Under POPIA, a photo in which a child can be recognised is that child’s personal information, and an NPO may only use it with the prior consent of a “competent person”, usually a parent or legal guardian (sections 34 and 35). And no, you won’t face ten years in jail for posting a child’s photo. That penalty in section 107 applies to other offences, such as obstructing the Information Regulator or ignoring its enforcement notice.
This isn’t legal advice. If you’re unsure about your own consent forms, ask a lawyer to look at them.
What does POPIA actually say about photos of children?
The Protection of Personal Information Act (POPIA) defines a child as “a natural person under the age of 18 years”. Personal information is “information relating to an identifiable, living, natural person”. A photo where a child’s face can be recognised fits that description.
Section 34 says a responsible party (your organisation) may, subject to section 35, “not process personal information concerning a child”. Processing includes collecting, storing, using and sharing, so taking, keeping and posting a photo all count.
Section 35 lists the exceptions. For NPO photos, the one that matters is processing “carried out with the prior consent of a competent person”. Consent comes before the photo is used, not after someone complains.
Under section 11(2)(a), “the responsible party bears the burden of proof” for consent. If a parent says they never agreed, it’s up to you to show that they did.
Is it really up to 10 years in jail for posting a child’s photo?
Some headlines have said so, but section 107 doesn’t. It sets two levels of penalty:
- Up to 10 years, a fine, or both, for sections 100, 103(1), 104(2), 105(1) and 106(1), (3) or (4). These cover obstructing the Regulator, failing to comply with an enforcement notice, giving false evidence to the Regulator, and unlawful acts involving bank account numbers.
- Up to 12 months, a fine, or both, for sections 59, 101, 102, 103(2) and 104(1).
Posting a photo without consent is on neither list. That doesn’t make it harmless. The Regulator can serve an enforcement notice (section 95), and ignoring that notice is one of the 10-year offences. It can also issue administrative fines of up to R10 million (section 109), and a person can sue for damages “whether or not there is intent or negligence” (section 99).
So the realistic risk is a complaint, an enforcement notice and a fine, plus the harm to a child and to your community’s trust. That’s reason enough to get consent right.
Who can give consent for a child, and what makes it valid?
POPIA defines a competent person as “any person who is legally competent to consent to any action or decision being taken in respect of any matter concerning a child”. That is usually a parent or legal guardian, not a teacher, a volunteer or a relative who happens to be at the event.
Consent is “any voluntary, specific and informed expression of will”. Each word gives you a practical test:
- Voluntary. A parent must be free to say no. A child’s place on a programme should never depend on a photo.
- Specific. Say what you’ll use (photos, first names, a short story) and where (website, social media, funder reports, the press).
- Informed. Explain it in plain words, in the family’s home language where you can.
It’s good practice to ask the child too. UNICEF’s ethical reporting guidelines say to “obtain permission from the child and his or her guardian” for interviews, video and, when possible, documentary photographs.
When a child turns 18, they are no longer a child under POPIA. From then on, any new use of their photo or story is theirs to agree to, not their parent’s.
What happens when a parent withdraws consent?
Section 11(2)(b) says consent may be withdrawn “at any time”. What you did lawfully before stays lawful. What changes is what you do next:
- Stop any new use of that child’s photos and story.
- Take the photos down from channels you control, like your website and social media.
- Tell anyone you supplied them to, such as a funder or journalist.
- Record the date and what you did.
Make withdrawal easy. If a parent has to fight to take a photo down, the consent was never really voluntary.
How long can we keep children’s photos, and where?
Section 14 says records “must not be retained any longer than is necessary” for their purpose, with some exceptions. Section 19 asks for “appropriate, reasonable technical and organisational measures” against loss and unlawful access. For a small NPO, that usually means:
- One private, access-controlled place for photos, not personal phones or WhatsApp groups.
- A short list of people who can download or share them.
- The consent record kept with the photo.
- Deleting photos you no longer need.
Your data protection policy should say who is responsible. Our post on policies every NPO board should have is a good place to start.
Would this child be proud of this photo when they’re older?
The law sets the minimum. The question I find more useful is whether the child in the photo will be glad it exists in fifteen years’ time. A photo of a child in a torn school uniform might raise money this month, but it stays online long after the need has passed, and it can follow them into high school and a first job.
The sector has been talking about this for a long time. The Irish network Dóchas updated its code on images and messages, first written in 2006, into a Guide to Ethical Communications in 2023. It says that “stories and images of children should be captured with the best interest of the child in mind”.
Radi-Aid Research, by the Norwegian organisation SAIH, asked 74 people in six African countries, including a group in Johannesburg, what they thought of aid imagery. The views were mixed, and many accepted that sad pictures raise money. But the researchers wrote that “what came out very clearly” was the need to preserve the dignity of the people shown, and many suggested showing people’s achievements and progress.
The report also noted that people in aid-receiving communities are “often silent” in this debate. For a long time, the people in the pictures were rarely asked. Explaining consent to families in their own language, and taking their “no” seriously, is a small way to change that. It gives a community a say over its own image.
So choose photos that show children learning, playing and belonging. Show the work, not the worst day. Use a first name or an alias. And when you’re unsure, leave the photo out.
How Kaycie helps
Kaycie doesn’t decide what’s ethical. Your team does. What it does is take the checking and remembering off your desk.
- A consent register. Each student’s photo and story consent is recorded with its status. Guardians can consent online through a link, and the wording they agreed to is stored with their typed signature. Signed paper forms are uploaded as evidence.
- A media library that holds photos back. Every photo starts in “Do not use” and is only cleared when every student tagged in it has current consent. If consent is withdrawn or lapses, the photos go back to “Do not use” automatically. Every download and export is in the audit trail. There’s no facial recognition.
- Story reports that protect names. Reports for donors or your media team use aliases, never real names, and leave out any child without current consent, checked at the moment the report is made.
- Consent that follows the child’s age. Once a student turns 18, a guardian’s consent no longer counts for them, and Kaycie asks for the young person’s own consent instead.
These are part of the Plus and Complete packages. See what each includes on our features page.
Frequently asked questions
Do we need parental consent to post a child’s photo in South Africa?
In most cases, yes. POPIA section 34 prohibits processing a child’s personal information, and section 35 allows it with the prior consent of a competent person, usually a parent or legal guardian.
Can you go to jail for 10 years for posting a child’s photo under POPIA?
No. Section 107’s 10-year penalty covers offences such as obstructing the Information Regulator or ignoring its enforcement notice. The realistic risks are a complaint, an enforcement notice, an administrative fine of up to R10 million, or a damages claim.
Who counts as a “competent person” under POPIA?
Anyone legally competent to consent to decisions about a child. In practice this is usually a parent or legal guardian.
Can a parent withdraw photo consent after agreeing?
Yes, at any time, under section 11(2)(b). Earlier lawful use stays lawful, but you should stop new use and take photos down from channels you control.
Does a parent’s consent still count once the child turns 18?
POPIA defines a child as someone under 18. From 18, any new use of their photo or story should rest on their own consent.
Can we use group photos from a public event?
If children can be recognised, POPIA applies to each of them. Use group photos only when you have consent for every recognisable child, or choose shots where no child can be identified.
Sources
- Protection of Personal Information Act 4 of 2013, official text (Information Regulator): sections 1, 11, 14, 19, 34, 35, 95, 99, 107 and 109.
- UNICEF, Ethical reporting guidelines.
- Dóchas, Guide to Ethical Communications (2023).
- SAIH, Radi-Aid Research: a study of visual communication in six African countries (2018).