Celebrate with up to 80% offBack-to-school warning: ExpressVPN warns parents over the hidden risk in first-day photo
ExpressVPN is urging parents to rethink their own posting habits this back-to-school season, warning that the proud first-day photo could be scraped and manipulated using AI by malicious actors.
New YouGov research for the VPN Trust Initiative, co-founded by ExpressVPN, finds that 77% of parents worry about their child's online privacy — but the caution rarely extends to the adults. Children are warned about strangers and passwords; parents keep posting their names, faces, schools and birthdays with little of the same scrutiny.
The concern has sharpened in 2026. AI "nudification" tools have made it trivially easy to manipulate an ordinary photo, and in July the National Crime Agency and Internet Watch Foundation urged parents to carefully consider before posting children's images publicly, warning that AI is being used to harvest everyday photos, including images lifted from school websites, and turn them into abuse material.
Internet Watch Foundation CEO Kerry Smith said: “It’s deeply sad that parents are having to think twice about sharing the moments that celebrate their children because of the risk that those images could be exploited by criminals.
“Tackling this requires a collective response, from families, government, technology platforms and society as a whole, to better protect children online. ExpressVPN’s research shows that parents are rightfully concerned about their child’s online privacy, so it is vital that families have those all-important conversations about what they are comfortable sharing online.”
Against that backdrop, ExpressVPN's Chief Research Officer and father Dr Pete Membrey is calling on families to agree to shared privacy rules before the first-day photos go up.
ExpressVPN works with the same organisation behind that warning, the Internet Watch Foundation (IWF), blocking access across its network to web domains the IWF has confirmed as hosting child sexual abuse material. But Membrey argues the first line of defence sits earlier, in the everyday choices families make about what they put online.
A school crest on a jumper, a street sign in the background, a birthday or a pet's name are the same details used to identify a child, locate them, or answer their security questions. Once a photo is public, it can be exploited within hours.
The research, which surveyed 2,558 UK children aged 11 to 17 and a parent of each, found the worry isn't only the parents': 56% of children said they are concerned about their own online privacy. Yet the decisions about what actually gets posted still sit largely with the adults — and often without the child's say-so.
"Children learn privacy from the choices they watch us make, not from the warnings we give them," said Dr Pete Membrey, Chief Research Officer at ExpressVPN. "A parent who asks before posting, explains who will see a photo and accepts the answer is teaching consent far better than any lecture about being careful online. Back to school is when the photos go up fastest, so it's the moment to set that standard."
Six questions to start the conversation
Membrey is encouraging families to begin the year with a shared privacy conversation, built around six questions:
- What are we each comfortable sharing about one another?
- Which family details should stay out of public posts?
- Who can currently see our profiles and locations?
- Which new apps, accounts or online groups have appeared this year?
- What will happen when someone receives unwanted contact or shares something they regret?
- Which privacy decisions is the child ready to manage independently now?
And the rules should grow with the child
The research shows oversight drops sharply with age: content filters are in use for around 60% of 11- to 12-year-olds but only 20% of 16- to 17-year-olds, and more than half of older teens have no parental controls at all. As those controls come off, children still need to know they can report a threatening message, scam or regretted post without losing their phone over it.
"Sharing our children's milestones comes from a good place, and no parent should feel bad about it," Membrey added. "The small shift that helps is treating our own posts with the same care we'd want our children to use one day."
Notes to editors
Dr Pete Membrey is available for interviews and can provide practical, age-by-age guidance for parents.
The research was conducted for the VPN Trust Initiative, an industry body co-founded by ExpressVPN. ExpressVPN also works with the Internet Watch Foundation to block access across its network to domains verified as hosting child sexual abuse material.
About ExpressVPN
ExpressVPN is a privacy and security company offering a VPN and a wider suite of privacy tools. It is a co-founding member of the VPN Trust Initiative.
Methodology
All survey figures, unless otherwise stated, are from YouGov Plc. The total sample consisted of 2,558 UK children aged 11 to 17 and a parent or guardian of each child. Fieldwork was conducted online between 5 and 22 June 2026. The figures were weighted and are representative of UK children aged 11 to 17 by age, gender, region, Index of Multiple Deprivation and ethnicity.
