Guide
Photos of children on nursery websites: the consent rules
A photo of a child on your website is personal data. Here is what the ICO and the EYFS say, what a consent form needs, and what to do when a parent changes their mind.
The law, in short
The ICO's guidance on photos in schools says that images taken "for official school use, such as for inclusion in a prospectus or other promotional material" are personal data under UK GDPR. Consent is "one possible lawful basis" and the ICO notes it "will not be appropriate to rely on consent in all circumstances", but for a nursery's own marketing it is the basis that works, because it can be given per child and withdrawn. Tell parents how images will be used, and offer an opt-out.
The EYFS safeguarding requirements separately say your safeguarding policy must cover the use of mobile phones and cameras in the setting (paragraph 3.7 of the 2025 framework, carried into the September 2026 edition).
Sources: ICO, "Photos" guidance for schools; EYFS statutory framework for group and school-based providers, 2025 and 2026 editions; NDNA factsheet on photographs in nurseries, September 2025.
What the consent form needs
- The child's name and the parent's name and signature, dated.
- Separate tick boxes for: the website, social media, printed material, and internal learning journals. A parent may say yes to the journal and no to Instagram.
- A plain statement that once an image is on social media the nursery cannot control where it goes, which NDNA's factsheet says parents must understand.
- How to withdraw consent, and what happens then (the image comes down from the website within a stated time; it cannot be recalled from social media).
- Who to contact.
Keep a register: which images are live, which children are in them, and which forms cover them. When a form is withdrawn or a child leaves, the register is how you find every image.
On the website itself
Answer first: no image of a child goes live without a form on file, and no image is named. Prefer photos where children are not individually identifiable (from behind, hands at an activity, a room without faces) for the home page, and keep identifiable images for pages parents visit after they have enquired. Never use stock photos of children; parents recognise them and inspectors ask about them.
Illustration, colour and photos of rooms without children carry a design perfectly well until you have consented images. We build every site that way and add photographs as the forms come in.
Staff phones, CCTV and the rest
Staff personal phones should not take photos of children; use a nursery device and a policy that says so, as the EYFS expects. CCTV in a setting is covered by the ICO's general CCTV guidance and needs signage and a purpose. The ICO's Children's Code (the Age Appropriate Design Code) applies to online services likely to be used by children; a nursery's brochure website aimed at parents is not one, but a parent portal with a login needs a privacy notice and cookie consent like any other service.