What we can show
There is a floor underneath the permissions, and your whole building sits on it
Most systems treat publishing a child’s photograph as a permission: off by default, on if a parent agrees. That is how it works for older students. For an early-childhood centre there is something underneath the permission, and it does not have an override.
The floor, in the order it actually happens
When anything asks whether a child’s photograph may go onto the open web, the system answers in this order, and the order is the whole point.
First, it asks how old the child is. If the child is under thirteen — or if their date of birth is missing or unknown, which happens more often in early-childhood records than anywhere else — the answer is no, and it stops there. It does not go on to look at what anyone agreed to, because there is nothing a permission could add.
Second, and only for a child who cleared the first question, it looks at whether that family has actively agreed to publication, and whether that agreement is still current.
In an early-childhood centre, nobody ever reaches the second question. That is what we mean by a floor rather than a setting: the block is not the default position of a switch, it sits underneath the switch entirely.
A parent cannot override it, and neither can you. We have been asked for a way round it by centres with a family who actively wanted their child in the marketing, and the answer is no.
Consider how the alternative reads from outside: a centre that will put a three-year-old on the public internet if the right form has been signed. The families who would sign it are not the ones the policy exists to protect you from.
Four situations where this gets uncomfortable
A rule is easy to agree with in the abstract. These are the four moments where a director has to actually apply it, and we would rather you meet them here than in the corridor.
One family says no
A room photograph is only shown to a family when every child in the frame may be shown to that family.
So one family’s refusal takes the whole room picture away from everybody. This is the rule people argue with most, and the argument always runs the same way: surely you could just crop it, or blur that one child.
We do not, because a crop is a judgement made once by whoever was in a hurry, and a blur is a claim about a piece of software that a parent has no way of checking. Withholding is the only version of this that a director can honestly describe to a family who asked.
The enrolment page is empty
You need pictures for enrolment and you cannot use the children’s.
This is a genuine operational problem and pretending otherwise would be useless to you. The answer is a separate, deliberately built collection: rooms, outdoor space, equipment, materials, staff with their own agreement, and photographs from an open event where the adults present agreed in advance to that specific use.
Centres that do this properly usually end up with better marketing than the ones filling the space with children, because a photograph of your actual garden tells a prospective family something a stock-feeling group shot does not.
A family changes its mind
It takes effect the next time anybody looks, not overnight.
Because what a person may open is worked out at the moment they ask rather than remembered from the moment it was granted, a withdrawal does not depend on a job running later or on anybody remembering to go and change something.
The practical version: a parent tells you at drop-off, you record it, and it is true from that point. You do not have to think about which albums, which folders or which staff member has a copy, because there are no copies to think about.
A child leaves mid-year
Their pictures stay attached to their record, under your own retention decisions.
They are not sold, they are not handed to another company as material to train anything on, and they do not quietly become part of a marketing library because nobody deleted them.
How long you keep them is your decision and your obligation, not ours to announce. What we can tell you is that when you decide, the deletion is of a record rather than a hunt through folders, which is the difference between a policy you have and a policy you follow.
How a picture finds the right child
By looking them up on your own list. A name and an id, checked against what the person asking is allowed to see. It is deliberately dull.
The interesting alternative is to sort photographs by recognising faces, and the wider platform can do it — switched off, per family, and only where a parent has actively turned it on. For children this young we would advise you not to offer it at all. Your staff already know who was in the room, so a face scan answers a question your list has already answered, and pays for the answer with a stored biometric template for a toddler.
Where a parent has switched it on anywhere in the platform, the template is a set of numbers derived from a photograph rather than a saved picture of a child’s face, it stays inside the private cloud we run ourselves, and it is never sent to an outside service. Withdrawal stops the matching at the point of asking rather than on a delay.
Here is the piece we have not finished. Face matching is off by default and is not wired in the shipping configuration, so no face template is computed from a child’s photograph today. That is the easy half. The hard half is what would become of a template if that lane were ever switched on for a two-year-old, and we are not going to tell you it is solved.
What is built is the clock, not the destruction. A stored template would carry a deadline — 365 days unless the district over you sets its own, and a setting we cannot make sense of falls back to that default rather than to no deadline at all. A nightly pass works out which templates are past theirs. It is registered wherever the durable database is and registered unconditionally, because a retention schedule written into law is not an optional job, and while the lane is switched off every pass writes an honest line into an append-only record saying it scanned nothing and destroyed nothing.
What is not built is the piece that destroys the sealed copy. Because it is missing, the pass stops and raises an alarm the moment anything is genuinely due, rather than deleting the record that points at a template while the sealed copy would still be sitting there. It does not skip quietly, and a run that goes silent is watched for in its own right, so a job that has stopped shows up rather than simply being absent. That failure path is exercised deliberately, which is why we can describe it to you rather than merely intend it.
So we are not going to tell you it happens nightly, or on withdrawal, or at the end of the window. A quiet overstatement would be the worse outcome and it is the one we write against. When the whole chain can be shown, this section will say so, and not before.
The questions with uncomfortable answers
Is there any way to publish a child's photograph publicly from here?
Not for a child under thirteen, and every child in your building is. The block is applied before the system looks at what any adult agreed to, which is the part that surprises people: it is not a permission that has been left switched off, it is a floor underneath the permissions.
What if a family actively wants their child's photograph used in our marketing?
The floor still holds, and we are not going to build a way around it for you. If that feels unhelpful, consider what the alternative looks like from the outside: a centre that will put a three-year-old on the public internet if the right form is signed. The families who would say yes are not the families you need to protect the policy from.
What happens when a family withdraws a permission?
It takes effect the next time anybody looks, because access is worked out at the moment of asking rather than remembered from the moment it was granted. There is no overnight job to wait for and no album somebody has to go and edit.
Do you have a signed statement that this satisfies the law?
No, and be careful with anyone who offers you one. We can tell you exactly what the system does -- what is blocked, when it is checked, and what it refuses to do. Whether that satisfies a particular obligation for a particular centre in a particular state is a question for you and your own adviser, and it is not one a marketing page should be answering.
What have you not finished?
One thing, and it belongs here rather than in a footnote. Face matching is off by default and is not wired in the shipping configuration, so no face template is computed from a child's photograph today. The part we cannot demonstrate from one end to the other is what would happen afterwards. What is built is the part that decides a stored template is due: it would carry a deadline of 365 days unless a centre's district sets its own, a setting that cannot be read falls back to that default rather than to no deadline at all, and a nightly pass works out which templates are past theirs. What is not built is the piece that destroys the sealed copy. Because it is missing, the pass stops and raises an alarm the moment anything is genuinely due, rather than deleting the record that points at a template and leaving the sealed copy alive, and it does not skip quietly. So we are not going to tell you destruction happens nightly, on withdrawal, or at the end of the window. When we can show the whole chain, we will say so here and not before.