Is it safe to upload a child’s photo to an AI book maker? A privacy checklist

What are the real risks of sharing a child’s photo with an AI service?

The main risks are the photo being kept longer than needed, passed to providers you don’t know about, reused for advertising or model training, or exposed in a data breach. Hidden location data in the file can also reveal where your child lives or plays.

The CNIL, France’s data protection authority, warns that children’s photos shared online can be copied or manipulated with AI, and that metadata can reveal places and times. Uploading a photo for a personalised book is not a public post, but the rule holds: share as little as possible, with as few parties as possible, for as short a time as possible.

What should you check before uploading?

Check who processes the photo, which third parties receive it, how long it is kept, when it is deleted, whether it may be used in ads, sold or used to train AI, and how to exercise your rights. If the policy is silent, ask before uploading.

Vague wording such as “we may share data with partners”, with no names or purposes, is a reason to ask or to choose another service. See also how to choose a personalised book.

Who should give consent to upload a child’s photo?

A parent or legal guardian, or someone they have clearly authorised. Where parents share responsibility, agree together, and involve the child in the decision as far as their age and maturity allow.

Laws differ but point the same way. Brazil’s LGPD (art. 14) requires children’s data to be processed in their best interest and, when based on consent, with specific consent from at least one parent or guardian. Spain requires parental consent for under-14s when processing relies on consent. In France, a 2024 law says parents protect their child’s image rights jointly and involve the child according to age and maturity.

Which photo should you choose?

A recent, sharp photo of your child alone, front-facing with the face clearly visible, against a plain background. Leave out anything that shows where they live or study: school uniform, name tags, house numbers, street signs or recognisable landmarks.

• Face front-on, eyes open, good daylight, no filters.
• Only your child in the frame: no siblings, friends or classmates.
• No school logo, club kit or badge with a name.
• No visible address, number plate or local landmark.
• Everyday clothes; never bath or swimwear photos.
• Crop to head and shoulders: less context, less to reveal.

How do you remove location data from a photo?

Phone photos often carry EXIF metadata such as GPS coordinates and the date taken. Remove the location before uploading, using your phone’s sharing options or your computer’s file properties, then check the file’s details to confirm it has gone.

• Phone: many share menus can leave out location; you can also turn off location for the camera for future photos.
• Windows: right-click the file → Properties → Details → “Remove Properties and Personal Information”.
• Mac: open the photo in Preview, show the Inspector and use “Remove Location Info”.

Which privacy laws protect children’s photos?

In the EU, the GDPR; in the UK, the UK GDPR; in Brazil, the LGPD alongside the Statute of the Child and Adolescent (ECA); in the US, COPPA, for children under 13. All treat children’s data with extra care, but their scope differs.

What rights do you have over your child’s photo?

Under the GDPR, UK GDPR and LGPD you can usually ask to see the data held, correct it, have it deleted and withdraw consent. Write to the contact named in the privacy policy and keep a copy of your request.

• Access: what data is held, why, and who received it.
• Correction: a misspelt name or wrong age, for example.
• Erasure: the photo and anything derived from it.
• Complaint: if there is no answer, contact your data protection authority.

In the UK, the ICO says organisations normally have one calendar month to respond to an erasure request.

How does Heroica handle the photo?

Heroica stores the original photo privately and sends it temporarily to its image-generation provider, KIE AI. We keep the original during production and for seven days after delivery or revision completion, with access restricted to authorized support staff. The photo is not sold or used in advertising, and you can request access, correction or deletion.

• The original goes to KIE AI to create the character sheet; it is kept during production and for seven days after delivery or revision completion, and the other pages are drawn from the sheet, not the photo.
• Unpaid requests are cleaned up seven days after upload; deletion is suspended while a revision is open.
• The photo is not sold or used in advertising.
• Whoever uploads must confirm they are the child’s guardian or have authorisation.

For anything not listed here, such as questions about AI training, read the privacy policy or write to the team before uploading. To see how the photo becomes illustrations, read how AI personalised books work.

Frequently asked questions