Social media policy for a nursery

The rule: EYFS paragraph 3.6 and the law on images

No law requires a document called a social media policy, but the EYFS statutory framework for group and school-based providers, effective from September 2026, requires its core. Paragraph 3.5 says providers “must have and implement policies and procedures to keep children safe and meet EYFS requirements”, recorded in writing and “in line with the guidance and procedures of the relevant Local Safeguarding Partners”. Paragraph 3.6 lists what safeguarding policies must include, and one of the five items is “how mobile phones, cameras and other electronic devices with imaging and sharing capabilities are used in the setting”. The childminder framework makes the same requirement in paragraph 3.7; childminders “solely registered on the early years register or with an early years CMA” need not write their policies down but “must be able to explain” them to parents, Ofsted and others.

The framework’s criteria for safeguarding training, in Annex C, name the risk directly: staff must be trained to spot “inappropriate behaviour from practitioners, or any other person working with the children”, which “could include inappropriate sexual comments; excessive one-to-one attention beyond what is required through their role; or inappropriate sharing of images”.

Photographs and videos of identifiable children are personal data. When a setting takes or publishes them for its own purposes, UK data protection law applies; when a parent films the nativity for the family, it usually does not. The ICO’s page on taking photos in schools, whose principles apply to nurseries too, draws the line: “data protection law doesn’t apply to the use of personal data for ‘purely personal or household activity’”, but “data protection law is likely to apply if photos or videos are taken for official school use, such as for inclusion in a prospectus or other promotional material”. The ICO notes that, because of the Data (Use and Access) Act 2025, this guidance “is under review and may be subject to change”; check the page date.

What a nursery social media policy covers

Most settings combine the mobile phone and camera policy that paragraph 3.6 requires with the social media rules, because they are about the same images and the same devices. A policy that does its job covers five things:

1. Devices in the setting – which devices may take images of children (setting-owned only, never personal phones or social media sites), where staff, students, volunteers and visitors keep personal phones during sessions, and when and where they may use them. Our personal mobile phone policy guide covers the staff side in detail.
2. The setting’s own social media pages – who may post, what may be posted, consent, and how comments and messages are handled.
3. Staff, students and volunteers in their own lives – what they may post about work, and their online relationships with families.
4. Parents and visitors – photos at events, posts about other people’s children, and concerns raised online.
5. Responding when something goes wrong – an image posted without consent, a staff post about a child, a hostile comment about the setting – with the route into the safeguarding, allegations or complaints procedure.

Its purpose is to safeguard children first and protect staff second. Write it for the people who will use it: a new apprentice on their first day, a parent at enrolment, a student on placement. Share it with parents when a child starts, as the UK Council for Internet Safety’s early years guidance suggests policies should be “easily accessible to staff and parents/carers, for example, published on the setting’s website”.

The setting’s own pages and photographs of children

Decide the lawful basis before the first post. The ICO says the organisation “will also need to have a valid reason to publish photos or videos”; consent is one lawful basis, but “it will not be appropriate to rely on consent in all circumstances”, and whichever is used, the ICO recommends allowing an opt-out and telling parents at the outset how images will be used. NSPCC Learning’s guidance on photographing and filming children recommends written parental consent for under-16s before images are taken, used or shared, a record of that consent, and new consent or deletion if images are to be used for a different purpose. Settings usually collect this at enrolment, with a separate tick for each use: the learning journal, displays inside the setting, the website and social media.

Then set rules for what goes online. The NSPCC’s list is a practical checklist for any post:

• “don’t supply names of children along with the images”, and avoid any other identifying information;
• choose images that “focus on the activity rather than the child”, taken from a distance, and of children in appropriate clothing;
• “ensure location data and other image metadata have been removed before uploading images”, and consider reducing the resolution;
• review the photo and video content on the setting’s pages regularly, and check the privacy settings; and
• consider whether an image of a child is needed at all, or whether an illustration or a non-identifiable photograph would do.

Some families will say no for reasons the setting will never be told: a child in care, an adoption, a parent escaping abuse. The NSPCC notes that “if a child and/or their family have experienced abuse, they may worry about images of the child being shared online, enabling the person who perpetrated the abuse to trace their whereabouts”. The policy should say that children without consent are never excluded from activities, and how staff know who they are.

Name the member of staff who may post and approve posts – usually the manager or a named deputy – and who reads and answers comments and direct messages on the page. A message from a parent through the page is still a message to the setting: a complaint received there goes into the complaints procedure, and a safeguarding concern into the safeguarding procedure, not a reply thread.

Staff, students and volunteers in their own lives

The fullest official source for early years staff is the UK Council for Internet Safety’s online safety guidance for early years practitioners. It was published in February 2019, so some of its references are dated, but its rules on social media are plain and still widely used:

• “You should not add parents of children at your setting as friends online; this can blur professional relationships and put you at risk of allegations.” Where a relationship already exists, it should be discussed with the designated safeguarding lead or manager.
• “Do not give out your personal contact details to children or parents/carers; professional communication should always be through a work provided email, setting-approved digital platform or phone number.”
• If the setting uses social media with parents, staff follow its policy, “such as not sharing photos without consent or using your own personal devices to share content on behalf of the setting”.
• “Posting derogatory comments is never acceptable”, and “disciplinary or legal action could be taken if you post something online which brings the profession or your setting into disrepute.”
• Concerns seen online go to the DSL; “if you are concerned about content posted by a colleague, follow your setting’s allegations policy.”

A nursery policy usually adds three rules of its own: no images of children on personal devices or personal accounts, ever; no naming the setting, children or families in personal posts about work; and no discussing children, parents or colleagues in personal messaging groups. The last is the one most often broken in good faith, because the staff group chat is where a team organises its day. The staff code of conduct, the induction checklist and the disciplinary procedure should all refer to the policy, so that every member of staff is aware of it and a breach is handled consistently.

Parents, events and posts about the setting

Parents filming their own child at a setting event are usually outside data protection law: the ICO’s example is that grandparents filming a school nativity play are taking images “for personal use and the law does not apply”. But a setting can still set rules. The ICO says schools “may have their own policies, separate from data protection law, on whether or not they allow parents or guardians to take photos or videos”, for example for safeguarding reasons, and NSPCC Learning recommends a photography and filming policy statement shared with parents before an event.

The ICO also distinguishes where images end up: posting to “your private social media account, only viewable by friends or family, … is likely to fall within the definition of personal use”, while posting to “a public account, viewable by an indefinite number of people” is likely to go beyond it. A nursery policy commonly asks parents to photograph only their own child at events, or not to post images of other children online, and explains why, given the families who cannot be identified. Tell parents what the rule is at enrolment and before each event; it is a request backed by explanation, not something the setting can enforce in a parent’s home.

Parent group chats and parents’ posts about the setting are the parents’ own. The policy can say how the setting responds: a concern or complaint posted online is invited into the complaints procedure, a post that identifies a child at risk goes to the DSL, and staff do not reply from personal accounts. The UKCIS guidance asks staff to report concerning content, “such as comments posted by a parent”, to the DSL.

The photos that never reach the setting’s tablet

Most nursery policies are strict about cameras and lenient, by omission, about messages. The setting tablet is locked in the office at night, its photographs go to the learning journal, and personal phones live in lockers. Then the day happens in messages.

The baby room leader asks in the staff group whether anyone has a photo of the sensory tray for the newsletter; a colleague who took one on the setting tablet forwards it from her own phone, with three children’s faces in it. A parent texts the key person’s personal number on a Saturday to ask whether her son was the child bitten on Friday, and the reply – the setting’s first response to what may become a complaint – is sent from the same phone. The deputy posts in the staff group that a family has asked for no photographs because of a court order, so everyone knows. Each is a message that the photo policy, the complaints procedure or the safeguarding procedure says should be handled in a particular way, and each sits on personal phones in an app the setting does not control, readable by everyone in the group, including staff who have since left.

The policy can forbid images on personal devices; it cannot make a group chat behave like the setting’s records. A question for the next owners’, managers’ or committee meeting: if Ofsted or a parent asked where every photograph of a child taken this week now exists, could the setting answer from systems it controls?

Questions people ask

What should a nursery social media policy include?

A nursery social media policy should cover how phones, cameras and other devices are used in the setting (which the EYFS requires in the safeguarding policy, paragraph 3.6), who runs the setting’s own pages and what they may post, photo consent and its record, staff conduct on personal accounts, rules for parents at events, and how breaches and online concerns are handled.

Can nursery staff be friends with parents on Facebook?

The UK Council for Internet Safety’s guidance for early years practitioners says staff “should not add parents of children at your setting as friends online”, because it can blur professional relationships and put staff at risk of allegations. Where a friendship existed before, the guidance says to discuss it with the designated safeguarding lead or manager.

Does a nursery need consent to post photos of children on social media?

A nursery needs a valid lawful basis to publish photographs of children, and must tell parents how images will be used; the ICO says consent is one possible basis but not always the right one, and recommends offering an opt-out whichever basis is used. NSPCC Learning recommends parental consent before photographing or filming children under 16, consent to share recorded on a written consent form, and new consent, or deletion of the images, if they will no longer be used for the original purpose.

Can parents take photos at nursery events?

Data protection law does not usually stop parents taking photos or videos of their own child at a nursery event for personal use, according to the ICO. A setting can still have its own rules for safeguarding reasons, such as asking parents not to post images of other children online, and should share them before the event.

Can nursery staff have their mobile phones at work?

The EYFS does not ban staff phones, but every nursery’s safeguarding policy must set out how mobile phones, cameras and other devices with imaging and sharing capabilities are used in the setting (paragraph 3.6 of the group and school-based framework). Many settings require personal phones to be stored away from children during sessions and forbid their use for photographs of children.

Official guidance and your next step

The primary sources are the EYFS statutory frameworks effective from September 2026 (paragraphs 3.5 and 3.6 and Annex C of the group and school-based framework; paragraph 3.7 of the childminder framework), the UKCIS early years online safety guidance for practitioners and its companion for managers, the ICO’s data protection tips for early years settings and its page on photographs, and NSPCC Learning’s photography guidance with its example policy statement and consent form. Your local safeguarding partnership may publish its own model.

This guide is a summary for early years providers in England, not legal advice.

Then do one thing: walk round the setting during a session and list every device that could take a picture of a child – setting tablets, staff phones, visitors’ phones, smart watches – and check the policy says what happens to each. Anything not on the list is the first thing to add.