How to make this happen
The evidence, the process, the motion template, and how to handle every objection.
Three things your school can do right now
None of these cost money. None require technical expertise. All of them reduce the exposure of children's photos to AI scraping, facial recognition, and deepfake generation.
Move to a private Facebook Group
Facebook Pages are public by design and cannot be made private. Facebook Groups can be. A private Group keeps all the functionality parents value (photos, events, discussions) while removing content from public access, search engines, and automated scrapers.
Remove historical photos from the public Page
Every photo ever posted on the public Page is still publicly accessible right now. Stopping new posts is not enough. The historical archive needs to be removed or the Page needs to be archived entirely.
Stop publishing identifiable children's photos publicly
Until the school moves to private channels, stop posting photos where children can be identified on any public platform. Text updates, event announcements, and general school news can continue without identifiable images.
A private Group stops third-party scraping, search engine indexing, and random public access. It does not stop Meta from accessing content posted on its platform. Getting off Facebook entirely stops Meta. But the private Group is the achievable first step, and it addresses the broadest set of threats immediately. Read the honest breakdown →
Public Page vs Private Group
| Feature | Public Page | Private Group |
|---|---|---|
| Visible to anyone on the internet | Yes | No |
| Indexed by search engines | Yes | No |
| Accessible to AI scrapers | Yes | No |
| Accessible to facial recognition scrapers | Yes | No |
| Membership approval required | No. Anyone can follow. | Yes. Admin approves. |
| Posts, photos, events, files | Yes | Yes |
| Community conversation | Limited. Algorithm controls reach. | All members notified. |
| Cost to switch | Free | |
Your path depends on your role
I'm a parent
Your path is through the P&C. Read the motion template, talk to a few other parents informally first, then raise it at the next meeting. You don't need to be a tech expert. The evidence speaks for itself.
I'm on the P&C
You need to build consensus and manage the process. Read the full step-by-step, prepare for the pushback, and talk to the principal before the meeting. This is a recommendation, not a directive.
I'm a principal or teacher
You're managing policy requirements, parent expectations, and duty of care. The compliance section covers the legal landscape, where regulation is heading, and how to raise this with your Director.
The process, step by step
This is not a technology project. It's a conversation with your school community, followed by a simple settings change.
Read the evidence yourself
Before raising this with anyone, read through the evidence. You need to be confident in what you're presenting. Every claim is sourced. You don't need to memorise it. You just need to know where to point people.
Talk to a few parents informally
Don't walk into a P&C meeting cold. Mention it to 3 or 4 parents you trust. Share this site. See how they respond. You want at least a couple of people in the room who already understand the issue when you raise it formally.
Raise it at the P&C meeting
Use the motion template below. Present the key evidence: the Senate testimony confirming AI scraping, the children found in training datasets, the deepfake incidents at Australian schools. The goal is a formal P&C recommendation to the principal.
The P&C cannot direct the school. But a formal, well-evidenced recommendation from the parent body carries significant weight with principals and the Department of Education.
Principal reviews and approves
The principal manages the school's social media. Share the evidence package. Most principals will recognise the risk immediately. This is a duty-of-care issue, not a technology debate.
Create the private Group
Create a new Facebook Group with privacy set to Private. Name it clearly (e.g. "[School Name] Community"). Set up admins from both the school and P&C. Add screening questions for membership requests.
Migrate the community
Post on the public Page directing followers to the new Group. Send the link via newsletter, email, and school app. Pin a final post on the old Page. Allow 2 to 4 weeks for migration.
Archive the public Page and remove photos
Remove all historical posts containing student images from the public Page. Archive or unpublish it, or leave a minimal redirect to the Group. Do not just stop posting. The historical photos remain publicly accessible until removed.
Update consent processes
Review the school's Permission to Publish form. Consider adding options that distinguish between internal communications and social media. Disclose AI and data scraping risks. This is optional but recommended.
P&C Motion Template
Copy and adapt this for your P&C meeting. Print copies for everyone in the room.
Keep your presentation to 5 minutes. Lead with the Senate testimony (most credible single fact), then the children found in training datasets, then the deepfake incidents. Don't read the motion aloud. Summarise the issue, hand out printed copies, and leave time for questions. The pushback section below covers the objections you'll hear.
Background
[School name] currently operates a public Facebook Page for school communications. Content posted on public Facebook Pages is visible to anyone on the internet without requiring a Facebook account or any connection to the school.
The issue
Since September 2024, it has been publicly confirmed that:
- Meta scrapes all public Facebook posts, including photos of children on school accounts, to train its AI models. Confirmed under oath to the Australian Senate by Meta's global privacy director. Australian users have no opt-out.
- Facial recognition companies have scraped over 50 billion photos from Facebook, including children's images, to build biometric databases. The Australian Information Commissioner found this breached the Privacy Act.
- Human Rights Watch found 362 identifiable Australian children in a single AI training dataset from less than 0.0001% of the data. Sources included school uploads.
- AI-generated explicit images of 50+ schoolgirls at an Australian school were created using publicly accessible photos. Similar incidents have occurred at multiple Australian schools.
The NSW "Permission to Publish" consent form does not disclose AI training, facial recognition, or deepfake risks. It offers only a binary choice (all public publishing or none) with no option to consent to newsletters but not public social media.
Proposed solution
Transition the school's Facebook presence from a public Page to a private Group. A private Group:
- Restricts content visibility to approved members only
- Removes children's photos from public access, search engines, and AI scraping
- Maintains all communication functionality
- Costs nothing and can be implemented immediately
Supporting evidence
An audit of every NSW government school found that 82% (1,780 schools, 637,818 students) operate public Facebook Pages under a consent framework that does not mention AI.
Full research with sources: schools.algorithms.technology/the-audit
Motion
That the P&C strongly recommends the school transition its Facebook presence from a public Page to a private Group, and that all historical posts containing student images on the current public Page be removed, in order to protect students from AI data scraping, facial recognition harvesting, and other emerging privacy threats not contemplated by current consent forms.
The pushback you'll get
These are the objections you'll hear and how to respond.
"The Department of Education requires public pages."
NSW DoE policy PD-2011-0418 does currently require this. The response is not to ignore the policy but to flag that it predates the confirmed evidence. The P&C recommendation demonstrates that the parent community has identified a duty-of-care gap. Principals can raise this with their Director, Educational Leadership. The policy needs updating, and parent pressure is how that starts.
"This will cause drama and divide the community."
Frame it as a community safety decision, not a political one. The evidence is specific and sourced. You're not asking people to take a side. You're sharing confirmed facts and asking whether the community wants to act. Most parents, once they understand what's happening, support the change. The ones who push back usually just need reassurance that nothing they value is being taken away.
"Won't we lose followers and reach?"
You'll lose a follower count. You'll gain an engaged, verified community of actual parents. Private Groups generate more meaningful interaction than public Pages. All members are notified of new posts, not just a fraction selected by Facebook's algorithm.
"Can't we just stop posting photos?"
That stops future risk but doesn't protect the children whose photos are already on the public Page. It also removes something parents genuinely value. A private Group lets the school keep sharing photos safely.
"The school will think we're attacking them."
Schools didn't create this problem. They use Facebook because the Department told them to. The motion is worded as a "strong recommendation," not a directive. Talk to the principal before the meeting. Let them know this is coming and that you're on the same side.
"What about grandparents and family who use Facebook?"
A private Group works exactly the same for anyone who joins it. Grandparents request to join, an admin approves them, and they see everything. They'll likely see more content, not less, because Groups notify all members of new posts.
"What about prospective families?"
The school website remains public. A minimal public Page can stay as a shopfront with general information and a link to join the Group. No child's photo needs to be publicly accessible for prospective families to learn about the school.
"Is making it private actually enough?"
It stops third-party scraping, search indexing, and public access. It does not stop Meta. Getting off Facebook entirely stops Meta. But a private Group is the most impactful step a school can take right now, and it's free. Read the full protection breakdown →
"What about Instagram, TikTok, and other platforms?"
The same principles apply. Any public account where the school posts identifiable student images carries the same risks. Facebook is typically the primary school communication platform, which is why we start there.
Frequently asked questions
Answers backed by original research: an audit of every NSW government school.
How many schools are affected?
More than 1,750 NSW government schools operate public Facebook Pages. Over 637,000 students attend these schools. The pattern is consistent across metro (83%), regional (81%), and rural (82%) areas. 93 Schools for Specific Purposes (serving students with disabilities) also operate public Pages.
Are we the only school doing this?
No. 82% of NSW government schools operate public Pages. This is the system working as designed. The Department of Education policy governing school social media was written in 2011. Your school is not making a mistake. The framework hasn't kept up.
Do any schools use private Groups instead?
Approximately 100 NSW schools use Facebook Groups instead of public Pages. These schools communicate with their communities through member-approved channels. The transition is straightforward, free, and takes less than an hour. The alternative exists and works.
Will moving to a Group solve everything?
A private Group stops third-party access. Search engines, AI scrapers, facial recognition crawlers, and dataset builders can no longer reach the content. It does not stop Meta's own AI training practices. But it eliminates the largest attack surface: unrestricted public access to every photo of every child, by anyone on the internet. Read the full protection breakdown →
What about the secondary schools?
Secondary schools have the highest rate of public Pages: 90% (367 of 408). These are the students most at risk from deepfake generation. Old enough to be targeted. Young enough to have no say in what their school publishes about them.
For principals and teachers
You're caught between policy and emerging evidence. Here's the picture.
This is a duty-of-care issue
The evidence that public Facebook Pages expose children to AI scraping, facial recognition harvesting, and deepfake generation is confirmed and documented. Continuing to publish children's photos on a public platform when these risks are known creates an increasingly difficult position for any school.
The regulatory direction is clear
The legal framework already supports caution
The Privacy Act treats photographs as personal information. It requires "express consent after telling them what the picture will be used for and who will be able to see it." Current consent forms don't mention AI training, facial recognition, or data scraping. The Online Safety Act establishes that the "best interests of the child is the primary consideration."
Read the full legal framework →
If the P&C passes a recommendation, you have formal parent community backing. Frame it to your Director, Educational Leadership as proactive risk management given confirmed evidence and upcoming regulatory changes. You're not defying policy. You're flagging that the policy needs updating, supported by evidence that didn't exist when it was written.
This affects every school with a public Facebook Page
If this evidence concerns you, share it with parents and P&Cs at other schools. Every school that acts makes it harder for the policy to stay unchanged.
Follow the investigation
Get notified when new evidence emerges or policy changes.
Last reviewed: April 2026