What AI should and shouldn’t do with yearbook photos
Some AI in a yearbook is ordinary photo editing: finding the faces in a picture so nobody’s head is cropped off, or skipping the blurry shot. Other AI works out whose face is in each photo, and that means building biometric data about children, which is a different decision that deserves its own consent.
More yearbook companies are adding face-matching features, and the words used to describe them vary. This page explains the difference in plain language, where a sensible line sits, what the law generally asks about, and the questions any PTA can ask any vendor.
What is the difference between face detection and face recognition?
Face detection answers one question: is there a face in this photo, and where? The result is usually a box around each face. It does not know or care who the person is, and it is not compared against anyone. Photo software uses it to:
- crop a photo without cutting off a face,
- tell a close-up from a crowd shot,
- pick the sharper of two similar photos,
- count roughly how many people are in a frame.
Face recognition answers a different question: whose face is this? It measures a face and turns those measurements into a numeric pattern, often called a face template, faceprint or embedding. It then compares that pattern with patterns made from reference photos, such as picture-day portraits, to find a match. That pattern is a biometric identifier: it identifies a specific person from their body, much as a fingerprint does.
A simple test: if the software could tell you the name of the child in the photo, it is recognition. If all it can tell you is “there is a face here”, it is detection.
Which uses of AI are ordinary, and which involve children’s biometric data?
A practical line for a school or PTA:
Ordinary photo work (no one is identified)
- cropping and framing around faces,
- flagging blurry, dark or duplicate photos,
- colour and exposure correction,
- sorting photos by the class or event folder they were uploaded to,
- laying photos out on a page.
Uses that involve children’s biometric data (a face is singled out)
- matching faces in candid photos against portraits,
- building and storing a face template for each student,
- automatically tagging students by name based on their face,
- “how often does each child appear” counts, when they are produced by matching faces,
- finding the rest of the photos of a face someone has already tagged — the tag can be a name, a student number or nothing at all, and the matching still works the same way.
A name is not what makes it recognition. To match one face to another, a system measures the geometry of the face — the distances and proportions between features — and stores that measurement as a template it can compare. That measurement is the biometric data, and it exists whether the face is labelled “Ava in Room 12”, “student 0413” or nothing at all. So a tool that says it never stores names, or that it only groups “similar faces” for someone else to label, is still doing face recognition on children. Ask what is measured and stored, not just what it is called.
Whose consent does it need?
Everyone who was photographed, not everyone who buys a book. This is the part that is hardest to do properly and easiest to get wrong. A yearbook is built from candids of the whole school, so a face-matching tool measures the faces of children whose families never order a copy, opted out of the yearbook, or were never asked at all. Consent collected at checkout, or a line in the order form, reaches none of them. Nor does consent given by the school on families’ behalf, unless your state allows that and the school has actually done it.
So the question to a vendor is not “did you get consent?” but whose: how was it collected, what were families told, what happens to a child whose family said no or never replied, and can that child still appear in the book normally. A school that cannot answer those four questions is not ready to switch face matching on.
A separate question: training AI models
Whether student photos are used to train or improve an AI model is a different issue from recognition. A tool can do no recognition at all and still have terms that allow training, or the reverse. Ask about it on its own.
No school should agree to it. Training a model on children’s school photos is not needed to make a yearbook, the children and families cannot meaningfully consent to it, and once photos are in a training set they cannot be taken back out. It is not something yearbook companies advertise, and no coordinator we have spoken to has been asked to agree to it. It is also the kind of permission that is granted quietly in terms of service rather than in marketing, so read the terms rather than assume, and ask every vendor you are considering, including us.
Is there a real benefit to face recognition in a yearbook?
Yes, and it is fair to say so. The honest case for recognition is coverage: if software can tell which children appear in the candids, a coordinator can see who is missing and go and find photos of them before the book closes. Missing children are a real problem in yearbooks, and that is a genuine use.
The cost is that, to do it, the system has to create biometric data about every child in the book, most of whom are too young to understand it. That data has to be consented to, kept secure, limited to its purpose, and deleted — and the consent has to come from the family of every child who was photographed, not only from the families who buy a book. A child whose family never orders, or who opts out of the yearbook entirely, is still in the candids a school uploads, and their face is measured the same way. That is the group most easily forgotten when a vendor says consent was collected. Coverage can also be tracked without faces, by checking which classes and events have photos, though that is coarser than knowing each child.
Neither choice is automatically right. What matters is that the school and families know which one they are getting, and agree to it.
What does the law generally ask for?
This is general information, not legal advice. Laws differ by state, change over time, and depend on facts such as who collects the data and why. Treat everything below as questions to raise with your school or district and its counsel.
Illinois: Biometric Information Privacy Act
BIPA covers a “scan of hand or face geometry”. It excludes photographs themselves, so the concern is the face scan, not the picture. Before a private company collects a biometric identifier, the law generally requires it to tell the person, or their legally authorized representative, in writing that it is collecting it, for what purpose and for how long, and to get a written release. It also requires a public retention and destruction policy, and it bars selling or otherwise profiting from the data.
Question to raise: if a vendor scans faces, who signs the written release for each child, and where is the vendor’s published destruction schedule?
Texas: Capture or Use of Biometric Identifier Act
According to the Texas Attorney General, anyone who captures a “record of hand or face geometry” for a commercial purpose must give notice and get consent first, must protect it with reasonable care, generally may not sell or disclose it, and must destroy it within a reasonable time, no later than one year after the purpose for collecting it has expired.
Question to raise: how and when is notice given and consent collected, and what is the destruction date?
California: CCPA, as amended by the CPRA
California’s law defines biometric information to include face imagery from which a faceprint can be extracted, when used to establish identity. Processing biometric information to uniquely identify someone is “sensitive personal information”, which consumers can ask a business to limit. It applies to businesses that meet the law’s thresholds.
Question to raise: does the vendor treat face data as sensitive personal information, and how can a family use its right to limit?
Federal: COPPA
The FTC finalized changes to its Children’s Online Privacy Protection Rule in January 2025. The amended rule took effect on 23 June 2025, with most provisions requiring compliance by 22 April 2026. It adds to the definition of children’s personal information “a biometric identifier that can be used for the automated or semi-automated recognition of an individual”, naming facial templates and faceprints. COPPA applies to online services that collect personal information from children under 13 in the situations the rule describes, so whether it covers a particular yearbook tool may depend on how that tool works.
Question to raise: does COPPA apply to this service, and if so, whose consent is being relied on?
Federal: FERPA
The US Department of Education says a photo of a student is an education record when it is “directly related” to a student and kept by the school or by a party acting for the school. Whether a given photo is directly related depends on context. A company the school outsources work to may be treated as a “school official” when it is under the school’s direct control over how records are used and kept, and is bound by limits on sharing them.
Question to raise: is the vendor acting for the school under FERPA, and does the agreement cover face data as well as the photos?
New York
On 27 September 2023, the New York State Education Department issued a determination that prohibits schools in New York from purchasing or using facial recognition technology. Other biometric technology is left to local decision, weighing privacy, civil rights, effectiveness and parental input.
Question to raise, for New York schools: how does the determination apply to any yearbook feature that matches faces?
Other states have their own biometric and student-privacy laws. If your school is outside these states, ask counsel which apply.
What should a PTA ask any yearbook company?
A good vendor will answer these plainly, in writing.
- Do you use face recognition, or only face detection? Does any feature match faces to portraits or names, even if it is not called “facial recognition”?
- Is it opt-in, and who opts in? The school, each family, or both? What happens if not everybody opts in?
- Is parental consent collected, and how? A signed form, a checkbox, or consent given by the school on families’ behalf?
- Whose consent did you collect? Every child who appears in the photos, or only the families who ordered a book? Children whose families never order are still in the candids, and their faces are measured the same way.
- What is stored? Face templates or embeddings? Where are they kept, for how long, and on what date are they deleted? Can we get confirmation when they are?
- Is any student photo used to train or improve AI models, yours or anyone else’s?
- Can a family opt their child out without losing their place in the book? Will the child still appear in class pages and candids?
- Who at your company, and at any subcontractor, can see student photos?
Keep the answers with your yearbook records. Next year’s coordinator will want them, and so might your district. The coordinator handover pack covers what else to pass on.
Where does Rethink Yearbooks stand?
We do not use facial recognition, face matching, or any other biometric identification on student photos — not to build the yearbook, and not for anything else.
Each child’s myClass and myGrade pages are built from how the school organizes its photos — by class, grade, and event — not by scanning or identifying anyone’s face. Student photos are also never used to train AI models, are stored on U.S.-based servers, and are deleted after the school year ends. Final yearbook files are kept longer so schools and families can reorder or reprint copies in the future.
We do use plenty of other AI and automation, and it is the ordinary kind. A school can upload a few hundred photos or many thousands, in whatever format the phones and cameras produced, so software does the sorting work nobody has time for: converting formats such as HEIC into print-ready files, flagging photos too low-resolution, dark or blurry to print, finding duplicates and near-duplicates so the same moment does not run three times, ranking a set by quality so the strongest shots surface first, grouping photos into the events they came from by time and folder, laying pages out automatically, and generating the cover and page templates behind the First Draft we hand a school to edit. None of it asks who is in a photo: it works from the image itself and from how the school organised its folders.
- Detecting where faces are, so crops never cut through a child. This is detection only: we do not identify anyone and do not create face templates.
The details are in our FAQ and privacy policy.
AI and yearbook photos, answered.
Is face detection the same as facial recognition?
No. Face detection finds where faces are in a photo, so software can crop or pick sharp images. Facial recognition works out whose face it is by comparing a face pattern against reference photos such as portraits. Recognition creates biometric data about a person; detection is not used to identify anyone.
Is it still face recognition if the company never stores names?
Yes. Matching one face to another means measuring the geometry of the face and storing that measurement as a template. That template is the biometric data, whether it is labelled with a name, a student number or nothing at all. Grouping “similar faces” for a person to label later works the same way. Ask what is measured and stored, not what it is called.
Whose consent is needed for face recognition in a yearbook?
Every child who appears in the photos, not only the families who order a book. Candids include children whose families never buy a copy or opted out, and their faces are measured the same way. Consent gathered at checkout misses all of them. Ask a vendor how consent was collected, what families were told, and what happens to a child whose family said no.
Is a yearbook photo biometric data?
A photo on its own is usually not treated as a biometric identifier. Illinois’s biometric privacy law, for example, excludes photographs. The biometric data is the face measurement, template or faceprint that recognition software extracts from the photo and uses to identify someone. Illinois courts have read that exclusion narrowly: the paper or digital photo is not the identifier, but the face-geometry scan taken from it is, so extracting a template from school photos can fall under the law even though the photos themselves do not.
Can face recognition help make sure no child is left out of the yearbook?
It can help a coordinator see which children do not appear in the candids. The trade-off is that it creates biometric data about every child. Coverage can also be checked by class and event folders, which is less precise but identifies no one.
Does opting out of face recognition mean my child is left out of the yearbook?
It should not, but it depends on the company. Ask directly whether a child who is opted out still appears in class pages and candids, and how the company makes sure of that.
Is facial recognition allowed in schools?
It depends on the state. New York’s education department prohibited schools from buying or using facial recognition technology in 2023, and states such as Illinois and Texas regulate biometric identifiers generally. Ask your school or district and its counsel what applies to you.
Ask us anything
about the photos.
If you are choosing a yearbook company, we will answer the questions above in writing, and show you how a personalized copy is put together.