Is this actually a big deal?
Common doubts, addressed with evidence. The short answer is yes.
The short version
Your school posts photos of your kids on a public Facebook Page. Those photos are visible to the entire internet. Meta confirmed under oath to the Australian Senate that it scrapes every public post to train AI. Clearview AI scraped 50 billion photos from Facebook for facial recognition. Human Rights Watch found 362 identifiable Australian children in a single AI dataset, from less than 0.0001% of the data. AI-generated explicit images of 50+ Australian schoolgirls were created from their publicly accessible photos.
None of this is theoretical. All of it is documented and sourced. The school consent form that parents signed makes no mention of any of it.
This sounds like scaremongering
A fair reaction. Here is every common objection, and what the evidence actually shows.
"Every website collects data. This is no different."
It is different in a specific and important way. When a website tracks your browsing with cookies, the data stays with that company for advertising. When a school posts a photo on a public Facebook Page, that photo is visible to the entire internet. Anyone can download it. Any company can scrape it. And confirmed evidence shows that multiple companies have.
This is not about cookies or ad tracking. It is about your child's face being downloaded, permanently stored in databases you have never heard of, and used to train AI systems you have no control over and no recourse against. A cookie expires. A photo in an AI training dataset does not.
Read Meta's Senate testimony →
"Facebook wouldn't let companies scrape photos."
Facebook is one of the companies doing it. Meta's global privacy director confirmed under oath that Meta scrapes all public posts to train its own AI models. And Meta failed to stop Clearview AI from scraping more than 50 billion photos from its platform. The Australian Information Commissioner investigated, found Clearview breached the Privacy Act, and ordered it to delete Australian data and stop collecting it. Regulators in France, Italy, the UK, and Greece imposed fines exceeding $100 million. Clearview has not demonstrated compliance with any deletion order. The database has grown since the orders were issued.
Read the Clearview AI evidence →
"Nobody is going to make a deepfake of my kid."
In June 2024, AI-generated explicit images of more than 50 schoolgirls at Bacchus Marsh Grammar in Melbourne were created using their publicly accessible photos and circulated online. In February 2025, a similar incident was reported at Gladstone Park Secondary College. Reports emerged from Sydney schools in January 2025. The eSafety Commissioner confirmed that deepfake reports are doubling year on year.
These were ordinary school photos. The kind posted on school Facebook Pages every week. The pipeline from a school Facebook post to a deepfake is short, and it is getting shorter as the tools improve and become more accessible.
Read about the deepfake incidents →
"Making it private won't change anything."
It changes specific, measurable things. A private Facebook Group removes children's photos from public web access. They stop appearing in Google search results. Third-party scrapers like Clearview AI and LAION can no longer reach them. Strangers can no longer browse or download them. Those are real protections against real threats.
Here is what it does not change: Meta still has access to content posted within its own platform, including private Groups. The only way to fully stop Meta is to get off Facebook entirely. And photos that have already been scraped from the public Page cannot be unscraped from AI models that have already trained on them.
A private Group is not a complete solution. It is the first meaningful step. And it costs nothing.
What about grandparents and family?
This is one of the first things people raise. "Nanna loves seeing the school photos on Facebook. She'll be devastated if they stop."
She won't lose access. A private Facebook Group works the same way as a public Page for anyone who is a member. Grandparents, aunts, uncles, family friends, anyone in the school community can join the Group. They request to join, an admin approves them, and from that point on they see every photo, every event, every update. It is the same experience.
The only thing that changes is that people who have no connection to the school can no longer see the content. That includes scrapers, facial recognition companies, dataset builders, and strangers.
In a public Page, only admins can post and Facebook's algorithm decides which followers see which content. Most followers never see most posts. In a private Group, all members are notified of new posts. Research shows private Groups generate higher engagement and more interaction than public Pages. Your family will likely see more school content in a Group, not less.
The school told us to use a public Page
That is true. The NSW Department of Education's social media policy, PD-2011-0418, requires school Facebook accounts to be public. The policy explicitly states accounts "must not restrict access or be set as 'private' or 'closed'." Schools did not choose this. They were directed to do it.
That policy was written in 2011. It predates Meta's confirmation that it scrapes public content for AI training. It predates Clearview AI's 50-billion-photo facial recognition database. It predates Human Rights Watch finding Australian children in AI datasets. It predates the deepfake attacks on Australian schoolgirls.
This is not the school's fault. The school followed the policy it was given. But the policy has not caught up with the technology, and the gap between what the policy assumes and what the technology does is where children are being harmed.
Parent communities can help close that gap. A P&C motion recommending the school move to a private Group is a formal signal that the community has looked at the evidence and wants action. It puts the question on the record. It gives the principal something to take to the Department.
What can I actually do?
It depends on how much time you have right now.
60 seconds
Share this page with one other parent at your school. That is how this spreads. Not through campaigns or petitions. Through one parent telling another parent what they found.
5 minutes
Read through the evidence. Look at the sources. Decide for yourself whether it concerns you. If it does, mention it to a few parents you trust. See if they have thought about it.
At your next P&C meeting
Everything you need is here: a motion template, a step-by-step guide for the conversation, an implementation plan, and answers to every objection you will hear in the room. You do not need to be a tech expert. You just need to raise the question.
This isn't about blame. It's about what we do now.
Nobody did anything wrong. Schools posted photos because parents loved seeing them. Parents signed consent forms because they trusted the system. The system was not built for what the technology became. Now we know. The question is whether we act on what we know, or wait for someone else to act first.
Follow the investigation
Get notified when new evidence emerges or policy changes.
Last reviewed: April 2026