Uma Prasai was scrolling through TikTok one evening when she paused on a video featuring her son. He was in a swimming pool, and the camera followed him closely, while music blared in the background. He appeared distressed, pulling away from whoever was filming and trying to get out of frame. The comments underneath were about his behaviour rather than his discomfort. Prasai’s son is autistic. She had never given anyone permission to film him.

She did not learn about the video from his school. She learned about it from the internet, the way a stranger might.

The footage had started from a class group chat, where teachers regularly shared photos and videos from school activities. From there, another parent had downloaded it, added music, and posted it publicly — without consulting Prasai, the teacher who filmed it, or anyone else.

Across Kathmandu, parents and child rights advocates say this is not an isolated lapse but a routine practice, one that schools have normalised for years and that artificial intelligence (AI) is now making far more dangerous, turning a casual classroom photo into raw material that can be copied, manipulated, and misused well beyond whoever first shared it.

For Prasai, the experience was deeply unsettling. She said, ‘‘In the video, one can see my child is aggressive and does not want to be in the picture.’’

At first, she did not think much of it. Photos of student activities had become routine, what she calls a ‘‘new normal’’ in Nepali schools, and her son’s classroom already had CCTV cameras so that she could review his day if needed. However, the school had never asked for her permission to publish photographs or videos of him, not at admission, not verbally, not at any point since.

It was only after the TikTok video circulated that she raised the issue directly with her son’s class teacher, asking that he not be photographed unless he gave his consent. The school agreed, but only for her child. Other students in the same classroom continue to be filmed and photographed without any such arrangement, and Prasai said many of the parents have not objected. Some, she says, are comfortable with their children appearing in school posts and videos.

“I feel like I am in a minority,’’ she said. ‘‘But autistic or not, the children’s pictures should not be shared without the individual’s consent, or that of their parents.’’

Her proposed fix is simple: if schools can send payment notices home through students, they can send consent forms the same way.

Her experience is not unusual. Across Kathmandu, parents describe a similar pattern: schools photographing and filming nearly every activity: swimming, eating, dancing, sports day, and circulating the material through class group chats, school Facebook pages, and prospectuses, often without ever asking.

For Shilpa Dhakal, who is the parent of a seven-year-old boy and a thirteen-year-old girl, the discomfort has built gradually, through smaller frictions rather than one viral moment. Her objections began not with the school’s own posts but with other parents. They shared exam results without permission, and children’s grades became visible to the wrong audience. She has also pushed back on what she sees as a more subtle harm: the unevenness of which of the children get photographed and praised online, and which do not.

‘‘When one child does something well but their picture isn’t posted while another friend’s picture is posted repeatedly—that is problematic,’’ Dhakal said. ‘‘Children like to compare.’’ She said her own children have noticed the pattern, sometimes asking why a classmate’s photos appear again and again while theirs do not.

Dhakal credits her son’s school with being unusually responsive to her concerns, including over the unsupervised posting of exam results. But she is careful to note that this responsiveness is not common. ‘‘It’s usually the vocal parents who are heard,’’ she said. ‘‘The quiet ones are not.’’

Consent for photography itself, she said, was never formalised. It was simply understood, verbally, until the practice became so normalised that parents now expect it. ‘‘Before, parents used to complain if their child’s photo wasn’t posted,’’ she said.

Her sharpest concern is more specific: older children, particularly girls, photographed in swimwear at the pool, with those images posted to the school’s public Facebook page. ‘‘There are privacy concerns, and there is a risk of misuse of such photos,’’ she said.

Children are highly attuned to patterns of inclusion and exclusion, said Pallawi Ghimire, a psychologist. A child’s sense of self is shaped by how others view and treat them, and when a child is repeatedly left out of photographs being shared, the message can be internalised long before they have the language to articulate it.

“They may internalise messages like, ‘I am less important’ or ‘I am not worthy of being seen,’” Ghimire said. A single instance may not register. But a repeated pattern, she said, can destroy a child’s self-esteem and social identity, a feeling that intensifies with age as peer comparison and self-consciousness take on added weight.

The capacity to meaningfully consent develops gradually, Ghimire said. Preschool-age children can express a preference, but do not yet grasp the long-term consequences of having their image shared. By age twelve, most children understand the implications for their reputation and privacy. That does not mean younger children’s preferences should be disregarded: even a simple question — ‘‘Are you comfortable with this photo being shared?’’ — builds a child's sense of bodily autonomy and trust in adults, Ghimire said.

The risk is more acute for children like Prasai’s son, who is autistic.

Neurodivergent children often struggle to navigate social stigma, and emotional responses during moments of distress are easily misread by those filming. ‘‘Recording or sharing moments of emotional dysregulation can lead to humiliation, shame, and public mockery,’’ the psychologist said, raising the risk that a child will be targeted by classmates or others online.

The cumulative effect of years of undocumented consent is a digital footprint a child did not choose and may not discover until adolescence, when it can surface alongside questions of reputation and self-presentation the child never had a say in, says Ghimire.

Photos of rows of students in uniform during morning assembly, children receiving prizes on stage, and snapshots from field trips have become a standard part of how schools communicate with parents and promote school activities. But such images often contain far more information than schools may realise: faces, uniforms, school logos, location details, and sometimes name tags, all of which can make a child identifiable. Once posted, they can be copied, downloaded, altered, and redistributed without the knowledge of school administrators, parents, or the children themselves.

While Nepal has taken some steps to protect children online, experts say awareness and enforcement remain weak.

The Ministry of Women, Children, Gender and Sexual Minorities, and Social Security approved the Online Child Protection Procedure, 2021, under the Children’s Act. The procedure bars schools from collecting and uploading children’s photographs and personal details without obtaining prior consent from guardians. It also encourages schools to educate children on online abuse and reporting mechanisms.

Anil Raghuvanshi, founder of ChildSafeNet, an organisation that works to combat online sexual exploitation and abuse of children, said schools have a responsibility to protect children in digital spaces as well as physical ones.

Even group photographs, often considered relatively harmless, can present risks. They may include children whose identities require additional protection, including survivors of abuse, children involved in custody disputes, or those facing other safety concerns.

“Schools must understand that public photos are global, searchable, downloadable, and often permanent,” Raghuvanshi said. “A school noticeboard and a public Facebook account are not the same.”

The rise of AI technologies has intensified those concerns.

Recent cases abroad have shown how images taken from school websites and social media accounts can be repurposed using AI tools. According to the Internet Watch Foundation (IWF), a school in the United Kingdom was targeted by criminals who allegedly scraped photographs of students from publicly available sources and used AI tools to generate child sexual abuse material. The perpetrators then attempted to extort the school by threatening to publish the manipulated images online unless they were paid.

The IWF subsequently identified around 150 images linked to the incident that met the legal definition of child sexual abuse material under UK law. The organisation then used digital fingerprinting technology to help prevent the images from being shared online.

For child protection advocates, the incident highlights how rapidly evolving technologies, such as deepfakes and generative AI, have changed the nature of online risks.

Experts warn that AI can combine publicly available images with information such as school names, event details, and locations to create detailed profiles of children, potentially increasing risks of grooming, harassment, fraud, and exploitation.

The developments have also raised questions about whether Nepal’s legal framework is equipped to address emerging threats.

At present, the Constitution of Nepal recognises privacy as a fundamental right, while the Privacy Act and the Children’s Act contain provisions on personal information and the protection of children. However, experts say the country lacks clear and enforceable child-specific guidelines governing how schools photograph, store, and share children’s images online.

Raju Ghimire, general secretary of Children as Zones of Peace, an organization working to protect children’s rights, said existing protections have big gaps.

“Nepal’s laws protect children from online abuse and exploitation, but not fully,” Ghimire said. “Stronger child-specific cyber safety legislation, improved enforcement capacity and better digital literacy would help. So would parent education, and enhanced cooperation with technology companies.”

Not every school treats consent as an afterthought. At Kathmandu World School, the process is built into admission and renewed annually, said Shirish Ratna Tuladhar, a Chief Branding, Partnerships & Strategic Officer there. Parents are informed about how photographs, videos and student work may be used for educational, communication and promotional purposes, and the school reaches out separately for activities that call for additional permission.

The shift was not prompted by any single complaint or incident, Tuladhar said, but grew out of routine policy review and an effort to align with international child-safeguarding practices. ‘‘We believe educational institutions have a responsibility to anticipate evolving expectations around privacy and child protection,’’ he said. ‘‘Rather than waiting for concerns to arise, we prefer to establish clear and transparent practices from the outset.’’

When a parent withholds consent, Tuladhar said, the child is not excluded from school life. ‘‘Our focus is always on inclusion,’’ he said. ‘‘It simply means exercising care and professionalism in how documentation and communication are handled.’’

He said the policy does not require new staffing or systems and has largely been absorbed into existing administrative routines. Nor has it created the friction some principles might expect, he said: ‘‘Having clear expectations actually reduces misunderstandings.’’ His advice to schools that view consent processes as a hassle is to see them instead as a way to build trust. ‘‘At the end of the day, schools are entrusted with the care and well-being of children,’’ he said. ‘‘Respecting family preferences and maintaining transparency are simply extensions of that trust.’’

Experts further recommend that schools adopt a principle of data-minimisation practices by asking whether photographs need to be shared publicly at all. Alternatives could include using private communication channels, blurring images, taking photos from behind, using artwork, or taking group shots that do not clearly identify individual children.

They also urge schools to avoid publishing full names alongside photographs, disable location tagging, moderate comments, regularly review old posts, and promptly remove images upon request.

“Children’s achievements should be celebrated,” Raghuvanshi said. “But never at the expense of their privacy, dignity, safety, or future well-being.”