Is It Illegal To Record a Child Without Permission in the UK?

If your business operates in the UK and ever interacts with children, you may find yourself taking photographs, using CCTV, recording video, livestreaming events, or capturing audio. This happens in shops, gyms, schools, clinics, online platforms, sports clubs, tutoring services, childcare settings and even at community events.

But when children appear in recordings, the legal obligations can become more complex. Business owners often worry about whether they need permission, what counts as consent, or whether they could be breaching privacy rules without realising it. This guide explains the law in clear English so you know what is (and isn’t) allowed, and what steps you should take to protect your business.

Is it illegal to record a child without permission?

There is no single rule that makes it automatically illegal to record a child in all circumstances. The legality depends on the context, the purpose of the recording, whether the child is identifiable, and the type of environment in which the recording takes place.

For businesses, most situations will fall under UK data protection law. If a recording identifies a child – whether through their face, voice or other characteristics – it becomes personal data. At that point, your business must comply with the UK GDPR and the Data Protection Act 2018, including lawful basis, transparency, safeguarding and retention obligations.

In private or sensitive settings, additional rules apply. In situations involving indecent or intrusive recording in private places, criminal laws may also apply.

Key legal frameworks you need to understand

Data protection law (UK GDPR and DPA 2018)

When a child is identifiable in a recording, it becomes personal data. This includes CCTV footage, audio recordings, video clips, photographs, screen recordings and livestreams. Because children’s data is considered higher risk, businesses must apply enhanced protection, including clear transparency information, securing a lawful basis for the recording, limiting access, and ensuring the recording is necessary for your activity.

If a recording reveals sensitive information – for example, health needs, special educational needs, ethnicity, religious information or social care involvement – it may also amount to special category data.

Safeguarding obligations

Businesses that work directly with children, such as schools, sports clubs, tutoring services, childcare providers or health settings, must also comply with safeguarding standards. These may include sector-specific rules, professional obligations or statutory guidance such as Keeping Children Safe in Education for schools.

Surveillance rules and CCTV

If your business uses CCTV or audio monitoring, you must inform people clearly, ensure the recording is necessary and proportionate, follow ICO surveillance guidance, and avoid monitoring in places where people expect privacy. Audio recording is treated as more intrusive than video and requires particular justification.

Online services and digital platforms

If your business operates an online service directed at children or is likely to be used by them, the UK’s age of digital consent becomes relevant. For online services, children under 13 cannot lawfully consent themselves – a parent or guardian must do so. For offline activities, consent depends on whether the child has the capacity to understand the decision.

When recording a child without permission is likely to be unlawful

Recording a child is likely to be unlawful in situations where the child is identifiable and you cannot justify the recording under data protection and safeguarding rules. This includes:

• Recording for marketing or promotional purposes without consent.
•  Recording beyond what is necessary or proportionate for your purpose.
• Failing to provide clear transparency information (for example, using CCTV without signs).
• Recording in private or sensitive areas such as changing rooms, clinics, counselling spaces or toilets.
• Recording children in regulated sectors without following required safeguarding procedures.
• Secret or hidden recording, unless justified by a very specific security or legal purpose.

When businesses use identifiable children in promotional content, social media, websites or advertising, consent from a parent or guardian (or the child if they have capacity, often 13+ for online use) is essential.

When recording a child without permission may be allowed

There are situations where businesses may lawfully record children without express consent, provided that GDPR and safeguarding rules are met.

CCTV for security

CCTV used for legitimate security purposes typically does not require consent if signs are visible, the purpose is clear, and data is not used for other reasons. A Data Protection Impact Assessment (DPIA) is recommended, especially if children are likely to be recorded.

Incidental recordings

If a child appears in the background of a recording – for example, as part of a large group or public crowd – a business may rely on legitimate interests, provided that the recording is expected, proportionate and transparently communicated.

Recordings that are strictly necessary

Examples include documenting an incident for safety or legal reasons or where consent is impractical. Even in these cases, the business must still follow data protection and safeguarding rules.

Consent, parental responsibility and capacity

When consent is required, it must be valid. Valid consent must be informed, freely given, specific, unambiguous and easy to withdraw. It should also be documented.

Who can give consent depends on the context:

• Children under 13 cannot consent to digital services themselves; parents must consent.
• Children aged 13–17 may have capacity to consent depending on the circumstances, especially online, but involving parents is recommended for marketing or sensitive contexts.
• Parents or guardians with parental responsibility may give consent for offline activities, although older children may still be able to consent if they understand the implications.

The key is understanding whether the recording is truly necessary or whether consent should be obtained to eliminate risk.

Public vs private spaces

Recording in public spaces is not automatically illegal. People in public have a lower expectation of privacy, especially in open areas. However, if your business records identifiable children in public, GDPR still applies if the recording is for business purposes rather than personal use.

In private spaces, expectations of privacy are higher. Businesses should avoid recording children in sensitive or personal environments unless it is strictly necessary and legally justified.

Hidden or surreptitious recording

Secret recording of children poses serious legal risks. It may breach GDPR, safeguarding obligations and, in extreme cases, criminal law. Hidden cameras should only be used in rare, high-risk scenarios where justified, proportionate and legally compliant, such as detecting serious crime in exceptional circumstances. Most businesses should avoid hidden recording entirely.

Marketing, social media and promotional use

Using images or videos of children in marketing, website content or social media always requires consent. Clear consent forms and withdrawal processes should be in place. Businesses should not rely on implied consent, verbal consent or signage for promotional use.

Event photography and recordings

If your business hosts events involving children – such as sports matches, classes, recitals or workshops – you should tell attendees that photos or videos may be taken, explain how they will be used and offer opt-out options. For close-up or focused images of identifiable children, obtaining consent from parents or guardians is best practice.

Practical steps for businesses

• Identify what types of recording your business uses and why.
• Assess whether recordings are necessary, proportionate and justified.
• Use transparency notices and clear signage to inform people.
• Obtain consent where required, especially for marketing.
• Limit access to recordings and store them securely.
• Keep retention periods short and appropriate.
• Carry out DPIAs for CCTV or large-scale recording involving children.
• Train staff so they understand privacy and safeguarding duties.
• Review your consent forms, privacy notices and internal policies regularly.

When your business should seek legal advice

Legal advice can be helpful when your business regularly interacts with children, uses CCTV where minors are likely to appear, operates an online service aimed at under-18s, uses recordings in marketing, or handles special category data or safeguarding concerns. It is also advisable to seek guidance when you receive data deletion or access requests involving children’s recordings.

Understanding when and how you can record children is essential for operating responsibly and reducing legal risks. With the right processes, clear communication and strong data protection practices, your business can record safely, ethically and in compliance with UK law.

If you would like a consultation on legal compliance when recording a child, you can reach us at 08081347754 or team@sprintlaw.co.uk for a free, no-obligations chat.