Introduction: "She's too cute, I'm putting her in my story"
Saturday, 4:20 p.m. First day at the pool. Your four-year-old daughter climbs out of the water laughing, hair plastered down, polka-dot swimsuit. The photo is perfect. You put it in your story, you send it to the "Family" WhatsApp group, your mother reshares it on her Facebook wall where she has 480 "friends," roughly 300 of whom she has never met.
In ten minutes, an image of a child in a swimsuit, time-stamped, geolocated by the name of the municipal pool visible in the background, has left your control for good. Nobody did anything wrong. Nobody will be able to take it back either.
The phenomenon has a name: sharenting, a blend of share and parenting. The estimates most often cited in Europe — repeated notably by the Observatoire de la parentalité et du numérique and relayed by French parliamentary work in 2023 — put at around 1,300 photos the number of images of a child posted online by their relatives before the age of thirteen. Thirteen is precisely the age from which, in France, a minor can consent alone to the processing of their data by an online service (article 45 of the Loi Informatique et Libertés, transposing article 8 of the GDPR).
In other words: a child's digital identity is largely built before they have any right to say a word about it.
This guide is not asking you to stop photographing your children. It proposes separating two gestures we have grown used to confusing: showing the people we love, and publishing to the entire world.
What a photo of a child really reveals
The photo is never alone
A published image carries three layers of information, and most parents only see one.
| Layer | Content | Who exploits it |
|---|---|---|
| The visible | Face, body, clothing, setting, other children | Any visitor to the profile |
| The contextual | School name on a schoolbag, street sign, club jersey, uniform, date of the post | Malicious individuals, cold callers, the merely curious |
| The technical | EXIF metadata (device model, date, sometimes GPS coordinates), account identifiers, server time stamps | Platforms, ad networks, data aggregators |
Major platforms generally strip GPS coordinates on upload — but file-sharing services don't, nor do email attachments, nor many messaging apps that send the file "in original quality." A snapshot emailed to your child's teacher can contain the exact coordinates of your living room.
The series is worth more than the image
A single photo doesn't reveal much. A series posted over eight years does. The same child, the same building façade in the background, the same school pickup every Friday, the same first name in the caption, the family name in your profile URL: from this you can reconstruct an approximate address, a weekly schedule, a school, a family structure, sometimes a health condition ("second day in hospital, he's being so brave").
This is exactly the reasoning the CNIL applies to mobility or payment data: it isn't the individual trace that's the problem, it's the cross-referencing.
Misuse: rare, but documented
Two concrete risks come up repeatedly in official warnings.
The first is the diversion of children's images into child-abuse spaces online. In 2023, the Australian eSafety Commissioner noted that a significant share of the images seized on certain forums came from ordinary social media accounts, posted by parents with no problematic intent whatsoever — beach photos, bath photos, gymnastics photos. In France, the association e-Enfance and the 3018 helpline regularly relay this warning.
The second is more mundane and far more frequent: impersonation and doctored images. The rise of image generators has made it trivial to fabricate falsified content from three public photos — including in cases of bullying among secondary school students. The law of 21 May 2024 on securing and regulating the digital space (SREN) created a specific offence for distributing non-consensual sexual montages generated by AI.
Key takeaway: the main risk isn't that a stranger means you harm. It's that you lose control over the circulation of images you never chose to make public, but never chose to protect either.
What French law says (and it says a great deal)
A minor's image rights belong to the minor
Article 9 of the Civil Code — "everyone has the right to respect for their private life" — applies fully to children. Parents are not its owners; they are its temporary guardians under parental authority. Two practical consequences:
- Both parents' consent is required for any distribution of a photo of the child, including after separation. A parent who posts alone exposes themselves to action by the other.
- Once an adult, the child can take action against publications concerning them, including their parents', on the basis of article 9 or the right to erasure (article 17 of the GDPR).
The law of 19 February 2024: an unprecedented French text
Law no. 2024-120 of 19 February 2024 "aiming to guarantee respect for children's image rights" amended the Civil Code to state in black and white that parents protect their child's image rights and involve the child in decisions concerning them according to their age and maturity. The text also provides that, in the event of serious disagreement between parents, the family court judge can prohibit one of them from distributing the child's image without the other's consent, and that in the most serious situations the judge can delegate the exercise of that right to a third party.
This is not a symbolic text: it makes image-sharing an attribute of parental authority, subject to judicial oversight.
At school, at the club, at daycare
No photo of a child can be distributed by an institution without written authorization. The CNIL regularly restates the framework:
- The authorization must be specific: a school blog is not a public Instagram account, a class photo is not a promotional video.
- It is revocable at any time, by a simple letter.
- A refusal can never justify excluding a child from an activity.
Read the back-to-school forms before signing. Many lump "class photo," "school website," "social media" and "local authority communication materials" into a single checkbox. You have the right to cross out one line and sign the rest.
Sharing without publishing: the three-circle method
The founding mistake is treating all photos the same way. Here's a breakdown that holds up in real life — the one where you have three minutes between bath time and dinner.
Circle 1 — Close relatives (15 to 30 people)
This is where 95% of your photos of your child should go: grandparents, godfather, godmother, two or three friends.
- A private shared album (a native feature of photo services) with invitation-only access, no public link.
- Or, better still, storage you control: an encrypted external hard drive or a small family NAS plugged in at home, which you open up on a video call when the grandparents drop by.
- Turn off automatic camera-roll syncing to backup services you never chose: many phones enable uploading all photos to the manufacturer's cloud by default.
Circle 2 — Messaging groups
Parent WhatsApp groups, club groups, extended family groups are the main blind spot. A photo sent to a group of 40 people is published, in the literal sense: you know neither the automatic backup settings of those 40 members, nor who has access to their phones.
Three useful habits:
- Never send a photo to a group showing other people's children without their parents' consent (legally, this is distribution).
- Use the "disappearing message" or "view once" feature for sensitive photos.
- Disable automatic saving of media to your gallery: this keeps you from hosting other people's children in your own cloud backup.
Circle 3 — The public
If you insist on posting publicly, adopt a simple rule that stays stable over time, rather than an emotional judgment call photo by photo.
| Rule | Why it works |
|---|---|
| No face-on shots, or face obscured | Blocks facial similarity search |
| No first name in the caption | Breaks the name ↔ face link |
| No bare bodies, even babies | Keeps the image out of misuse channels |
| No uniforms, schoolbags or street signs | Removes implicit geolocation |
| Post with a delay (two weeks) | Prevents anyone knowing where the child is right now |
| No medical or school content | Avoids exposing sensitive data |
To obscure a face properly, an opaque block is better than a blur or a draggable emoji: reconstruction tools handle light blurring very well. Many parents find an elegant compromise by photographing the child from behind, backlit, or showing only their hands — which is often a better photo anyway.
The clean-up: reclaiming what's already online
Take inventory, once
Allow two hours, on a Sunday evening.
- Search your child's first and last name on several search engines, including image search.
- Review your own posts from the last five years (platforms offer a filter by year).
- Explicitly ask your parents, in-laws and siblings to do the same. This is the most useful conversation in this entire guide, and the hardest.
Exercising your rights
You have real tools at your disposal, free of charge, and they work:
- The right to erasure (article 17 of the GDPR) with any site hosting an image of your child. A response is mandatory within one month. If there's no response: file an online complaint with the CNIL.
- Delisting with search engines: requests concerning minors are handled with a favourable presumption since the Google Spain ruling and the guidelines of the European Data Protection Board.
- Reporting misused content to 3018 (the national platform against digital violence, free calls and chat) or to PHAROS for illegal content.
- Removal of non-consensual intimate content: the 2024 SREN law requires platforms to take it down within 24 hours of notification.
The case of school and sports photos
A club that posts a team photo on its public page with first names in the caption has almost never obtained valid consent. A polite letter citing article 9 of the Civil Code and article 17 of the GDPR settles the matter within a few days in the vast majority of cases.
Growing up with your own data
Involve the child, from age 6 or 7
The 2024 law speaks of involving the child "according to their age and maturity." In practice, this looks like an ordinary sentence spoken before posting: "Can I show this one to Grandma?" Children say no far more often than you'd imagine — and that no is formative: it teaches them that an image belongs to them.
Mainstream books such as a guide to screen-time education help install this vocabulary at home without turning every photo into a negotiation. The government-backed site Jeprotegemonenfant.gouv.fr also offers age-bracket guidance.
The physical steps that change everything
- An adhesive webcam cover on the family tablet and the living room computer: three euros, ten seconds, and it settles once and for all the question of the room where your child does their homework.
- A compact digital camera with no connectivity: the photos stay on a memory card, nothing goes anywhere, and you rediscover the habit of sorting before showing.
- A cloud-free digital photo frame, fed by an SD card, for grandparents who want to "see the little ones": on its own it replaces 80% of the Facebook posts aimed at family.
- A label maker for sorting backup drives avoids the classic "I don't remember what's on this disk, I'll just leave it lying around."
When you need to say something without saying who you are
Sometimes you discover a problematic photo posted by another family, a club, a teacher, and a direct approach is awkward: neighbours, a small town, a work relationship. Reporting it factually — a brief, non-aggressive message requesting removal — remains the most effective route, including when you'd rather not reveal your identity. What matters is that the information gets through: in the vast majority of cases, the person who posted it simply didn't know the legal framework.
Summary: the sensible parent's checklist
- Turn off geolocation in the camera app.
- Switch off automatic backups to clouds you never chose.
- Make private any accounts where your children appear.
- Reread the image authorizations signed at school and at the club, and cross out what doesn't suit you.
- Create a private shared album for close family, and announce it.
- Ask grandparents to take down public photos.
- Never post other people's children without consent.
- Ask your child's opinion as soon as they're able to give it.
- Run an annual search on their first and last name.
- Keep written records of the removal requests you've sent.
Conclusion: what we owe them
In ten years, your child will be sixteen, with a first internship interview, a first heartbreak, a first account they'll want to build themselves. They will discover what the world already knows about them: a polka-dot swimsuit, a photographed third-grade report card, a crying fit captioned "life is hard when you're 4," a hospital stay narrated across three posts.
None of it is serious in isolation. All of it, together, amounts to a biographical file they didn't write. The only truly lasting gift you can give them when it comes to privacy is a more or less blank page — and the vocabulary to fill it in themselves.
Keep taking photos. Plenty of them. Show them to the people who matter. And keep the rest offline: that's where memories age best.
