School Photography and Data Privacy: What Parents Should Know

When you order school photos online, you're doing more than purchasing prints. You're sharing personal information — your name, email, address, payment details, and your child's photo — with a photography company that may have its own data practices, third-party relationships, and retention policies.

What Data School Photography Companies Collect

A typical online school photo order involves sharing:

• Your name and contact information
• Your child's name, grade, and school
• Payment information
• Your child's photograph (which the company already has from the school session)
• Your ordering preferences and history

Larger companies — particularly Lifetouch, which is owned by Shutterfly — may combine this data with information from their consumer photo products platforms, building a more comprehensive profile of your family.

FERPA and School Photo Data

The Family Educational Rights and Privacy Act (FERPA) governs how schools handle student records, including photos taken in an educational context. Under FERPA, schools must obtain parental consent before sharing student photos with third parties — including photography companies.

In practice, most schools obtain this consent through the enrollment process or through the photo order form itself. If you're concerned about how your child's photo data is being used, you can request to see the school's FERPA consent forms and data sharing agreements.

What to Look For in Privacy Policies

Before ordering school photos online, review the photography company's privacy policy. Key questions:

• How long is data retained? Some companies retain customer data indefinitely. Others have defined retention periods.
• Is data shared with third parties? Marketing partners, analytics providers, and affiliated companies are common third-party data recipients.
• Are children's photos used for any purpose other than fulfilling your order? This should be explicitly prohibited.
• What are your deletion rights? Under California law (CCPA) and other state privacy laws, you may have the right to request deletion of your data.

Practical Steps

Use a dedicated email address for school photo orders if you're concerned about marketing emails.

Review the privacy policy before creating an account with a photography company.

Request data deletion after your order is fulfilled if you don't plan to use the company again.

Ask your school what data sharing agreements they have with their photography vendor. You can also compare the baseline questions here with SmilePlease's privacy policy, data request process, and plain-language privacy promise.