Plenty of small businesses post photos that include children. A soft-play café, a swimming teacher, a children's hairdresser, a family event. The image is warm, the parents were pleased on the day, and it goes up on the page. The problem is not the posting. It is that “we asked at the time” is a memory, not a record, and a memory does not stand up when someone changes their mind.

Under data protection law a photo of an identifiable child is personal data, and you need a lawful basis to use it. For marketing that basis is usually consent, and consent has to be freely given, specific and, crucially, recorded. A verbal “yeah, that's fine” in a busy room is honestly worth very little six months later when a parent emails asking why their child is still on your homepage.

The part people forget is deletion. If a parent asks you to remove an image, you have to be able to find it and take it down, across your website, your social pages and anywhere it has been reshared by your own accounts. That is far easier if you kept a simple list of what you posted and who consented, and far harder if you did not.

The fix is unglamorous but light. Use a short written consent - a form, or even a dated message thread - that names the child, the parent, and where the image may appear. Keep it somewhere you can search. When someone withdraws consent, act on it promptly and note that you did.

For a sole trader this can be one folder and one template. For a growing business it is worth making it part of how you take bookings, so consent is captured once and the awkward conversation never happens. Either way, the aim is simple: be able to prove what you were told, and be able to undo it when asked.