We all signed the form. We trusted the process. But the form doesn't mention AI, and the world it was written for no longer exists.
If you're a parent at a NSW public school, you've signed one of these. The Department of Education "General Permission to Publish and Disclose Information" form is the legal basis for schools posting our children's photos on Facebook, the school website, newsletters, and in media. We signed it because we trust our schools. And because it seemed straightforward.
The form offers parents a single binary choice:
"I give permission to the school/Department of Education to publish information about my child as described above, including in publicly accessible communications."
OR
"I do not give permission to the school/Department of Education to publish information about my child as described above, including in publicly accessible communications."
That's it. One box or the other. The form bundles everything into a single consent:
The form doesn't let us say "yes to the school newsletter, no to public Facebook." It's all or nothing. Accept your child's photo on a public Facebook Page visible to anyone on the internet, or opt out of the school newsletter, the school magazine, and event photos entirely.
For a primary school child, opting out feels like being left out. The binary choice forces parents to either accept public social media exposure or isolate their child from school community life. Most of us, understandably, tick the consent box.
The form does include this warning:
"Parents should be aware that when information is published on public websites and social media channels, it can be discoverable online for a number of years, if not permanently. Search engines may also cache or retain copies of published information. Published information can also be linked to by third parties." NSW Department of Education, General Permission to Publish form
This was written for a pre-AI world. It talks about discoverability and caching. It says nothing about:
The consent parents gave was for "publishing." What's actually happening is extraction into permanent AI systems. These are fundamentally different things, and no parent was asked to consent to the latter. The OAIC has since confirmed that photographs often contain sensitive information and generally cannot be scraped for AI training without consent.
The Permission to Publish form remains effective "until I advise the school otherwise." Many of us signed years ago, when Facebook was primarily a way to share photos with friends and family. The risk landscape has changed beyond recognition since then.
A consent form signed in 2020, or 2018, or 2015, cannot meaningfully apply to a risk landscape that didn't exist when it was signed. The consent is stale. The risks are new. The form hasn't changed.
The consent is between the school and parents. Our children, whose faces, names, and identities are being published, have no say. A 2024 peer-reviewed study of UK school social media practices found this contravenes Article 12 of the UN Convention on the Rights of the Child, which guarantees children the right to express their views freely in all matters affecting them. The same principle applies here.
For older primary school children in years 4, 5, and 6, this matters. They're old enough to understand what social media is and old enough to have opinions about whether their photos are posted publicly. The current framework doesn't ask them.
In December 2025, the Online Safety Amendment (Social Media Minimum Age) Act 2024 took effect, banning children under 16 from social media platforms. As a country, we decided these platforms aren't safe for our kids. In the first month alone, 4.7 million under-16 accounts were removed.
But our schools, doing what they've always done with the best of intentions, are still posting our children's photos on those same platforms. Nobody updated the process. The law protects our children from being on social media. Nothing yet protects them from being published on it by the adults entrusted with their care.
The OAIC published the exposure draft of the Children's Online Privacy Code on 31 March 2026. It must be registered by December 2026 and will require online services to consider children's best interests before collecting, using, or disclosing their personal information. Broader privacy law reform is also underway.
But we don't have to wait for legislation to protect our own children. By working with our schools to update how they use social media, we can close this gap now, as a community, not as a mandate.
A consent framework fit for 2026 would, at minimum:
None of this exists in the current NSW framework. The Children's Online Privacy Code will push in this direction when it takes effect in late 2026, but reforming the Department of Education's consent process is a longer-term goal. The immediate step schools can take is to remove the most dangerous vector: the public Facebook Page.