Do parents have a right to publish photos/videos of their young children without consent? The Reddit discussion AITA for deleting my newborn son's instagram? soon reached In about 5 years or so I’m ready for the sh**storm when all these kids become teens and get (rightfully) angry that everything about them growing up is on the internet and similar comments (e.g baby's first poop, or other potential embarrassing incidents). Question: upon reaching adulthood, does a person have any legal recourse against a parent who publishes their photos or videos of them to social media without the child's consent? If I have to state a jurisdiction, then I will plump for the USA, but information about other jurisdictions is certainly welcome.
united-states In some countries there are laws prohibiting publishing a person's picture without that person's consent. The US has no such general rule, and many other countries do not either. The details of such laws, where they exist, vary from country to country. In the US there are two kinds of legal action that might be used by a person to stop that person's image from being published. These are a suit for invasion of privacy, and a suit to enforce a person's right of publicity, also called a right of personality. These torts vary from state to state, and are not recognized at all in some states. Invasion of Privacy This has several variants, such as &quot;intrusion upon seclusion&quot;, and &quot;disclosure of private facts&quot;. Intrusion generally applies when someone has entered a private place, such as a dwelling, without permission, and has then taken a photograph, made an audio or video recording, or perhaps a written account, and has published or attempted to publish the image, recording or account. If and only if the publication would be &quot;highly offensive to a reasonable person&quot; then the subject or lawful occupant of the place invaded may be able to obtain money damages, or an injunction against publication. This would not apply to the fact pattern in the question, because the parents would have had a right to be in their own home, or anywhere that such baby photos are likely to have been taken. Intrusion can also apply to one who observes private activities without permission, even if no recording is made. But the &quot;highly offensive&quot; standard still applies. A &quot;private facts&quot; case generally applies when a person (or a small group, such as a family) has attempted to keep certain facts private, but some other person or business has published them (or attempted to publish them). A successful suit will in most states that allow such suits require evidence of some positive effort to keep the facts private, and that the publication would be &quot;highly offensive to a reasonable person&quot;. This might possibly apply in the fact pattern described in the question. But note that the &quot;highly offensive&quot; standard applied to both of these privacy torts. Most typical baby pictures would not be considered &quot;highly offensive&quot;, this is a fairly high bar. It would be a decision ultimately made by the jury or other finder of fact, I believe. For comparison, peeping on a couple having sex in a hotel room has been found to be highly offensive. When a person had sex with another, and had secretly arranged to record a video of the sexual encounter, and later distributed it, that was found to be highly offensive. Right of Publicity This generally prohibits using a person's, name, image or likeness, or &quot;persona&quot; to endorse or advertise anything, or for other commercial purposes, without consent. It is most often applied to unauthorized celebrity endorsements. Most US states have some form of this, but the details vary significantly. Unless the baby pictures were being used to advertise something, or in some commercial manner, this would not apply. If the parents sold baby pictures to someone who used them to advertise, say a day-care, or some baby product, this might apply, although it might be that the parents would be held to have had the right to act as the child's agent. If someone else downloaded the baby pictures from Facebook (or any other such site) and used them in ads, this might well apply. Conclusion It is unlikely in the US that a child could successfully take legal action against a parent for having posted pictures of the child, even if they were embarrassing, unless they were also &quot;highly offensive&quot;. Even then such a suit would be unusual, and might not be successful. It is more likely that a request to the parent would be successful, unless the parties are on vary bad terms. A request to the site to take down such images might work, depending on the site's terms. A DMCA takedown would not work, because the subject does not normally hold copyright to an image, the photographer initially does (unless it is a work made for hire, in which case the employer initially does). This conclusion is specific to US law. The outcome would be different in at least some other countries.
Let's put to bed the myth of privacy that is at the heart of your question: in R v Sotheren (2001) NSWSC 204 Justice Dowd said “A person, in our society, does not have a right not to be photographed" So they can ask you to stop; its bad manners if you don't but it is not illegal. If they are the controller of the property then they can stop you filming from their property but they cannot stop you filming into their property from outside (either public land or land where you do have permission). See How do laws affect photography of non-humans in public when people may be in the frame?
Permission is not a physical thing that disappears when a piece of paper evidencing that permission is lost or handed to another party. When someone gives you permission as part of an agreement having the necessary characteristics of a contract, then the revocation of that permission is governed by the terms of the contract itself and your jurisdiction's contract-law. You may not need any permission to use the photos you paid to have taken. (For example, in the U.S. if they were taken in a public place and you are not displaying them for profit.) Or, you might need permission due to various rules or laws protecting minors – only an IP lawyer familiar with your jurisdiction can confirm this is the case – and, unless it was drafted by a competent lawyer, it is quite possible that your "permission statement" was legally insufficient or defective. Or, you might have legally secured necessary permission and still have that permission even though you handed the "permission statement" back to the parents of the subject. In practice: Only a lawyer in your jurisdiction can offer an opinion on which of these scenarios is in fact the case. And only via litigation can you establish further confidence that legal opinion is correct.
I'm pretty sure that under GDPR, you can indeed request them to send all data they have on you. If it's a complex request, they may charge you something like £10. If they have a lot of data on you, they may list the categories of data they have and ask you to pick one, rather than them having to collect and send everything. They should respond within one month, but iirc in the UK implementation, they can inform you (within that month) that they will respond within three months instead. For the rest, I only know current Dutch law. GDPR is not that different from what we already had (in general terms) and in many cases it even extends it. Under our law (WBP), you can also request a correction of the data in case it is incorrect, or deletion if they no longer need it for the purpose for which it was collected and stored. I don't really know how that works out in practice though, as Facebook can of course claim that "being able to connect you to your friends when you sign up for WhatsApp or Facebook with that number" is a legitimate purpose (in their eyes). They might also not have your full name and therefore not be able to connect your data to your request. Or, perhaps, they have only your full name (and there are probably more people with your name), so they'll have a hard time verifying that it's really your data which they would be handing over or deleting. The company is required to verify your identity before acting on your request. How they implement that is up to them. Under Dutch law, if I remember correctly, any data that can be connected to your person by any party is personally identifiable information (PII). While Facebook might not be able to find who's behind a phone number, your carrier most certainly can. Therefore, the data falls under PII protection laws and they will have to implement a way to verify you and get you your data. Finally, whether your local laws apply to Facebook, I don't know exactly. There's lots of information on this though, so you should be able to find it. Generally, countries say that if something happened within their territory (e.g. you signed up for WhatsApp while in the UK), their law applies. Companies, I've read, will instead try to claim that their main office is in SomeCountry and therefore SomeCountry's laws apply. But I'm pretty sure you'll be able to find a Facebook office somewhere where GDPR applies, so that's probably fine. While not an exact answer and while I am not sure about everything, I hope this gave you some pointers to go on!
The relevant law in England and Wales is the Protection of Children Act 1978. Under section 1 of the Act, it’s a defense to distributing, showing, or possessing indecent images of children if you had a “legitimate reason” to distribute, show, or possess them. It’s also a defense if you had not seen the images, didn’t know they were indecent, and didn’t have any cause to suspect they were indecent. However, the 1999 case of R v. Bowden held that downloading a digital copy of an image counts as “making” an image. This is not subject to the “legitimate reason” defense by statute (although I don’t know if it’d count as “making” if you have no reason to know the contents, like if a computer repair shop backs up a customer’s hard drive without looking at what’s on the drive). However, it is explicitly still subject to defenses in sections 1A and 1B of the Act. 1A covers spouses and partners. If you are the spouse or partner of a child between 16 and 18, then with their consent you can legally make indecent images of them (although this doesn’t apply if anyone but the two of you is in the image). You can also possess those images with their consent and give them a copy. Section 1B covers criminal proceedings, investigations, etc., and was added after R v. Bowden. Because copying a digital image counts as “making” an image, it would generally be illegal for people to work with digital copies of indecent images even if done for a good reason. To avoid that, Parliament made an exception for making an indecent image when necessary to prevent, detect, or investigate crimes, as well as for criminal proceedings anywhere in the world. Parliament also exempted the UK’s intelligence agencies (MI5, MI6, and GCHQ) when carrying out their duties. These are specific statutory exemptions, so they can’t really be generalized to “if you have a legitimate reason.”
Your VPN scenario is why you have to show the banner to everyone. If you somehow knew beyond any doubt that someone was not in the EU, then you would not have to show a banner, but because you can't verify that, you should always show the banner. Doing so also protects against accidentally violating a similar law in another country; the GDPR is the best-known privacy law, but it is far from the only one. It's good practice to ask for people's permission before collecting their information anyway.
united-statestexas In the US, it depends on the consent-to-treat laws of the state. In Washington, under RCW 9.02.100, everybody has a right to reproductive privacy (be it contraceptives or abortions). Under the federal HIPAA privacy rule, the minor requesting contraceptives would therefore be &quot;the individual&quot;, which means that disclosure to others requires consent from the patient. Given the supremacy clause, that's all she wrote for Washington. The majority of states similarly allow 16 year olds to request contraceptives. Texas Family Code §32.003 spells out the conditions where a minor can consent to their own medical treatment, which does not include the situation you describe, therefore parental consent would be required (which clearly implies parental notification). Furthermore, that law also says (d) A licensed physician, dentist, or psychologist may, with or without the consent of a child who is a patient, advise the parents, managing conservator, or guardian of the child of the treatment given to or needed by the child. Therefore in Texas there is no prohibition against informing the parent(s). (Note that in the Texas Family Code, &quot;child&quot; is a synonym for &quot;minor&quot;, so this also applies to teenagers, not just small children.) Carey v. Population Services Int'l, 431 U.S. 678 is an important ruling regarding the rights of minors to make their own decisions regarding contraception, but it does not go so far as to declare that minors have a constitutional right to give consent to the requisite medical examination.
Does CCPA impact whether or not this is allowed? Probably not. Public schools are divisions of state government and there are limits to how much the federal government can dictate the operations of state and local governments. Limitations on whether public schools can monetize data collected from students (13+) would arise under state law. The state law could certainly expressly authorize the practice (and to some extent does already with profit generating sports teams and yearbooks). State law could likewise prohibit the practice. For the most part, state law is silent and it doesn't happen that much because it isn't very profitable. Is there different guidance for public (government-managed and nonprofit) vs private schools? The legal analysis is very different. I'm not as familiar with this area of law, however, and will leave that question to someone else. As a practical matter, private schools are in a very good position to obtain express consent to do so from parents and students, so that is usually how the issue is resolved, I suspect.