Practical measures for photographs you share online, ordered by how much they actually change, and honest about which are close to useless. A companion to a longer argument about what retained images are worth to the systems that keep them.
The measures are not equal
Most advice on this subject arrives as an unordered list, which leaves you spending the same effort on the hardest measure and the least effective one. Covering a face with a sticker sits beside not posting at all, as though they were comparable. They are not, and the ordering is most of the value.
This assumes you have already read, or will take on trust, the longer argument: that an uploaded photograph is retained rather than consumed, and that the file outlives the decision to share it by considerably longer than anyone imagines at the time.
What actually changes the exposure
Not posting it. The only complete measure. Most people will not take it, for reasons that are neither foolish nor weak, and the rest of this list exists because of that.
Posting to a closed group rather than a public profile. This limits the human audience to people you invited. It does not limit the platform, which holds the file either way and processes it either way. You are restricting who can see it, not who has it. That is still worth doing — most of the ordinary harms of a shared photograph are human ones — provided you are clear about which half of the problem you have addressed.
Not naming the child, and not tagging them. A name attached to a face is what converts an image into a linkable record. Without it, a photograph is one unlabelled example among billions. With it, the face is joined to an identity, and every later photograph of the same face joins the same record. Of the measures that cost almost nothing, this is the one that changes the most.
Faces turned away, partly obscured, or at an angle. Crude, unfashionable, and more effective than most of what gets recommended in its place. Recognition depends on a consistent view of a face's geometry; a face in three-quarter profile, in shadow, or half behind a cake is a poorer example for that purpose.
For what you keep rather than what you share, use storage the provider cannot read. This does nothing for photographs already posted publicly. It does mean the archive — the thousands of images you never shared — is not a second copy sitting somewhere readable.
What helps a little
Stripping location metadata. Reasonable, and less useful than its reputation. Many platforms strip it on upload, so you may be repeating work already done, and it does nothing about a recognisable background. A school gate is a location whether or not the file says so.
Delaying the post. A photograph published three months late is a weaker signal about where someone is now. It costs nothing but immediacy, which is the whole appeal, which is why it is rarely done.
What is close to useless, and why people do it anyway
Each of these is a sound instinct attached to a measure that does not deliver it.
An emoji or sticker over a face. The instinct — hide the face — is exactly right. But the platform received the original at upload, before you covered anything, and the covering is a display decision made afterwards.
Tightening privacy settings later. The instinct is to correct a mistake. The file has been held since it arrived; the setting governs who can see it from now on, not what was already taken from it.
"Please do not share" in the caption. A social request, and it works on the people it addresses, which is worth something. It is not a technical control, and it says nothing to anything automated.
Deleting it years later. The most widely held misconception, and the most understandable. Deletion governs display. It does not reach back through whatever was derived from the image in the years it was available — and derived material does not look like the photograph, so removing the photograph does not remove it.
The asymmetry with children
Three things make this sharper for a child than for an adult, and they compound.
The adult consented and the child did not. That is the obvious one and the least interesting, because consent to a photograph is not really the issue — consent to a permanent record is, and nobody is asked for that.
The adult's face is largely settled. A child's is a series through exactly the years in which a face changes most, which makes a decade of a child's photographs a far richer example than a decade of an adult's.
And the adult can revise the decision. They can stop posting, change what they share, decide they were wrong at twenty-five. A child arrives at the age of making their own decisions to find the significant ones already made, by someone who loved them and was not thinking about this.
A realistic position
The aim is not privacy. Privacy in the sense people mean it — nobody holds a record of my family — has not been available for some time, and advice written as though it were leaves people feeling that since they cannot have all of it they may as well take none of it.
The aim is a smaller permanent record. That is achievable, and it responds to effort.
Decide once rather than per post, because per-post decisions are made while tired, pleased and in a hurry, and they go the same way every time. Keep two or three rules firm rather than ten aspirational: no names, no faces, nothing that shows where. Accept that you will break them occasionally, and that a rule broken occasionally still does most of its work.
And do not try to be the only parent who never sends a photograph. You will not sustain it, and the version of this you can sustain for fifteen years is worth more than the version you abandon in three months.