Posting Your Kids Online: The Real Risks

In January 2021, YouTuber Roman Atwood and his wife Brittney sat down in front of the camera to explain why one of YouTube's biggest family vlogs had gone almost silent for a year. Stalkers, they said. The stalkers had called in a bomb threat to a family funeral, cancelled the family's car insurance, cut the power to their house in the middle of winter and sent them pictures from their own home security system. The FBI was involved. Atwood said the only option left was to shut everything down and make sure our kids are safe.

The family was not short of physical security. In 2018 Atwood said they had armed police at their home around the clock after four years of swatting, and during the stalking, the couple said, police watched the house constantly. It made little difference, because almost nothing the stalkers did needed anyone at the front gate. It needed a phone line, an online account or a connected device.

That is the uncomfortable lesson for anyone whose family life is online, and above all for anyone with an audience: every post about your children adds to a file strangers can read. This guide reads the Atwood case the way a security team would, then covers the six concrete risks of posting children's photos, where the law stands as of October 2026, and what to do instead.

What happened to the Atwood family#

Atwood built his audience on prank videos and then on daily family vlogs. This timeline comes from the family's own videos and posts, as reported at the time:

In the January 2021 video, the couple described a campaign that went far beyond online abuse. By their account, the stalkers:

• Harassed them by phone around the clock and sent texts, Discord messages and voicemails threatening violence and death, even after the family changed their numbers and personal details several times.
• Called in a bomb threat to a family funeral.
• Got into the family's cars, switching them on and off, and set off the alarm in the house.
• Cut the power to the home in the middle of winter.
• Cancelled Atwood's car insurance, leaving him driving without cover, and changed the family's mailing address.
• Sent photos of the family to their phones, including pictures from their own home security system.

The couple said they spent days calling company after company to undo the damage, and the stalkers always seemed to be a step ahead. In the video, Atwood thanked the FBI but didn't name the people responsible or explain how they did it.

This isn't a story about a careless family. The Atwoods had armed guards, police outside and the FBI on the case. It's a story about what a public life exposes even when the physical security is excellent.

Read it like a security incident#

Strip out the celebrity and the case reads like an incident report. We don't know which route the stalkers used at each step, so treat the middle column as the usual way attacks like these work, not as a finding about this case.

The camera row isn't hypothetical. In 2023 the US Federal Trade Commission said attackers had used passwords leaked from other sites, plus automated guessing, to take over Ring camera accounts, reaching the videos and live feeds of about 55,000 US customers. Some used the cameras' two-way audio to harass and threaten people in their own homes, children included. Ring hadn't introduced multi-factor authentication until 2019, the FTC said, and the proposed settlement required it to pay $5.8 million and tighten its security (FTC).

Neither is the car row. Connected-car apps can track a car and start it from a phone. A 2023 New York Times investigation found abusive partners using them to stalk and harass victims, and in December 2024 New York passed a law requiring carmakers to cut off an abuser's remote access when a survivor asks (New York State Senate).

The thread running through every row is the same: each attack starts with a fact about the family. Where they live, what they drive, which security system they use, when the funeral is, whose name is on the insurance. A long-running public channel produces facts like these by the thousand, not through carelessness but because showing your life is the format. To an attacker, years of daily family video are years of free reconnaissance. And armed guards don't touch any of it. They protect a gate, not a password reset, a customer-service call or a camera app.

Why public figures and their children are targeted#

Fame changes the maths. An audience of millions doesn't need many bad actors in it to become a real problem, and the archive behind it can be searched, frame by frame, indefinitely.

• Kim Kardashian's robbers knew what to look for from her posts. The gang that tied her up in a Paris hotel in 2016 said they had seen her jewellery in her social media posts. A Paris court convicted eight of them in May 2025 (CBS News).
• Selfies were enough to find a pop idol's home. In 2019, Tokyo police charged a man with assaulting a singer he had allegedly tracked down by studying the scenery reflected in her eyes in her selfies and matching it to Google Street View (CBS News).
• Children's accounts draw the wrong audience. A 2024 New York Times investigation of some 5,000 parent-run Instagram accounts featuring young girls found that the bigger the accounts grew, the larger the share of men following them, and parents described spending hours a day blocking them (PBS NewsHour). An audience analysis for the Times counted 32 million connections to male followers (Online News Association).
• The platforms confirm the scale. In July 2025 Meta said it had removed nearly 135,000 Instagram accounts for leaving sexualised comments on, or requesting sexual images from, adult-managed accounts featuring children under 13, plus 500,000 linked accounts, and would hide such family accounts from adults it flags as suspicious (Meta).

You don't need millions of followers for this to apply. A coach with a public club page, a local business owner, a parent whose post went viral once: anyone with an audience they don't personally know is a public figure for these purposes.

The six risks of posting children's photos#

1) Photos give away places and routines#

A photo is rarely just a face. School logos and uniforms, house numbers, car plates, street signs, the view from a window, the club name on a sports kit: each narrows down where a child lives, learns or plays. Nominet warned back in 2016 that the yearly wave of first-day-at-school photos in new uniforms can give away a school's name and location (Nominet). The Japanese case shows how little it takes, and AI tools can now guess where a photo was taken in seconds, as covered in our doxxing guide.

Timing matters as much as place. A live post says where a child is right now; a regular one says where they'll be next Tuesday.

2) Children's details are identity-fraud material#

A name, a date of birth and an address are often all a fraudster needs, and plenty of parents post all three. In 2018 Barclays projected that parents' oversharing could cost the next generation £676 million a year by 2030 and lead to up to 7.4 million cases of online identity fraud. It also found parents routinely posting classic security-question answers, such as mother's maiden name, place of birth and first pet, and 30% using details like their children's names in their own passwords (Tech Monitor).

That's a projection, not a count, but the mechanism isn't in doubt. Javelin Strategy & Research found that 915,000 US children were victims of identity fraud in the year to July 2022, with under-sevens the most likely to be hit (Javelin). Because a child's credit file is blank, the fraud often goes unnoticed until they apply for a student loan or their first job (NBC Miami). Javelin also found that two in three affected households knew the perpetrator (AARP), so public posts are far from the only route. They're simply the one you control.

3) Innocent photos end up in the wrong collections#

As far back as 2015, Australia's Children's eSafety Commissioner reported that innocent photos first posted on social media and family blogs made up as much as half of the material on some paedophile image-sharing sites, usually alongside comments sexualising the children (Children and Media Australia). Nothing in those photos was explicit. They were ordinary family pictures, copied and re-filed by strangers.

The harm is now measurable. In September 2025, University of Southampton researchers published what they describe as the first study linking sharenting to children becoming victims of cybercrime. Of more than 1,000 UK parents surveyed, 45% actively shared about their children, and one in six said their child had already suffered a harm such as cyberbullying, harassment, identity theft or fraud, or contact from a stranger. The researchers also found that parents overestimate privacy settings: tagging and resharing can carry a "friends only" post to people the parent never chose (University of Southampton).

4) AI turns any clear photo into raw material#

A photo no longer has to be compromising to be dangerous. In June 2023 the FBI warned that criminals were turning ordinary photos and videos from social media, including those of minors, into sexually explicit fakes for harassment and sextortion, often without the victim knowing until someone else told them (FBI).

It has reached schools. In a 2025 Thorn survey of 1,200 young people aged 13 to 20, one in 17 said someone had made deepfake nudes of them, and one in eight knew someone who had been targeted (Thorn). Between January and March 2026, Australia's eSafety Commissioner received more than 100 reports of anonymous accounts targeting schools and staff with images lifted from school websites and social media, much of it turned into sexualised deepfakes, and in July told schools to review how they share photos (Human Rights Watch).

Your family's photos may already be training data, too. Human Rights Watch found links to 190 identifiable photos of Australian children in LAION-5B, a dataset used to train popular image generators. Some had been posted years earlier on personal blogs and video sites, some came with names, ages or a preschool's name in the caption or web address, and AI models can't simply unlearn them (Human Rights Watch).

Any sexualised image built from a photo of a real, identifiable child is treated as child sexual abuse material under US federal law, however it was made, as we explained in our post on the Anderegg ruling. The law can punish it afterwards. It can't stop the image being made.

5) A child's voice can be cloned too#

Video carries voices, and voices are now easy to copy. The FTC warns that a scammer needs only a short clip of a family member's voice, which can come from content posted online, and a voice-cloning program to stage a convincing emergency call asking for money (FTC). Every public video of your child talking is a sample.

6) The internet doesn't forget, and children never agreed#

Most of today's children were online before they could talk. A 2010 AVG survey found that 92% of US children had an online presence by the age of two, and almost a quarter of mothers had posted prenatal scans (Dark Reading). By 2016, UK parents were posting an average of 1,498 photos of a child by their fifth birthday, according to the same Nominet research.

Children mind more than their parents expect. In a 2016 University of Washington study of 249 parent-child pairs, children were twice as likely as their parents to say parents shouldn't post about them without permission (WHYY). And deleting a post later doesn't recall the copies: some of the photos in that AI dataset had been uploaded up to a decade before it existed. The child in today's photos will be a teenager, a job applicant and an adult with a searchable past that someone else wrote.

What the law says about children's photos#

Lawmakers are moving, but mostly on content that makes money from children and on the platforms themselves. Almost nowhere does the law stop a parent posting their own child on a personal account. As of October 2026:

Platforms help a little too. Google removes images of under-18s from its search results at the request of the child or a parent, unless they're newsworthy, though the image stays on the original site (Google). NCMEC's free Take It Down service lets anyone with nude, partially nude or sexually explicit images of themselves from before they turned 18 create a digital fingerprint on their own device, so participating platforms can find and remove copies without anyone seeing the image.

How to share family life without exposing your children#

None of this means never sharing a photo of your child. It means treating every image as something that may end up public, permanent and in the wrong hands. In rough order of impact:

1) Share privately by default, and assume private leaks#

Use a private shared album or an end-to-end encrypted family group limited to people you actually know, not a public profile. Then assume it can still leak: tags and reshares travel, anyone in the group can take a screenshot, and Human Rights Watch found photos in AI training data that families had shared with limited visibility.

2) Show the moment, not the face#

Backs of heads, hands, silhouettes or a sticker over the face tell the story without feeding your child's face to every face-search engine and AI tool. Mark Zuckerberg covered his older daughters' faces with emojis in a 2023 family photo, and celebrities from Kristen Bell to Orlando Bloom have long blurred or covered their children's faces (CNN). Ireland's Data Protection Commission gives parents the same advice (DPC). And never put a child's full name, birthday and school in one place.

3) Check the frame and the file, then post later#

Before posting, look past your child at everything else in the picture: house numbers, street signs, car plates, school logos, club names, distinctive views, even reflections in windows and sunglasses. Turn off location tagging in your camera and strip location when you share, as covered step by step in our doxxing guide. Then wait: share the holiday once you're home and the match once it's over, and don't advertise routines or private events in advance.

4) Leave out what you wouldn't want seen at 16#

Skip bath, nappy, swimwear and changing photos entirely, along with tantrums, medical details and anything embarrassing. A useful test: would your child be comfortable with a classmate, a future employer or a stranger seeing this?

5) Ask your children#

Once they're old enough to understand, ask before you post and respect a no. France now writes that principle into law, and asking teaches children the habit they'll need for their own accounts.

6) Lock down the accounts around your family#

The Atwood case shows that photos are only half the exposure. Use passkeys on your email, cloud photo library, social accounts, home cameras and car app wherever they're offered, an authenticator app where they aren't, and a unique password everywhere; don't rely on SMS codes. Our password and passkey guide walks through the setup. Review who can access shared cameras and the car app, and set a PIN or verbal password with your mobile carrier, energy supplier, insurer and alarm company. Keep indoor cameras out of bedrooms and bathrooms, and check a camera's security before you buy it; the EU's Cyber Resilience Act is starting to raise the minimum for smart devices.

7) Agree a family safe word#

Pick a word or phrase only your family knows, never post it, and ask for it on any call claiming a family emergency. If the caller can't give it, hang up and call back on a number you already have.

8) Protect their identity early#

Don't use children's names or birthdays in passwords, and give security questions random answers stored in your password manager. In the US, you can freeze a child's credit file with each of the three credit bureaus, even if nothing has leaked yet.

9) Clean up what's already out there#

Archive or delete old posts that fail the tests above, and ask grandparents, schools and clubs to do the same with photos of your children. Use Google's removal request for images of minors, GDPR erasure requests in the EU and UK, and Take It Down for anything explicit. Report sexualised comments on any child's photo rather than just deleting them.

Extra steps for creators and public figures#

If you have an audience, assume a small part of it is hostile and patient, and run your family's privacy like a security programme:

• Separate the persona from the family. Keep children's faces and names out of content, along with the recognisable outside of your home, your car plates and local landmarks.
• Keep the address unknowable. Opt out of data brokers, use a registered office or PO box for business, and when you move, don't show where. The Atwoods' new-home video gave away neither the location nor a full tour, which was the right call.
• Put a second pair of eyes on every upload. Someone who didn't film it should check backgrounds, reflections and audio before it goes live, and nothing should go out in real time.
• Plan for swatting before it happens. Targeted creators often stay in contact with their local police, so a hoax call about their address meets some suspicion (Dexerto).
• Secure your team, not just yourself. Editors, assistants and managers with access to raw footage or your accounts need their own passkeys, only the access their job requires, and prompt removal when they leave.
• Write the incident plan now. The Atwoods spent days on the phone undoing the damage. An up-to-date list of every account and provider, with recovery details stored offline, turns days into hours.
• Know the rules for paid content. If children appear in content you earn from, US state laws may require set-aside earnings and deletion on request, and Instagram already bars accounts that mainly feature children from offering subscriptions or receiving gifts.

Summary#

1. The Atwood case is a security story. Almost everything the stalkers did came through phones, accounts and connected devices, past armed guards and police.
2. Every public post about a child is reconnaissance: places, routines, names and birthdays that strangers can piece together.
3. Children's details feed identity fraud that may not surface until their first loan or job application.
4. Innocent photos get harvested and sexualised, and AI now turns ordinary photos and voice clips into deepfakes, sextortion and scam calls.
5. The law mostly covers money and platforms, not your feed. France is the exception for everyday posting.
6. If you share, share privately: no faces, nothing that locates your child, posted after the fact and with their agreement.
7. Secure the accounts around your family with passkeys and PINs, agree a family safe word, and freeze your child's credit where you can.

---

Are you a creator, executive or public figure whose family appears online? Get in touch - bluwarden can review what your public content and accounts reveal about your home and children, and help you close the gaps before someone else maps them.

This article is general privacy and security guidance, not legal advice. Laws on children's images and online content differ between countries and states and change quickly, so check what applies where you live. Our account of the Atwood case is based on the family's own public statements as reported in the press.