The digital footprint we create for children, three years on

_An update to the 2023 post on the digital footprint we create for our children, part of the wider Digital privacy for board directors series. The first of five 2026 updates to the children-focused posts._

When I wrote the original digital-footprint post in April 2023, the position I argued — do not publish identifiable images of your children publicly, even on social media you consider semi-private — was, in most circles I move in, treated as somewhere between cautious and slightly eccentric. Three years on, that position has moved from marginal to mainstream. The reasons are worth being explicit about, because they tell you what to do in 2026 and they are not all the reasons the news coverage emphasises.

What has actually changed

Four shifts of consequence between 2023 and 2026.

The Children's Code now has teeth. When I wrote in 2023, the ICO's Age Appropriate Design Code had been in force for two years but had produced relatively little visible enforcement. Since then, the ICO has issued formal action against TikTok over child accounts, against several edtech vendors, and through 2025 has been increasingly direct about the standards it expects from platforms holding data on under-18s. The threat of enforcement has, on the major platforms, started to produce visible product changes. Instagram's Teen Accounts, TikTok's screen-time limits, Snapchat's friend-of-friend default privacy: these are responses to regulatory pressure that did not exist in 2023.

Generative AI made the training-set argument operational. In 2023 I argued that the photographs we share publicly become the training set an adversary could use to identify a child later in life. In 2023 this was a structural argument. In 2026 it is operational. The Internet Watch Foundation has documented sustained growth in AI-generated child sexual abuse material, much of it built on publicly-available photographs taken from parental social media. The case for not posting children's faces is no longer about theoretical future risk; it is about the actual market for AI-generated harm that runs today.

Smartphone Free Childhood moved the conversation. The grassroots movement founded by Daisy Greenwell and Clare Reynolds in early 2024 reached, within eighteen months, scale that few campaigning organisations achieve in a decade. Parents who would not have considered themselves activists found themselves in WhatsApp groups of dozens of local families committing to delay their child's first smartphone. The conversation shifted in a way that has changed what is socially possible in a 2026 school-gate conversation that would have been awkward in 2023.

**Coroner findings and inquests reset what known harm meant.** The follow-up to the Molly Russell inquest, the Ofcom consultation on illegal-content codes under the Online Safety Act, and a series of further coroner reports have moved the conversation about social media's role in children's mental health from contested to broadly agreed. The 2023 disagreement was about whether the harm was real. The 2026 disagreement is about what to do about it.

What this means in practice

Three updates to the 2023 advice.

The five-question test still works. The test I described in 2023 — does this identify the child by name, by school, by location, by routine; would they be happy with it at 18; is the audience the one I want; could this image be misused — is still the right test. The threshold for yes answers has shifted; in 2026 could this image be misused is now operational rather than speculative, and that should change which posts pass.

Public-share versus family-share is now the default. The architectural choice of running a private family album for grandparents and close friends, and not broadcasting publicly, has gone from a position you have to defend to the default that needs no defence. The mechanics are unchanged. Apple Family Sharing, Google Photos shared albums, a controlled WhatsApp group. What has changed is that the people on the other end now expect this.

Extended family conversations are easier and more necessary. Grandparents who were sceptical in 2023 about being asked not to post grandchildren publicly have, by 2026, mostly come round. Some via reading the news. Some via their own peer groups. The conversation is materially easier to have than it was. The fact that it now needs to include and please be alert to AI voice scams that sound like your grandchild is the new piece. The Take Five to Stop Fraud campaign covers the framing.

What is genuinely new since 2023

Four things that were not on the table in 2023 and are now.

On-device nudity detection at scale. Both Apple and Google now ship — and, importantly, enable by default for accounts owned by under-18s — on-device detection of nude images sent or received in messages. This is one of the few unalloyed wins of the past two years for children's safety online. If you have not enabled the Communication Safety feature on iOS and the equivalent on Android, do so this month. The detection is on-device, the parent is not notified unless the child reports the image; the protection it offers is meaningful.

Voice clone scams targeting families. A separate and serious development. The grandparent-on-the-phone scam, in 2026, uses a cloned voice built from a few seconds of audio scraped from social media. The defence is the family code-word — covered in the 2024 AI/deepfake post — which I now think should be a default in every household with grandparents who could be plausibly targeted. Five minutes to set up. Possibly the single highest-leverage privacy decision you will make this year.

Australian under-16 ban as policy precedent. The Australian government's decision to ban social media for under-16s at the end of 2024 has, in 2026, produced enough operational evidence to inform UK policy thinking. The data on whether it has worked is mixed and contested. The UK has not followed and is unlikely to in the current Parliament. The conversation about whether such a ban is desirable has matured.

Schools have changed. The DfE's Mobile phones in schools guidance from February 2024 is now the default operating reality of UK secondary schools. The shift has been faster than I would have predicted. Most secondary schools now operate phone-free during the school day. The data on whether this has changed bullying or attainment is still being collected; the change in the daily texture of school life is visible.

What does not need updating

Five things from the 2023 post that are unchanged.

The principle that the digital footprint of a child is created by the parent before the child can consent. Unchanged.

The principle that the public-search posture you adopt now persists for decades. Unchanged, and reinforced.

The principle that grandparents and extended family are part of the household privacy boundary. Unchanged.

The five-question test, the public-share versus family-share architecture, the do not name children in public posts rule. All unchanged.

The point that this is not paranoia, it is deliberation. Unchanged, and increasingly mainstream.

What this month looks like

Three short pieces of work.

One: if you have not, set the family code-word. Five minutes. Tell the grandparents.

Two: if your children are on iOS or Android, confirm Communication Safety and the equivalent are enabled.

Three: read your own social media output from the past year. Anything that newly fails the five-question test, particularly anything involving the child's school, location, or routine, can be tightened or removed.

Next month: the school edtech post, revisited. The lay of the land in 2026 has shifted further than I would have expected when I wrote about it three years ago.