What we can show
There is a floor underneath the permissions, and your whole building sits on it
Most systems treat publishing a child’s photograph as a permission: off by default, on if a parent agrees. That is how it works for older students. For an early-childhood centre there is something underneath the permission, and it does not have an override.
The floor, in the order it actually happens
When anything asks whether a child’s photograph may go onto the open web, the system answers in this order, and the order is the whole point.
First, it asks how old the child is. If the child is under thirteen — or if their date of birth is missing or unknown, which happens more often in early-childhood records than anywhere else — the answer is no, and it stops there. It does not go on to look at what anyone agreed to, because there is nothing a permission could add.
Second, and only for a child who cleared the first question, it looks at whether that family has actively agreed to publication, and whether that agreement is still current.
In an early-childhood centre, nobody ever reaches the second question. That is what we mean by a floor rather than a setting: the block is not the default position of a switch, it sits underneath the switch entirely.
A parent cannot override it, and neither can you. We have been asked for a way round it by centres with a family who actively wanted their child in the marketing, and the answer is no.
Consider how the alternative reads from outside: a centre that will put a three-year-old on the public internet if the right form has been signed. The families who would sign it are not the ones the policy exists to protect you from.
Four situations where this gets uncomfortable
A rule is easy to agree with in the abstract. These are the four moments where a director has to actually apply it, and we would rather you meet them here than in the corridor.
One family says no
A room photograph is only shown to a family when every child in the frame may be shown to that family.
So one family’s refusal takes the whole room picture away from everybody. This is the rule people argue with most, and the argument always runs the same way: surely you could just crop it, or blur that one child.
We do not, because a crop is a judgement made once by whoever was in a hurry, and a blur is a claim about a piece of software that a parent has no way of checking. Withholding is the only version of this that a director can honestly describe to a family who asked.
The enrolment page is empty
You need pictures for enrolment and you cannot use the children’s.
This is a genuine operational problem and pretending otherwise would be useless to you. The answer is a separate, deliberately built collection: rooms, outdoor space, equipment, materials, staff with their own agreement, and photographs from an open event where the adults present agreed in advance to that specific use.
Centres that do this properly usually end up with better marketing than the ones filling the space with children, because a photograph of your actual garden tells a prospective family something a stock-feeling group shot does not.
A family changes its mind
It takes effect the next time anybody looks, not overnight.
Because what a person may open is worked out at the moment they ask rather than remembered from the moment it was granted, a withdrawal does not depend on a job running later or on anybody remembering to go and change something.
The practical version: a parent tells you at drop-off, you record it, and it is true from that point. You do not have to think about which albums, which folders or which staff member has a copy, because there are no copies to think about.
A child leaves mid-year
Their pictures stay attached to their record, under your own retention decisions.
They are not sold, they are not handed to another company as material to train anything on, and they do not quietly become part of a marketing library because nobody deleted them.
How long you keep them is your decision and your obligation, not ours to announce. What we can tell you is that when you decide, the deletion is of a record rather than a hunt through folders, which is the difference between a policy you have and a policy you follow.
How a picture finds the right child
By looking them up on your own list. A name and an id, checked against what the person asking is allowed to see. It is deliberately dull.
The interesting alternative is to sort photographs by recognising faces, and the wider platform can do it — switched off, per family, and only where a parent has actively turned it on. For children this young we would advise you not to offer it at all. Your staff already know who was in the room, so a face scan answers a question your list has already answered, and pays for the answer with a stored biometric template for a toddler.
Where a parent has switched it on anywhere in the platform, the template is a set of numbers derived from a photograph rather than a saved picture of a child’s face, it stays inside the private cloud we run ourselves, and it is never sent to an outside service. Withdrawal stops the matching at the point of asking rather than on a delay.
Here is the piece we have not finished. Destroying one of those stored templates at the end of its retention window is not something we can yet demonstrate from one end to the other. So we are not going to tell you it happens nightly, or on withdrawal, or at the end of the window.
What we can tell you is how it is built to fail: when the cleanup cannot actually destroy a template, it stops and raises an alarm rather than marking one gone, and the alarm stays standing where a centre can see it. A quiet failure would be the worse outcome and it is the one we designed against. When the whole chain can be shown, this section will say so, and not before.
The questions with uncomfortable answers
Is there any way to publish a child's photograph publicly from here?
Not for a child under thirteen, and every child in your building is. The block is applied before the system looks at what any adult agreed to, which is the part that surprises people: it is not a permission that has been left switched off, it is a floor underneath the permissions.
What if a family actively wants their child's photograph used in our marketing?
The floor still holds, and we are not going to build a way around it for you. If that feels unhelpful, consider what the alternative looks like from the outside: a centre that will put a three-year-old on the public internet if the right form is signed. The families who would say yes are not the families you need to protect the policy from.
What happens when a family withdraws a permission?
It takes effect the next time anybody looks, because access is worked out at the moment of asking rather than remembered from the moment it was granted. There is no overnight job to wait for and no album somebody has to go and edit.
Do you have a signed statement that this satisfies the law?
No, and be careful with anyone who offers you one. We can tell you exactly what the system does -- what is blocked, when it is checked, and what it refuses to do. Whether that satisfies a particular obligation for a particular centre in a particular state is a question for you and your own adviser, and it is not one a marketing page should be answering.
What have you not finished?
One thing, and it belongs here rather than in a footnote. Where a parent has switched face matching on, the system stores a template -- a set of numbers derived from a photograph, not a saved picture of a child's face. Destroying that template at the end of its retention window is not something we can yet demonstrate from one end to the other. The cleanup work is built to stop and raise an alarm rather than mark a template gone when it cannot actually destroy it, and that alarm stays where a centre can see it. When we can show the whole chain, we will say so here and not before.