Student image consent for 2026-2027: how to ask for it and how to keep it

September is the month when schools collect authorisations, and also the month when the most photos are taken: the first day of class, settling-in for the youngest children, the first outings. If the authorisation is poorly framed, or cannot be proved, every one of those published photos is a risk.

This article summarises what the school can do without asking permission, when it needs consent, and how to ask for it and keep it so that it holds up if someone questions it later.

What the school can do without consent

The Spanish Data Protection Agency (AEPD) distinguishes two uses of student images:

• Educational function: the school may take images when they are part of teaching, for example to document class work or assess an activity. The basis there is the educational function itself.
• Other purposes: publishing photos on the website, on social media, in the school magazine, or using them to promote the school are different uses and need the consent of the families or of the student.

The practical line is this: if the image leaves the classroom and someone outside the teaching team will see it, assume you need authorisation.

Who gives consent

• Under 14: their parents or legal guardians.
• From 14: the student themselves, under article 7 of the LOPDGDD.

In families with separated parents, it is worth knowing who signs and whether any order affects these decisions. If one of the two is on record as objecting, the prudent course is not to publish until it is clarified.

How to draft the authorisation

The most common mistake is a generic authorisation along the lines of "I authorise the use of my child's image for educational purposes". It does not cover social media, because consent must be specific to each purpose. A well-framed authorisation separates the purposes and lets the family choose them one by one:

• Internal communications with the families in the group, in the school's app or platform.
• The school website.
• The school's social media accounts (better if you name which ones).
• Magazine, class photo, annual report, or other printed publications.
• Promotional materials, such as brochures or open days.

It should also state who the controller is, how long the images will stay published, and how to withdraw consent. And a detail that is often forgotten: not replying is not the same as authorising. If a family does not return the form, that student is not authorised.

Keeping the proof: the mistake that costs the most

The General Data Protection Regulation requires the controller to be able to demonstrate that it has consent. It is not enough to have asked for it; you have to be able to show it.

In 2026, an AEPD decision became widely known that fined an educational foundation 6,000 euros for publishing a student's images on social media and on its website. The school said it asked for authorisation every year, but could not produce it: its retention policy only kept signed forms for one year, and the images were still published.

The lesson is direct. Authorisations must be kept for as long as the images remain published, and for the period during which a claim can still be made afterwards. A paper form in a box that is destroyed in June is not enough. An electronic signature, stored with the student's record and with a date, solves the problem; we explain it in electronic signature in schools.

When a family withdraws consent

Withdrawing consent must be as easy as giving it. When it happens, the school needs to know where that student's image is published so it can be taken down. A few guidelines:

• Keep a simple record of where each type of content is published: website, social media, magazine.
• Review recent publications and remove or crop the affected images.
• Update the student's file so that no one publishes their image again by mistake.

Group photos, festivals, and families who film

• Group photos: if a student is not authorised, it is not enough not to tag them. Frame the photo without them, or blur their face.
• Festivals and events: families who film their own children for personal use are outside the school's scope, but publishing those recordings openly is no longer a household use. It is worth reminding people before the event, and not circulating family recordings of other children through the school's channels.
• Instant messaging: student photos should not circulate in WhatsApp groups. We cover this in parent WhatsApp groups.

Checklist for this September

1. Review the authorisation template: separate purposes, complete information, and a way to withdraw it.
2. Collect authorisation from every new family before the first photo.
3. Check that you have one for each student from previous years, and that it can be looked up.
4. Mark on the student's file what is authorised and what is not, visible to whoever takes and publishes photos.
5. Define how long authorisations are kept, at least for as long as the images are published.
6. Explain the photo rules at the start-of-year meeting.

Conclusion

Many problems in this area come from not being able to prove the authorisation, or from using it for something it did not cover. Separate purposes, a dated signature, and a file that clearly states what can be done with each student's image solve most of them.

If you want to see how these authorisations are collected and stored with an electronic signature, and how photos are shared only with the families who have authorised them, book a demo of Edena.