_Part 4 of 18 in the Digital privacy for board directors series. The first of five posts focused on children._
The most personal section of this series starts with the most uncomfortable observation. The digital footprint a child accumulates between birth and 18 is almost entirely created by their parents and the institutions around them, and most of it is created before the child is old enough to consent to any of it.
I am writing this post as a parent, not a lecturer. The decisions described below are decisions I have had to make for my own family and revisit periodically. None of them is obvious. Some of them are uncomfortable. All of them benefit from being made deliberately rather than by default.
The shape of what gets created
By the time a UK child reaches their fifth birthday, the following information about them is, in a typical family, on the public or quasi-public record:
- A photograph of them as a newborn, posted to grandparents' Facebook accounts on the day of birth or the day after, which has by now been shared, re-posted, and saved by people the parents have never met.
- A first name, often a full name, in the captions of those photographs.
- Their date of birth, in many cases including the year, sometimes the hospital.
- A series of milestone photographs — first day at nursery, first smile, first steps — distributed across multiple platforms (Facebook, Instagram, WhatsApp family groups, sometimes Threads or BlueSky for the early-adopter parents).
- School-related information: which nursery they attend, what they wear, who their friends are, what their teacher's name is. This is typically posted by the parent rather than the school.
- Health-related information: vaccinations, illnesses, hospital visits, allergies. Often shared with family WhatsApp groups, sometimes more publicly.
- Voice and video, including songs they sing, things they say, conversations with grandparents.
- Education-platform data, if the nursery uses one — daily reports, photographs taken by staff, sleep and meal logs.
This is the shape of a normal middle-class digital childhood in 2023. None of it is malicious. Almost all of it was a parent's perfectly reasonable choice to share a happy moment with people who care. The cumulative effect is that by age five the child has a quite detailed public profile that will live, in various caches and archives, for the rest of their life.
What this enables, and what it does not
Let me be careful here. The risks I am about to describe are not common. Most children, even with the digital footprint described above, will go through life without any of these risks materialising. The point is not that you should be alarmed. The point is that the trade-off should be deliberate, because the data is durable.
Image-based targeting. A child whose face, name, and approximate age are public can be identified later by anyone with a reverse-image-search tool. This is not theoretical. It is how a meaningful fraction of online child-exploitation imagery is sourced — not by abusers taking photographs themselves, but by collecting and re-purposing photographs parents have posted publicly. The Internet Watch Foundation has published evidence of this repeatedly.
Identity construction. A child whose biographical details are public is easier to impersonate, at school and later. Schools have specifically warned about the rise of catfish accounts impersonating real children, often using publicly-available photographs and biographical information from social media.
Targeted social engineering of parents. A child whose name and routine are publicly known makes a more credible vector for parent-targeted social engineering — the I am collecting your daughter from school, she said you would know me call. Public school uniforms, locations, and timings make these calls more plausible.
Future searchability. The child you posted a sweet photograph of yesterday will one day be a job applicant, a prospective partner, a potential public-facing professional. The image, the caption, and the context will all be findable through to that future moment.
The point, again, is not that any of this is likely. It is that the trade-off should be made knowingly.
The five-question test before posting
I use a small test before posting anything publicly identifying a child. The five questions are:
1. Does this photograph or post identify the child by name? 2. Does it identify them by school, by uniform, by location, or by routine? 3. Would they be comfortable with this post when they are 18? 4. Is the audience for this post actually the people I want, or has it been broadcast to a larger group than I intended? 5. Could this image, in particular, be misused if it travelled to a place I cannot see?
If any of the answers is uncomfortable, the post does not go up publicly. Many of them go to a small private group instead.
I do not always pass this test. Almost no parent does. The point is to have run it.
The five practical decisions
If you are willing to be deliberate about this, here are the five decisions that make the most difference.
One: separate public-share from family-share. Make a deliberate distinction between photographs you broadcast publicly (Instagram public, Facebook public, Twitter, LinkedIn) and photographs you share with family. The mechanism matters less than the discipline. For family-share, a private group, a shared photo album, or a tightly-controlled messaging group is usually right. Apple Family Sharing, Google Photos shared albums, and a private WhatsApp group are all fine.
Two: review what is public. This week, scroll back through your own social media to the past three years. Make public posts about your children private or remove them. The cost is half an evening; the benefit is permanent.
Three: ask grandparents. Have the conversation with the extended family. Please do not post photographs of the children publicly; please share them with us instead. This is the conversation most parents avoid having. The grandparents are almost always pleased to be asked.
Four: do not name children in public posts. The names are the searchable element. If you do post publicly, do not include first names or surnames in the caption.
Five: leave the child's own face decision for them. Many parents I know have moved to a posture of no children's faces in any public post. Either obscured, or photographed from behind, or simply omitted. This is a respectable position; it is the one I have moved to for my own family. The grandparents are not denied photographs of the children — they get them in the private group. The public-facing version simply does not include faces. The child, at the age they choose, will decide whether they want a public-facing face.
The school dimension
A specific note on schools. UK schools collect a remarkable amount of data on children — academic, behavioural, medical, social, sometimes biometric (cashless catering systems often use fingerprints). The Department for Education publishes data protection guidance that schools should follow; the ICO's children's code (the Age-Appropriate Design Code) sets out what online services must do for under-18s. We will go into the school side properly in next month's post.
What this month looks like
Two evenings. The first, going through your own social media and tightening what is public. The second, having the conversation with grandparents and extended family. Both conversations are awkward and both pay back over the next twenty years.
In four weeks: the second children-focused post — school accounts, edtech, and the parent's reasonable role.