Four privacy-minded ways to share photos of your kid, ranked

I can’t tell you how many times this week that I whipped out my phone and took photos and videos of my infant son without a second thought. I want my friends and family spread across the country to see every smile.

He’s astoundingly cute and sweet. And you’re just going to have to take my word for it.

Last week, I detailed all the horrible potential repercussions of posting photos of your child to the open internet, which includes and this blog/newsletter. So today I want to go over the ways you can share them with friends and family without inadvertently cc'ing predators, bullies, data brokers, and companies that want to exploit your kid for AI training.

This also gives me a chance to address something specific that several friends have asked me since they learned I was doing this project: can I post photos of my kid to Instagram Reels?

One question for you before we get started: I've been thinking a lot about etiquette. What's the best way to politely tell a friend or uncle or cousin that it's ok to take a picture with your kid, but they need to follow certain rules if they want to post it? How do you bring it up with daycare or school or camp or a youth sports league that routinely posts photos of kids? If you have an experience that went well or poorly or have a related question, please email me: [email protected]. I'll anonymize anything you tell me unless you explicitly tell me that isn't necessary.

Trying to tackle privacy broadly can be so overwhelming, so to answer this question I'm tapping into a key concept from my day job as a cybersecurity reporter: threat modeling. That means we first identify what exactly we're worried about, then come up with solutions to address those concerns specifically. Fortunately, we have that first part already from last week's post. As a reminder, the four big risks of posting your kid’s face to the open internet are:

*Predators search social media for pictures of children.

*AI companies are gobbling up pictures and videos, including of kids, to use as training data and to do whatever they want with in the future.

*Creeps find photos of kids and use AI to create CSAM (Child Sexual Abuse Material) from them.

*You don't have any young child's consent — yours or anyone else's — to share their likeness with the broader world.

After speaking with a few experts, some on the record and some off (you know who you are — thank you!), I've identified four tiers of ways to share photos and videos of your kid while steering clear of those four threats. Personally, I'm sticking almost exclusively with the first one. But I want you to be able to make an educated decision.

Tier one (most private): Use good old fashioned text messaging, directly or in a small group.

Surprised? I was, but the logic is sound.

For one thing, this way there's no doubt who you're sending photos of your kid to. Their names are at the top of the group chat. No access for internet creeps, bullies, or bots trawling to feed to AI companies. But a tightly curated group chat of people you know and who understand they aren't allowed to share those photos without explicit permission, please. Not some WhatsApp group with 1,024 members.

The photos live on your phone, your trusted recipients' phones, and maybe on your or their cloud backup accounts. That's it.

And while that doesn't preclude somebody getting access to those accounts — and if you want to go the extra mile, encrypt and password-protect your backups! — really, this addresses most scenarios that would violate any of our four concerns.

Also, a big bonus to text messages: they're some of the very rare data that get a special protection under U.S. law. The Electronic Communications Privacy Act of 1986 makes it fairly easy for government agencies to get information about your emails and texts, called metadata, but it also protects messages content unless there’s a warrant or court order involved. That’s a huge concern for some threat models, but not what we’re worried about as regular parents.

To be clear, while you can use traditional SMS/MMS messaging, I'm really talking about the four major apps that have effectively taken their place: WhatsApp, Signal, Apple iMessage, or Google Messages. (Using those services for texting but with extra features like encryption, live video chat, and high quality photos and videos is called OTT, or Over the Top messaging. That will not be on the quiz, and sorry if that fact pushed out something important in your brain.)

Signal is the most secure messaging app for everyday use. Its encryption protocol is open-source, meaning anyone can inspect it for flaws, and it's so respected by cryptographers that the other three companies openly advertise it's what they use to power their messaging apps. Signal has a couple additional bells and whistles that make you even safer from two big-league hackers or subpoenas from law enforcement, which is why it's a must when I'm talking to sensitive sources for my day job.

If neither of those things are in your threat model, though, you're probably also safe with one of the other three options. Personally, I convinced my family to download WhatsApp for photos of my kid. It wasn't a hard sell and it’s easy for everyone to use.

The other two, Google Messages and Apple iMessage, are also pretty much the same thing. But with both apps, you only get the full features if everyone in your group chat uses an Android or everyone uses an iPhone.

If at least one person in your Messages or iMessage group doesn't have the right phone type, it will default to traditional SMS/MMS protocol, something you may remember from pre-smartphone days. That smushes pictures into a smaller format and degrades videos to the point they're borderline unwatchable, making it less than ideal for our purpose.

My wife's family all uses the same type of phone, so they never even had to have this discussion when sharing pictures of our son. If that's you and your family or friend group, great. If not, push for them to use Signal or WhatsApp.

Tier two: Curate photos and videos in Apple or Google albums.

Maybe you want to be a little more formal than interspersing photos and videos in a chat. You can spend some time picking your favorite pictures, maybe make it a theme, and you can send it to multiple trusted people.

Calli Schroeder⁩, who’s both a parent and senior counsel at the Electronic Privacy Information Center, a leading digital privacy nonprofit, told me that the privacy policies for Google and Apple's respective photo album platforms are surprisingly robust and should suit most parents’ needs, at least as they're written at the moment.

"With tech companies, there's always a possibility they're going to change their policies in the future," Calli said. "But it's also kind of a matter of practicality."

Most parents I know back up their phone's pictures automatically to their Google or Apple storage accounts. As things stand now, that’s a pretty safe practice.

Tier three: Post photos of your kid on social media apps, but either do it through a private account or obscure kids' faces.

I'm a big, big believer of drawing a firm line between your public online life and general private life, and strongly recommend it for everyone. If you set up clear boundaries for yourself, most privacy decisions become much easier. (Another great option is to simply have no public online life, though I think that's increasingly hard: Are you going to maintain your career without a LinkedIn account, for example?)

My job requires me to make some aspects of my life public. I'm on camera from time to time, so it's pretty easy to ID me as an elder millennial white American man. I'm open about a few basic biographical things: I live in Brooklyn; I'm from Huntington, West Virginia; I have a bachelor's degree; I'm married to a woman and we have a son. That information is out there and I'm never reeling it back in. But there's a lot more I'm never going to deliberately make public, especially more specific information about my family.

With that line clear in my head, I don't see much need to post public photos of my adorable son, though yes, I did include him in the profile picture I use for this newsletter. The rare times I do post a photo of him, I'm going to hide his face, either by camera angle or emoji.

You similarly can post photos of your kid to a locked or private Instagram, Twitter, Bluesky, or YouTube account, or adjust your Facebook settings to only share with people you know and keep that list very small. If you know that you've successfully limited your followers, you probably don't have creeps or potential bullies mining what you post, though this method to me seems like more trouble than it's worth.

You also don't have a guarantee that the company won't change their terms of service to allow it to use your kid for AI training data in the future. Meta's terms of service says it's fair game for the company to use your public Facebook and Instagram posts to train its AI models, which makes sense considering that other companies are also already doing that. For now, at least, they don't train on private accounts.

I didn't mention TikTok here because of the ongoing questions about the relationship with its parent company, ByteDance. Chinese law holds that data held by its companies is effectively the property of the Chinese Communist Party, and we know that China's intelligence services have a vast, ongoing project to steal information about Americans in bulk. Whether the U.S.-Silicon Valley tech data complex does the same thing is more of a digression than I can handle in this post, but at least the U.S. government generally requires court orders to get Americans’ personal information from tech companies. Anyway, I particularly distrust TikTok when it comes to worrying that the video you post to your private account might end up in AI training databases or used by China in the future.

The cost-benefit of taking an existing account and pruning out most followers seems not worth it to me. But if you’re going to post your young kid on Twitter or Facebook or even TikTok, definitely make it a private account. 

Tier four: Post to public social media that automatically disappears, like Instagram Stories or Snapchat.

Disappearing messages is a fantastic privacy tool for texting. For social media, it's more of a mixed bag.

I think that unless you're constantly posting photos of your kid in compromising situations, it's unlikely that perverts or scraping tools are going to lurk on your account and rapidly screengrab whenever your kid shows up.

This is one of those scenarios where for now, I think you don't have to be faster than the bear, you just have to be faster than the other hiker. But who knows what our technology landscape will look like in a few years? 

That's it for today. Tell me if this strategy works for you. And don't forget to email me at [email protected] with your questions and experiences in privacy etiquette! I think that one's going to have to be a group effort.