publish form. Issuing guidance to schools. These are administrative actions that could happen this year and would immediately protect every public school child in NSW. They would also set a precedent for every other state and territory.
Follow the investigation
Get notified when new evidence emerges or policy changes.
Last reviewed: April 2026