These back-to-school social media privacy tips start with the account you already have, not a new tool to install. Before the first-day-of-school photo goes up, open your account settings and check who can actually see it. ITRC notes that once a family's social accounts are set to public, that information is available to anyone, not just the friends and relatives you had in mind.

A single photo may reveal little on its own. The safer habit, and the simplest way to avoid doxxing your child, is to stop sharing children's personal information online in bundles: a full name, school, grade, teacher, and location together form a usable profile that any single piece alone doesn't. Skip captions that stack a name, school, and teacher into one sentence, and leave the classroom door sign or the schedule taped to the fridge out of the frame.

While you're in there, scroll back through the last several months of posts, not just the newest one. Check photos where your child is tagged by other people; a grandparent's public album or a coach's team page can carry the same identifying combination you just cleaned off your own account. Old location tags are worth removing too, since a geotagged photo from a game or recital tells anyone exactly where your child spends a given afternoon.

That caution matters even when you trust the platform and the people you share with. SAIFCA's guidance, aimed at schools but just as useful for parents, points out that consent doesn't stop third parties from copying or misusing an image once it's publicly accessible; the group is direct about the fact that good intentions don't limit who can grab a public photo (SAIFCA). A private album, a family group chat, or a platform with follower approval will shrink the audience, though none of those settings make copying impossible. Treat them as harder locks, not unbreakable ones.

None of this requires abandoning social media. It requires treating "public" as a real setting rather than a formality you clicked past years ago. Review it before major posting periods, such as the start of school, when the flood of first-day photos makes it easy to skip the check entirely.

Your family's settings do not control what the school publishes. Depending on the district, that may include yearbooks, newsletters, sports rosters, or the school's own social accounts. In guidance published earlier this year, SAIFCA recommends that schools move away from posting identifiable student photos on public websites and social media, framing the shift as a response to a changed risk environment rather than a change in values around celebrating school life. That framing is useful when you decide how hard to push on the question.

SAIFCA suggests several lower-risk options schools can adopt instead of dropping photos altogether: action shots where faces aren't clearly identifiable, silhouettes or rear-facing images, password-protected galleries limited to parents, or secure internal platforms rather than open social media. Whether your child's school has actually adopted any of these isn't something the research documents, which is exactly why it's worth asking directly. The group also argues that publicly visible child images should count as a safeguarding issue, not simply a communications choice, language that's useful if you need to explain to an administrator why you're asking.

When you sign the photo-release form this year, read it before you sign it. Look at whether the consent box is opt-in or opt-out by default, whether it names any third-party vendors who might handle the images, and whether the consent expires or needs renewing each year rather than covering your child indefinitely. Then ask the school directly:

• Does it post identifiable photos publicly, or only to a secure, password-protected platform?
• Is there an opt-out that doesn't single out your child?
• Does it periodically review or remove older public images, or do they accumulate indefinitely?
• Who can download or reshare images from the platform, and how long does the school retain them?

A vague answer is useful information too. It tells you where the school's policy may need closer scrutiny.

Enrollment season also means handing over documents, and Social Security numbers are the ones worth slowing down for. When a school asks for your child's SSN, the FTC recommends asking:

• Why is the number needed?
• How will it be protected?
• Would a different identifier work just as well?
• Is providing only the last four digits sufficient?

These questions help you understand whether the number is necessary and how the school plans to protect it.

There's a real reason to be careful with school-held data beyond cautious form-filling. The 2024 breach of PowerSchool, a widely used school software platform, exposed personal records for more than 60 million students and teachers across thousands of districts, according to ITRC. That breach doesn't mean any individual school mishandled data; it means the vendors schools rely on deserve scrutiny too. Cyberattacks on school systems have more than doubled in recent years, per the same ITRC research, which is reason enough to ask what platform stores your child's records and who has access, not just whether the paper form itself looks secure.

In practice, that means giving the school only what the form requires, providing the last four digits of the SSN when that option exists, and asking one follow-up question about the vendor behind the scenes. It limits the amount of information you disclose and clarifies how the school handles what it collects.

Checking for, and if necessary freezing, a credit file is one of the clearest no-cost actions in this guide. ITRC calls a credit freeze one of the most effective free tools parents have right now, and the reasoning holds up: a child's Social Security number is, to a criminal, a blank slate, with no debt, no payment history, and no existing accounts to trigger a fraud alert. Because children rarely use credit themselves, misuse can go unnoticed for a long stretch. Children generally shouldn't receive financial mail at all; if any arrives addressed to your child, treat it as a sign worth acting on immediately.

Start by contacting the three major credit bureaus, Equifax, Experian, and TransUnion, to check whether your child already has a credit file. A child under 18 generally will not have a credit report, so finding one at all is itself the warning sign. If your child is under 16, the FTC confirms you can request a free credit freeze, which stays in place until you ask to remove it; 16- and 17-year-olds can request or remove their own. The process for a minor differs from a standard adult freeze, so ask each bureau specifically about its Protected Consumer Freeze process rather than assuming the adult procedure applies.

Keep a simple log as you go: the date you contacted each bureau, whether you called, mailed, or used an online form, and any confirmation or reference number they provide. If a bureau sends back a PIN or password tied to the freeze, store it somewhere you'll actually find again, since you'll need it to lift the freeze later for a legitimate credit application. That paper trail matters more than it seems like it should if you ever need to prove when protections went into place.

ITRC's own recovery guide points parents toward FrozenPii.com, a dedicated resource for freezing both a parent's and a child's credit, for more detail on each bureau's process; the same ITRC recovery article also covers what happens after a freeze is in place. A Protected Consumer Freeze keeps protecting a child's credit against new misuse while any existing problem is being sorted out, according to that ITRC guidance, so putting one in place now doesn't just prevent future fraud. It buys room to deal with anything that's already happened without the damage compounding.

If a credit check turns up a file for your child, treat it as a serious warning sign and investigate promptly rather than assuming the worst outright. The FTC recommends acting in sequence:

1. Contact all three bureaus and tell them someone opened an account using your child's information; ask them to remove any fraudulent accounts from the report.
2. Freeze your child's credit report at each bureau, if you haven't already.
3. File a report at IdentityTheft.gov, which can help create an official Identity Theft Report and walks you through documenting what happened.

If the fraud touched a tax filing, ITRC notes you may also need to contact the IRS Identity Protection Specialized Unit or file Form 14039, the Identity Theft Affidavit. Neither step is automatic; it depends on what the fraud actually involved.

After filing, expect a wait. Credit bureaus generally take about 30 days to investigate disputes, and ITRC recommends checking back within 30 to 60 days if you haven't received written confirmation that disputes and account closures are actually being processed. Full recovery can run anywhere from a few weeks to several months, depending on how much fraud occurred and how quickly each institution responds. That sequence, report, freeze, follow up, gives you a documented process for addressing the problem, which matters even when it doesn't move quickly.

The two risks in this guide come from different directions. ITRC, citing Javelin Strategy & Research, says roughly three in four child identity-theft cases involve someone the child already knows, a parent, relative, or other trusted adult, rather than a stranger. That is why a credit freeze and a public-post audit solve different problems: one closes off access inside the household, the other limits what's visible outside it.

Make the review part of your back-to-school routine. Check the audience for recent posts, ask the school how it handles images and Social Security numbers, and contact all three bureaus if you want to check for a child credit file. A freeze is free, but it can't undo information that has already been published or fraud that has already occurred. Doing the check now, before either problem has a chance to compound, is the whole point.