The eSafety Commissioner has issued an online safety advisory to Australian schools, urging them to think twice before posting student and staff images online, as AI makes it easier for photos to be copied, manipulated and turned into harmful deepfakes.

The advisory, published in late July, says: ‘A staff headshot can become a fake video within minutes. A student photo can be altered or sexualised without consent. School identifiers can make fabricated content appear more realistic.’

‘Once content is public, schools have little control over who copies it, where it is distributed or how it may be modified.

‘Before publishing, schools should consider the purpose, consent, audience and identifying details of such images.’

Escalation of incidents

The rapid evolution, deployment and accessibility of AI tools has significantly increased the safety risks associated with sharing photos and videos online.

Over the past 18 months, eSafety has seen a rise in reports from teachers, staff and students involving school-related image misuse.

‘Between January and March this year, we received more than 100 reports about anonymous accounts targeting schools and school staff, including AI-generated dance videos, face swaps, memes and fabricated stories about principals and teachers,’ eSafety Commissioner Julie Inman-Grant said.

Almost all involved imagery harvested from school social media accounts or websites.’

Importantly, ‘covering’ faces with emojis may not prevent misuse, as AI can potentially reconstruct or generate a plausible face using other photos of the person available online, while other details in the image may also reveal their identity.

The IEU has reported on several instances of staff being subjected to deepfakes.

eSafety Commissioner Julie Inman-Grant told The Educator that staff-targeted abuse should be treated as ‘a wellbeing and workplace issue within the school response’.

Before posting, consider:

Purpose: What does the image add? Could the same story be told without showing identifiable details?
Consent: Is consent active, informed and current? Does it cover school social media posts?
Identification: Does the post include a name, uniform, location or routine that could identify a person or reveal their location?
Audience: Is the account public? Who can view, comment on or reshare the content?
Alternatives: Are close-ups necessary? Could the image be cropped or taken from a distance? Could names be left out?
Settings: Are privacy settings and controls for tags or comments reviewed regularly?
Governance: Who may post, approve and moderate content? How and where is consent recorded? What processes are in place to review older material?
Old material: Do archived pages or past posts still need to remain public?
Storage: Are original images stored securely and handled in line with school or sector policies for data retention and disposal?

If an image is misused:

Preserve evidence: If safe to do so, record screenshots, account details, URLs, dates and relevant messages. Never save, share or redistribute sexual images of anyone under 18. Keep evidence access tightly restricted.
Report it: Report harmful content to the platform first, then to eSafety where appropriate.
Communicate carefully: If students are affected, tell families what has happened and what the school is doing, without sharing the material or details that could help locate it. Ask families not to circulate it.
Expect it to resurface: Content may be reposted or appear on new accounts. Keep records, update affected people and reinforce that further sharing can prolong the harm.

This advice is particularly relevant to IEU members, who should take care when posting any imagery involving students.

Schools should review how they collect, approve, post and store images. A risk-based approach can help determine which images belong on public channels and which are better shared in a closed or restricted space.