New guidelines released for photographing and filming children

The Office of the Privacy Commissioner (OPC) has recently released new guidance concerning photography and filming (Images) of children and young people.[1]

This updated guidance flows from the OPC’s 2025 Privacy Survey, which found that public concern regarding children’s privacy was one of the top three privacy concerns in New Zealand.[2]

The Privacy Act 2020 sets out certain requirements for collecting, using, and sharing personal information. These requirements are set out in the 13 information privacy principles (IPPs). Images of any person is personal information about that person, unless there is nothing in the Image that could make it possible to identify them.

Potential consequences of taking Images of children and young people include ‘bullying, identify theft, Child Sexual Abuse Material (especially considering AI advancements), grooming exploitation and unwanted attention/intrusion’.

Things the OPC recommends that organisations consider are:

1. Do you have a good reason for collecting the Image?
   1. You can only collect personal information if it is for a lawful purpose connected with the functions or activity of your organisation, and collecting the information is necessary for that purpose.
   2. In practice this means you need to be clear about the purpose you are collecting the Image for; how that purpose relates to your organisation’s functions; and why collecting the Image is necessary for that purpose.
   3. For example, if you have collected an Image of a child or young person for the purposes of developing an activity progress report, you cannot then use that Image for an advertising campaign or post it on your organisation’s social media platforms.
2. What does the Image show?
   1. Organisations should have clear guidelines and processes for reviewing Images collected before they are used or shared.
   2. For example, an Image of a child or young person in their school uniform could reveal which school they attend, and their approximate age, gender, ethnicity, or sexual orientation. The background or surrounding details of an Image can reveal where they may live, their contact information, and what their interests or beliefs are. Or it may embarrass the child.

3. Have parents/guardians consented to the collection and sharing of the Image?
   1. Any consent must be informed so sufficient information must be provided.
   2. Parents/guardians must be told why their children’s information is being collected, what is going to happen to it and whether they have a choice about providing that information (including what will happen if they say no).
   3. Note that consent is not a ‘once and done’ People should have the right to withdraw consent at any time, including getting previously published Images taken down, as long as that is feasible. For example, a photo of a child that was not initially a problem may create safety concerns if it is kept up on a social media site after family circumstances change.
   4. If it has been some time since consent was provided for Images to be collected, check if they are still comfortable with photography or filming taking place.

4. How will Images be kept safe, and not held for longer than is necessary?
   1. Just because an Image is held by your organisation does not mean it is fair game for anyone who works there. Think about why you got it, who needs to see it, and whether you have been clear about what can be done with it – for example that it is only for use in a newsletter, not for posting on social media.
   2. Practical steps can include: not using personal devices to collect Images; using lower resolution Images to make it less likely that a child or young person could be identified; disabling right click and screenshot capabilities on website and/or social media pages; and removing embedded material/metadata from the Image – this separates or removes the Image information (which may say more about the person or the context) from the Image itself.
   3. Images should not be kept for longer than is required for the purpose it was collected. There is no minimum timeframe setting out this period – but as a general rule, if you no longer have a reason to use or share the Image for the original purpose for which it was collected, you should delete it. Also make sure that deleted Images are actually deleted and cannot be recovered.

Please reach out to our team if you require further assistance in this area. We specialise in privacy law, and this is a topic of particular interest to us.

---

[1] Office of the Privacy Commissioner | Children and young people: photography and filming guidance

[2] 67% of respondents stating they were concerned about the privacy of children, including when using social media.