Children and young people: photography and filming guidance

May 27, 2025

Source: Privacy Commissioner

27 May 2025, 10:00

This guidance is designed to help you protect the privacy of children and young people when taking photos and videos (images).

It covers:

While the guidance focuses on images of children and young people, it is also useful for any organisation wanting to improve how it collects, uses, discloses and stores images generally.

Download a diagram that shows the lifecycle of an image and gives tips about what to at each stage (opens to PDF, 111KB).

This guidance does not cover:

Introduction

In today’s digital age, it has never been easier to take and share images. Nearly everyone has a device capable of taking pictures and videos and the ability to immediately use or share those images with others.

There are many benefits to taking photos or videos, including:

recording a child or young person’s achievements and special moments at events such as a school production or a kids triathlon event
sharing events with a greater number of people through livestreaming videoconferencing, and online environments such as online classrooms.

However, taking and sharing images of children and young people also comes with risks.

These risks include:

Bullying – personal or embarrassing images in the wrong hands can lead to bullying behaviour affecting a child or young person’s confidence and self-esteem
Identity theft – images combined with personal information can be used to create fake online profiles or engage in digital and financial fraud
Child Sexual Abuse Material (CSAM) – with advancements in AI misappropriated images can be used or edited for child sexual abuse material
Grooming and Exploitation – other people may use images, and the personal information revealed in those images to locate and groom children
A general loss of privacy for the child or young person – sharing images online can lead to unwanted attention, intrusion into a child or young person’s privacy or affect education or job opportunities later in life.

It’s important that you are aware of the risks associated with the collection, use and sharing of images of children and young people and do what is necessary to protect their privacy and keep them safe from harm.

Application of the Privacy Act 2020

The Privacy Act sets out certain requirements for collecting, using and sharing of personal information. These requirements are set out in the 13 information privacy principles (known as the IPPs).

An image of a person is personal information about that person, unless there is nothing in the image that could make it possible to identify them.
Some images may be classed as sensitive personal information if they reveal more sensitive information about an individual such as their race, ethnicity, religion, or their health.

While the Privacy Act applies to everyone, it requires you to take extra care when collecting personal information about children and young people.
The following sections take you through the lifecycle of an image and how the Privacy Act applies at each stage of that lifecycle.

Collecting images

IPPs 1 to 4 govern the collection of personal information.

Do you have a lawful purpose and is it necessary to collect the information (IPP 1)?

You can only collect personal information if it is for a lawful purpose connected with the functions or activity of your organisation, and collecting the information is necessary for that purpose.

In practice this means you need to be clear about:

the purpose you are collecting the image for
how that purpose relates to your organisation’s functions
why collecting the image is necessary for that purpose.

Consider what information the image might show

If you’re taking an image of a child or young person, think about what the image will show about them. Images can reveal a lot more information than you might realise.

For example:

An image of a child or young person in their school uniform reveals what school they attend
An image can show their approximate age, gender or sexual orientation.
The background or surrounding details of an image can reveal where they may live, their contact information, and what their interests or beliefs are.
Other people shown in the image can show who they associate with.

It’s not always necessary to take an image of a child or young person directly. There are ways to take images that focus on the activity of the person or group of people (if that is the purpose for which you are taking the images) rather than people’s faces.

Use case – Talented Tutoring

Talented Tutoring provides online tutoring services to small groups of young people aged 12-18. The tutoring sessions are held online. Each session is recorded and later shared with the group (not more widely). At the beginning of each session, the tutor explains that the session is being recorded and will be shared with the group.

The online tutoring sessions are a core part of how the tutoring service works, so Talented Tutoring has a lawful purpose for collecting these images. Students are able to watch the recordings at a later date to assist them with their learning of the subject matter. Also, as part of the ‘virtual classroom’ environment, it is useful for students to be able to see one another. If a student feels uncomfortable with having the camera on (for instance because they do not have a private space to work in), they can ask the tutor whether they can keep the camera off.

Consent to collect images (IPP 2 and 3)

IPP 2 says that personal information, including images, must usually be collected directly from the person.

If you receive images from other sources (for example, people attending your event or parents attending a sports event or school production) you will need to think about whether the child, young person or their parent has provided consent for you to use and share those images.

IPP 3 is usually more relevant. It says that people have to be told why their information is being collected, what is going to happen to it and whether they have a choice about providing that information (including what will happen if they say no).

In practice this means that children, young people or their parents should always know that photography or videoing recording is happening and why it is happening.

Consent is best practice

Unless there’s a law that says the image has to be collected, it’s also nearly always going to be practical to give people the chance to say no to an image being collected, used or shared. So, while there is no specific requirement in the Privacy Act to get consent to collect, use or share images from a child, young person or their parents, it is best practice to do so.

Consent must be informed

Any consent must be informed – that is, you will need to give the child, young person or their parents sufficient information about why the images are being taken, what those images will be used for, and who they may be shared with, so that they can make a choice about what to do. Let them know what measures your organisation takes to protect the privacy of children and young people and protect them from harm.

This can be done either through a consent form (where people specifically choose to being photographed, such as class photos at school) or through an opt out form (where filming is part of an event, but you offer people the choice not to have photos used). If you have a Photography and Filming Policy, you should provide a link to that policy in your consent or opt out form.

People should have the right to withdraw consent at any time, including getting previously published images taken down, as long as that is feasible. Things can change; for example, a photo of a child that was not initially a problem may create safety concerns if it is kept up on a social media site after family circumstances change.
Consent is not a ‘once and done’ thing. If it has been sometime since a child, young person or their parent have provided consent for images to be collected, check if they are still comfortable with photography or filming taking place.

Use Case – South Soccer Club

South Soccer Club wants to take photos and videos of the club’s games for the upcoming season to post on social media and share internally within the club. The Club has several teams with ages of members ranging from 5 to 65. Posting photos is a great way to show what the Club does, to celebrate players’ success and to encourage people to join.

At the start of each season new and returning members of South Soccer Club are given the club’s privacy statement, their Photography and Filming policy, and an opt-out form. If anyone – including a young person or a parent of a child in the team – does not want photos taken of them or their child through the season, they can fill out the opt out form.

People can also change their minds at any time and withdraw consent for photos to be shared.

All photos are carefully checked before they are posted on the club’s social media pages to ensure that:

club members who have opted out are not in any of the photos
the photos don’t include identifiable players or spectators from other teams (who haven’t been asked for consent)
none of the photos show players or spectators in an embarrassing situation.

How to inform children, young people and parents (IPP 3)

There are a several ways to inform people that you will be collecting images of them. Use whatever works in your context:

Use consent or opt-out forms.
If you collect and use images regularly, it’s worth having a Photography and Filming Policy that sets out why, when and how your organisation collects images, how it uses images, how it keeps them safe and secure. Make sure the policy is readily accessible. It doesn’t need to be long or legalistic – the purpose of it is to let both photographers and photography subjects know what is expected.
Have signage at events where images of children and young people will be taken, that includes information about what to do if you don’t want a photo taken.

Information about photography should also be included in your organisation’s privacy policy.

All information provided to children, young people and their parents should be clear and written in age-appropriate language.

Use our online privacy statement generator, Priv-o-Matic.

Use Case – Ministry of Tasks

The Ministry of Tasks have set up a youth advisory group to get a youth perspective on a specific project. The members of the youth group are aged 16-17 years. The youth advisory group will meet in person to provide insights and feedback over a series of three meetings. The Ministry wants to take photos of the youth advisory group meetings and use the images in its internal newsletter to acknowledge and celebrate the contribution of the youth advisory group members.

The Ministry has provided each member of the youth advisory group and their parents a privacy statement that details why photos of the youth advisory group meetings are being taken and what the images will be used for. The youth advisory group meeting privacy statement refers to the Ministry’s general privacy policy and its more specific photography and filming policy. Advisory group members (and their parents) are also provided the opportunity to opt-out of the photos being taken while participating in the meetings.

Keep the best interests of children at the forefront (IPP 4)

IPP 4 says that when collecting images, you must do so in a way that is lawful and seen as fair and not unreasonably intrusive in the circumstances.

What is fair will depend on the circumstances of the individual concerned, such as age or capacity, and the sensitivity of the information. This means that you are required to take particular care to make sure the way you collect images of children and young people is fair and not unreasonably intrusive. The best interests of the child should be a primary consideration (United Nations Convention on the Rights of the Child, Article 3 –in all actions concerning children, the best interests of the child shall be a primary consideration).

Some useful things to think about are:

Where are you taking the image? Is it a relatively private space, or is it more open?
Is it just an image or is there audio? What’s on that audio?
Could the content be embarrassing? Is it something that the child or young person might not want captured for posterity or could cause longer term harm?
Could the content create safety or wellbeing issues for the child or young person?
Does the child or young person know the photography or filming was happening?

Use Case – CCTV in bathrooms

A high school was having trouble with students using school bathrooms to vape and installed CCTV cameras in bathrooms to monitor and discourage the use of vapes. The school completed a Privacy Impact Assessment to ensure they identified all privacy risks associated with installing the cameras.

The cameras are clearly visible with signs warning of their operation, are positioned to face away from areas that may be classed as sensitive, do not record audio, and all camera footage is securely deleted at the end of the day.
The school has updated their photography and filming policy and notified all students and parents about the new cameras.

It’s arguable that the way in which those cameras are set up may not be unreasonably intrusive. However, the school should monitor things to see whether the cameras are actually effective. If the cameras don’t solve the problem, then the collection of personal information using CCTV may no longer be considered necessary to achieve the intended purpose (monitor and discourage vape use).

Using or sharing images (IPP 10, 11 and 12)

The use and sharing of images are governed by a range of information privacy principles. These are:

IPP 10, which limits the use of personal information for the purpose it was collected,
IPP 11, which limits the disclosure of personal information for the purpose for which it was collected, and
IPP 12, which sets rules around sending personal information overseas.

Generally, you can only use or share an image for the purpose for which it was collected. For example, if you have collected an image of a child or young person for the purposes of developing an activity progress report you cannot then use that image for an advertising campaign or post it on your organisation’s social media platforms.

There are a few situations in which you can use an image for a purpose that’s different from the original purpose:

The most obvious one will be where the child, young person or their parents’ consent to the image being used for a different purpose. Remember that any consent needs to be ‘informed’.
Another situation would be if you are sharing an image where the child or young person is no longer identifiable (so the image is no longer “personal information”). This goes beyond not showing faces or not including names. Think about whether there are any distinctive features that could identify the child or young person – either in the image itself, or from the context in which it’s taken. Could the person or organisation that you’re sharing the image with pull together other information to find out who it is?
Sometimes, the new purpose may be ‘directly related’ – that is, it is so closely aligned to what you originally intended to do, that people will not be surprised when the image gets used for that reason. For more detailed guidance on ‘directly related’ purpose see: When can I use the directly related purpose exception? | Office of the Privacy Commissioner.
Occasionally, using or sharing an image for a different purpose may be authorised by law. People should usually have been told that it would have to be shared – and who it would be shared with, and why – at the time the image was collected. If they do not already know these things, they will need to be told at the time the sharing happens.

Use case – Phototown

Phototown is a photography organisation that specialises in portraits of children and families. G visited Phototown with her six-year-old L to have a portrait taken.

G was asked to review Phototown’s privacy statement and photography and filming policy. The policy explained that there was no requirement to purchase the portrait and that all photos would be securely deleted if the photos were not purchased by the customer.

After L had their photo taken, G decided not to purchase a portrait. Six months later G saw Phototown was using the portrait of L in an online advertising campaign. As G had not been advised that L’s image may be used for advertising purposes and had not consented to this use this would be considered an unauthorised use of the image by Phototown.

Review your images

Your organisation should have clear guidelines and processes for reviewing images you have collected before you use or share them.

At a minimum you should:

Review who is in the image, including who is in the background. This makes sure that people are not included, if they have asked not to be photographed or shown.
Be particularly careful when publishing images online to a general audience. Try to use images that capture the activity rather than featuring specific children or young people (unless you are completely confident that they and their parents are fine with that image being available to the world at large). Also consider how widely the images may be shared, how long they may remain available and how this may affect the child or young person’s long-term wellbeing.
Make sure the image doesn’t embarrass the child. Think about the clothing that they are wearing, their body positions and facial expressions, and any potential harm that long term exposure of the image could cause them.
Make sure that your intended use of the images aligns with the consent that you obtained e.g. if you collected the images for the purpose of sharing with a specific group of people (e.g. sharing classroom activities with parents of a specific classroom) you will need consent of the learners (or their parents) to use the images in the school newsletter which is distributed to all learners and parents attending the school.
Check that consents to use and share images are recent. For instance, if your consents relate to last year’s sports season, or last year’s school production, check in with the child, young person or their parent to see whether things have changed.
Consider potential cultural impacts of the image. For example, if your images relate to a school kapa haka event, is there tikanga you need to consider before using or sharing the images.
Avoid sharing identifying information with the images, for example, names and ages.

Keeping images safe (IPP 5)

It’s important to keep images of children and young people safe. Stolen or misappropriated images can be used to harm them (for instance, they could be used for bullying, CSAM, or grooming purposes). So, you need to make sure that you have appropriate safeguards in place.

A few key things to remember are:

Just because an image is held by your organisation does not mean it is fair game for anyone who works there. Think about why you got it, who needs to see it, and whether you have been clear about what can be done with it (for example that it’s only for use in a club members newsletter, not for posting on social media).
If you are sending an image somewhere, always make sure it is going to the right recipient, or that it is being posted to the correct online site with the right permissions attached (for instance that it is not made fully public by mistake, if it is only intended to be shared with a specific group).
For online classrooms/video conferencing think about the platform you are using and ensure it is age appropriate. Don’t use personal accounts to set up any online platforms – use your organisation account/credentials.
Before using any AI tools to create, edit or organise images you should carefully consider the privacy risks to children and young people.

Think about whether you can use other security measures as well. For example:

Think about whether you can prevent images from being taken and used by others for their own purposes by adding other features such as watermarks, copyright marks or digital signatures.
Use lower resolution images to make it less likely that a child or young person could be identified or information about them misused.
Disable right click and screenshot capabilities on website and/or social media pages.
Remove embedded material/metadata from the image – this separates or removes the image information (which may say more about the person or the context) from the image itself.

Read our guidance on security and internal access controls.

Use of personal devices

We recommend that you don’t use personal devices to collect images of children and young people for work or event related purposes. Personal devices include phones, laptops or computers, and portable storage devices.

If your organisation doesn’t have a device available for collecting images, clear processes for personal device use should be outlined in a document such as a photography and filming policy.

Images of children and young people taken on personal devices should be transferred to your organisation’s secure environment and then deleted from the personal device as soon as possible.

Use Case – Youth Outdoor Adventure Club

A local youth outdoor adventure club collects images of their outdoor activities to share with parents and the wider youth adventure community. As the club does not have a club device or camera to capture images, the club is reliant on its volunteers to capture images with their own personal devices.

The youth outdoor adventure club develops a photography and filming policy which states that photos taken for the purpose of the club’s outdoor activities are subject to the Privacy Act. The policy requires that all photos or videos taken by volunteers must be securely sent to the club’s email and deleted off personal devices to ensure the club is not in breach of IPP5.

Retention of images (IPP 9)

IPP9 says that you should not keep personal information for longer than it is required for the purpose it may be lawfully used.

There is no minimum timeframe setting out how long you should keep an image. Considerations about retention and disposal are usually connected to the original purpose for collecting the image. As a general rule, if you no longer have a reason to use or share the image you should delete it.

Retaining images for longer than is necessary means there is a greater risk of the images being used or shared for unauthorised purposes down the line. As children and young people get older their likes change – an image that was once cute and funny could be distressing or cause embarrassment if used or shared today.

If your organisation is a ‘public office’ or ‘local authority’ you will be required to comply with the Public Records Act. For more information about the Public Records Act see: Key obligations under the Public Records Act 2005 – Archives New Zealand.

Document your image retention and disposal process

Creating and documenting your processes for reviewing, retaining and deleting images that your organisation holds is a good way to help you manage the risks associated with retaining images.

Reviewing the information (including images) that your organisation holds on a regular basis helps you know what information you hold, where it is held and whether you still need it. It is a good idea to record when a review was completed and what actions were taken – this can be as simple as recording it in your organisations committee meeting minutes or, for larger organisations, ensuring recording of the review is part of your broader governance assurance processes.

Your review should also include your organisation’s social media posts and webpages where images of children and young people have been used. But remember, removing an image from an online post, or deleting the entire post doesn’t mean the image has been removed from the online environment completely.

Deleting images (IPP 9)

When you are deleting images, you need to ensure they are actually deleted.

While you can shred physical copies of photos, digital images may require a few steps to be permanently deleted – for example, simply moving digital images to a recycling or trash folder does not permanently remove the images from your device.

The most secure way of permanently deleting images from a computer is to use specialised computer software to ensure the image’s data is overwritten. Permanent means permanent – so if you choose to use this type of software make sure you check and double check you are deleting the correct files.

Use case – local volunteer organisation

V runs a local youth volunteer organisation. The organisation has photos of its volunteers going back 20 years but does not know what to do with them. While some of the photos are important to retain, V does not think it is necessary to keep all the photos.

V decides to develop an image review process for the organisation. The image review process sets out:

the purposes for which the organisation collects photo
a reasonable time period that the photos should be retained for each purpose
the process by which the images are deleted
how often the review process should take place and
who within the organisation should undertake the review.

Using the newly created image review process, V identifies a number of photos that are no longer necessary or relevant for the organisation’s purposes. V securely deletes these images using software that permanently deletes the images from the organisation’s computer.

Consider creating a Photography and Filming Policy

It is good practice to have a written photography and filming policy that sets out your processes and practices for taking and using and sharing images taken of children and young people during events and activities.

Your policy should document how your organisation:

collects images (for example whether consent is required and how consent is obtained) including what devices can be used to collect images
uses and shares images, including any processes for review of images before using and sharing them with others or online
keeps images secure
ensure images aren’t retained longer than is necessary
manages the risks associated with using and sharing images of children and young people, particularly online
Processes for managing complaints or privacy breaches (read more detailed guidance on managing privacy breaches and privacy breach notifications).

Children, young people, parents, staff and volunteers should know about your policy and understand how images are collected, used and shared. Providing your photography and filming policy as part of your consent process can help children, young people and their parents make an informed decision about consenting to images being taken, use and shared.

How to manage filming/photography by others

People (parents, family, spectators and other children and young people) attending an event may want to take images or livestream the event which may include images of children and young people who do not know the images are being taken. In most cases, this will be difficult to prevent.

However, there are some measures you can take to ensure that everyone is aware of the risks of taking and sharing images of children and young people, and act in ways that best protects the privacy of the children and young people participating in the event.

It is always good practice to inform people of your organisation’s photography and filming policy (if you have one) or remind people to be mindful when taking and sharing images of children and young people when they are entering or signing up to participate in an event. It’s okay to tell people attending your event that they should get consent before taking and sharing images of children and young people.

You can also have signs at your event to remind people about taking and sharing images of children and young people and have a process in place where people can raise any concerns about images taken and shared after the event.

In a school environment, if students have access to devices, a clear policy around taking and sharing images of other students and teachers should be made available to all students.

Using Professional Photographers

You may choose to use a professional photography or videography service to record events. If you do, you should ensure that children, young people and parents are informed and consent to their child being photographed or filmed.

Ensure that your photographer understands the specific purposes for which the images are being taken. They will also need to be aware of the children and young people for whom consent has not been obtained. How you do this will depend on the circumstances, but you will need to ensure that the children and young people do not feel singled out or isolated.

Use case – North High School

North High School provides devices for their learners to use. The devices are capable of recording video and are connected to the school’s internet. Every learner is given a device Code of Conduct (the Code) which clearly outlines what they can and cannot use their devices for, and the consequences if the learner breaches the Code. The Code is also provided to all parents. The Code provides a link to the school’s privacy statement and photography and filming policy.

The school’s Code is clear that learners cannot use their devices to take or record images of other learners (both on and off school grounds). The Code also provides that a learner cannot use their devices to access and use Facebook or other social media sites. The school’s Photography and Filming policy sets out what actions the school will take to remove images posted to social media or shared with others that go against the Code.

Having the Code and the Photography and Filming policy in place will help:

mitigate the risk of images of learners being shared inappropriately
enable the school to act quickly and effectively to reduce harm to the learner from the image being posted or shared with others
give learners and their parents confidence that the school has robust policies and procedures in place to protect a learner from unauthorised collection, use and sharing of their images.

Use case – Kids Triathlon Event

XYZ Limited is organising a kids triathlon event. The event is open to children and young people aged between 10 and 17 years old. XYZ Limited has arranged for a professional photographer to take photos of the event.

Parents are provided with information about the photographer, why the photos are being taken and what they will be used for. Parents are asked to read through the information and then complete an image consent form when registering their child.

When registrations close, XYZ Limited provides the photographer with the list of race numbers that belong to children for which consent to take images has been provided. At the completion of the event the photographer will review all the photos and check that only participants that have provided consent have been captured. If an image contains a child or young person who has not consented, those images will be permanently deleted. XYZ Limited will also review all images before they are shared onto social media accounts or other online platforms to ensure consent exists to share the images.

When registering for the event parents are also advised to be mindful when taking images of their child and to consider other children and young people who may be in the images before posting them to social media accounts. XYZ Limited also has signs that will be erected around the course to remind parents to be careful when sharing images of children and young people participating in the triathlon.

MIL OSI