Skip to content

Demo site. Fictional data; nothing is sent to anyone. Open the guided demo

UltoPulto
Try the scan

Children's images and privacy online

Short answer

Photos and details of children posted by families, schools and clubs can be copied, indexed and reused by services the family never dealt with. In the US, COPPA gives parents rights over data that online services collect from children under 13. In the UK, children's data has specific protection and erasure requests about it carry extra weight. The practical work is asking the right party to remove a specific copy.

Published
Last reviewed

General information, not legal advice. This page has not yet been reviewed by a lawyer; check the linked primary sources before relying on it.

Key takeaways

  • Human Rights Watch found identifiable photos of children in LAION-5B, a dataset used to train AI tools.
  • COPPA covers personal information collected online from children under 13, not teenagers, and not what adults post about children.
  • Under COPPA, a photo, video or audio file containing a child's image or voice is personal information.
  • UK guidance gives particular weight to erasure requests about data collected from children.
  • UltoPulto family accounts are planned, not built.

What is the problem?

A child's image usually goes online through someone else: a relative's post, a school page, a team photo. Once public, it can be collected and reused by systems the family never interacted with.

In June 2024 Human Rights Watch reported finding 170 photos of children from at least 10 Brazilian states in LAION-5B, a dataset used to train AI tools. Some carried names and locations. The organisation had reviewed less than 0.0001 percent of the dataset. LAION confirmed the photos were there and pledged to remove them.

This page is general information about privacy. It is not parenting, medical or legal advice.

How does it happen?

  • Posts by adults. Photos published by family, schools and clubs can carry names, dates or places in the caption.
  • Collection at scale. Publicly reachable images can be scraped into datasets, as the LAION-5B findings show.
  • Apps and sites children use. A service can collect personal information directly from a child. This is the situation COPPA regulates.

What laws may apply?

  • United States: COPPA. The FTC's rule applies to operators of commercial websites and online services directed to children under 13 that collect, use or disclose personal information from children. Operators must give parents access to their child's personal information to review it or have it deleted. The FTC says COPPA applies only to information collected online from children, not to information adults provide about them.
  • COPPA amendments. In January 2025 the FTC finalized changes that add biometric identifiers to the definition of personal information, require separate parental consent before a child's data is shared with third parties for advertising, and limit how long data may be kept.
  • United Kingdom. The ICO's Children's code sets 15 standards for online services likely to be accessed by children under 18. Under UK GDPR the right to erasure is not absolute, but the ICO says a request deserves particular weight when the data was collected from a child, even after that person has grown up.
  • Intimate images. The US TAKE IT DOWN Act requires covered platforms to remove a nonconsensual intimate depiction within 48 hours of a valid request. It covers depictions of minors.

Which of these may apply depends on where you live.

What you can do yourself

These steps are free and do not need UltoPulto.

  1. Start with whoever published the photo. Ask the relative, school or club to take it down or remove names and places from the caption.
  2. For a service your child under 13 uses, ask the operator to show you the personal information it holds about your child and to delete it. COPPA gives parents that right.
  3. In the UK, send an erasure request to the organisation holding the data. It must respond within one month.
  4. If a nude or sexual image taken of someone under 18 is online or might be shared, NCMEC's free Take It Down service can help. It works from a hash, so the image stays on your device.
  5. Keep a record: the URL, a screenshot, the date, and who you contacted.

What UltoPulto can do

  • Family accounts, which would protect several people, including children, from one account.Planned
  • For your own adult account: an Exposure Scan, and removal requests to people-search sites and data brokers that list you.Built

What UltoPulto cannot do

  • Today an account covers one adult. We cannot yet run a scan or open cases for a child.
  • We cannot remove a child's image from an AI model that has already been trained.
  • We cannot make a relative, school or club delete a post.
  • We are not a reporting channel for child sexual abuse material, and we are not an emergency service.

Sources

  1. 1Complying with COPPA: Frequently Asked QuestionsFederal Trade CommissionGovernmentOpened 2026-10-04
  2. 2FTC Finalizes Changes to Children's Privacy Rule Limiting Companies' Ability to Monetize Kids' DataFederal Trade CommissionGovernmentOpened 2026-10-04
  3. 3Introduction to the Children's codeInformation Commissioner's Office (UK)GovernmentOpened 2026-10-04
  4. 4Right to erasureInformation Commissioner's Office (UK)GovernmentOpened 2026-10-04
  5. 5Brazil: Children's Personal Photos Misused to Power AI ToolsHuman Rights WatchNon-profitOpened 2026-10-04
  6. 6Take It DownNational Center for Missing & Exploited ChildrenNon-profitOpened 2026-10-04
  7. 7TAKE IT DOWN Act, Public Law 119-12US Government Publishing OfficeLawOpened 2026-10-04

Questions

Does COPPA stop relatives or schools from posting my child's photo?

No. According to the FTC, COPPA applies to personal information collected online from children under 13 by operators of websites and online services. It does not cover information that adults share about children.

Can a child's photo be taken out of an AI training dataset?

Sometimes. A dataset maintainer can remove an entry, as LAION pledged to do with the photos Human Rights Watch reported. Removing an entry from a dataset is different from changing a model that was already trained on it.

What if the image is sexual or intimate?

NCMEC's Take It Down is a free service for nude, partially nude or sexually explicit images taken when someone was under 18. In the US, covered platforms must also remove nonconsensual intimate depictions within 48 hours of a valid request.

Can I add my child to my UltoPulto account?

Not yet. Family accounts are planned and not built.