Asking permission for a photo is the part everyone remembers. Deciding when it comes down is the part that has just cost 3,000 euros.

Picture this: a 24-year-old woman in London is preparing for a job interview and searches for her own name. In the image results she finds herself at fifteen, in the ski team jacket, on the website of the Swiss boarding school she attended. The caption gives her full name. At the school, nobody now knows who signed that permission form, or where it is.

Almost everything written about photos of minors is about permission. This note is about something else: how long a photo may stay on your website, and what happens to it once the person in it has left.

What the Spanish regulator fined.

According to a summary published by the law firm ECIJA on 22 April 2026, the Spanish Data Protection Agency (AEPD) fined the foundation that runs a school. In April 2024, a pupil’s father complained that the school had posted photos and videos of his son on Instagram, YouTube, Facebook and its own website, in posts from 2021, 2023 and 2024. When he asked to see the consent form, the school admitted it did not have one.

The school said it asked for permission at the start of every school year. For 2023-24 there was no signed form, and the boy still appeared in at least one image because of an “identification error”. For earlier years there was no paperwork left: the policy was to keep consent forms for one year. The regulator imposed 3,000 euros for publishing without consent the school could prove.

The other 3,000 euros are, to my mind, the more useful part. The school’s form said images would be kept “indefinitely, unless the data subject requests their deletion”. The regulator found this excessive and disproportionate, because the images could remain online after the pupils had come of age or left the school. Once proceedings had begun, the school set a maximum of five years. The total fine of 6,000 euros was reduced to 3,600 for accepting responsibility and paying voluntarily.

What the regulator’s guidance says.

The AEPD’s guide for schools draws a line between two things. Images taken for teaching, such as coursework or assessment, need no consent. Images of events that are published in the school magazine or on the website do. Asked whether a school may publish photos or videos of students on its website, the guide says yes, with their consent or their family’s, or in a way that makes them impossible to identify. It recommends that such publication sit in a private area of the website, behind a login and password. In Spain, below the age of fourteen, consent comes from whoever holds parental authority or guardianship.

And in Switzerland.

The Swiss Federal Act on Data Protection says something very similar in different words. Its Article 6 requires that consent, where it is needed, be given voluntarily, after appropriate information, and for one or more specific instances of processing. It adds that personal data must be destroyed or anonymised as soon as they are no longer required for their purpose.

The Swiss Civil Code protects personality, and with it a person’s own image: an infringement is unlawful unless it is justified by the consent of the person concerned, by an overriding interest or by law. And a minor who has capacity of judgement exercises the rights attached to their personality on their own. The law sets no age for that capacity: it is assessed person by person. I am not a lawyer. From what age each student signs, and whether their family must sign as well, is a question for your legal counsel.

What I do not know.

I have not read the regulator’s full decision: I am relying on the law firm’s summary, which cites its reasoning. I know of no published Swiss decision on student photos on a boarding school’s website, and I do not know how a Swiss court would view a limit of five years, or of ten. Nor is there public data on how many schools keep photos of former students online. What I do know is that a form promising to keep images “indefinitely” has already been fined once.

The blind spot: the photo is not only in the gallery.

Deleting a photo from the gallery does not delete it from the website. The name is often also in the caption, the file name and the alt text, which is exactly what Google Images reads. There are magazines and yearbooks in PDF from ten years ago, old news items, presentations sent to agents and copies in web archives. And a group photo can include someone whose family said no, as in the Spanish case. For some families, a photo with a name, a face and a school is not a privacy matter. It is a security matter.

Permission is asked once. The photo stays for years.

Where I stand.

I believe a boarding school’s website should show the school, not catalogue the people who study there. I would use student photos, yes, but with permission by channel and by school year, with a removal date, without names in captions, file names or alt text, and with a preference for images where you recognise the place and the activity rather than the face. I would keep recognisable faces for teaching staff and for former students who give their permission as adults. Anything meant only for families belongs in a private area. A photo with no removal date is not a memory of the school. It is a problem postponed.

What I would check.

• The inventory. How many photos with recognisable students your website shows today, from which year and on which pages.
• The proof. Whether each one can be matched to a signed consent form you still hold.
• The names. Captions, file names and alt text, including the versions in other languages.
• What is not in the gallery. PDF magazines and yearbooks, old news items and material sent to agents.
• The form. Whether it separates the website, social media and print, and whether it says how long each photo is published and what happens when a student leaves.

Where to start.

1. This week

   Take the inventory

   A list of the photos with recognisable students, with their year and their page.

2. This month

   Remove what you cannot prove

   Photos with no consent form you can find, and photos of former students unless they give fresh permission.

3. This quarter

   Rewrite the form

   With your legal counsel: channel by channel, with a time limit, a removal route and the right signatures.

4. At the end of each school year

   Check who has left

   Which permissions expire, which photos come down and who must not appear in group shots.

Find the oldest photo on your website that shows a pupil with their full name. Look at the date. Now think of that pupil today: are they still at the school? Are they an adult by now? Do they know their photo is still there?

And a question for the team, not the website: if tomorrow that former pupil asked for it to be taken down, who at the school would know in how many other places the same image appears?

If you would like me to review which photos of pupils your website shows today, with which names and since when, start with the Strategic Diagnostic. How long your school keeps each image is for your legal advisers to decide, not a designer.