Pause Before Posting: Student Privacy Concerns with Social Media Posts by Schools

Social media engagement by teachers and staff can provide opportunities for a school district to connect with students and the community in positive ways. However, a recent Review and Determination issued by the Chief Privacy Officer of the New York State Education Department underscores that schools and staff must comply with state and federal privacy laws when sharing social media posts that include images or videos of students. Not every student photograph will qualify as an education record in every circumstance, but photographs and videos frequently raise privacy concerns and should never be treated casually.

Student privacy in New York is protected by both federal and state law. Student data includes personally identifiable information drawn from student records, and unauthorized access, use, or disclosure of that information can create legal consequences for a school district and undermine trust among parents and students.

The Family Educational Rights and Privacy Act (FERPA) limits disclosure of personally identifiable information from student education records, while New York Education Law § 2-d and Part 121 of the Commissioner’s regulations impose additional requirements regarding data privacy and security. Together, these authorities require school districts to exercise care before sharing student information and maintain policies that protect against unauthorized disclosure.
Student data includes personally identifiable information drawn from student records, and unauthorized access, use, or disclosure of that information can create legal consequences for a school district and undermine trust among parents and students.

FERPA permits schools to designate certain limited categories of information as “directory information,” meaning information that generally would not be considered harmful or an invasion of privacy if disclosed. New York guidance also encourages districts to adopt clear procedures for photographs and videos, rather than rely exclusively on general directory information opt-out policies. Under both federal and state legal frameworks, schools may define directory information and establish policies governing its disclosure, but they must then adhere strictly to those policies.

One challenge for schools is that photographs and videos may be classified differently depending on which students appear in them and how the images are disclosed. For example, a concert video could be considered an education record if it depicts students performing as part of a class, or directory information if district policy defines it that way. The same video, or images taken from it, may also show students in the audience, in which case the district would need to honor any applicable opt-out requests for identifiable students, even though the audience members are not the focus of the video or image.

The recent Review and Determination also suggests that “reposts” on social media of content depicting students by school staff may constitute a disclosure of directory information and therefore may be subject to applicable restrictions and opt-out requests, even when the school did not create or authorize the original content. For that reason, school policies should clearly define directory information and this definition should be communicated effectively to staff, parents, and eligible students. Clear policies can both protect student privacy and allow schools and their staff to highlight student achievement in the arts, academics, and athletics in appropriate ways.

Standing NYSED guidance from the Chief Privacy Officer indicates that the strongest practice is often to adopt separate photo and video media release processes for social media posts, yearbook content, and other common forms of publications of student images, rather than treat all photographs and videos as directory information by default. The guidance also suggests that an opt-in form is the preferred practice, allowing parents and eligible students to affirmatively acknowledge what directory information is and how it may be disclosed by the school. An opt-out system, however, remains permissible so long as schools communicate their policies clearly and permit parents and eligible students to submit opt-out requests at any time.

Regardless of the consent structure used, a distinct policy helps families and staff understand when consent is required and what limitations govern district use of student images. Updated policies that reflect common uses of photographs and videos may also reduce confusion when student images appear in district communications, yearbooks, or social media.