The line at thirteen
A count is honest. A list would be a leak wearing a transparency badge.
The most useful thing we can tell a middle school is exactly where the line falls, exactly what it blocks, and exactly what it does not touch. The second most useful is why the one number we do publish stops where it does.
What the line blocks, precisely
It blocks publication of a student’s image to somebody outside the school community where that student is under thirteen, or where their date of birth is missing or unknown. It is applied before any permission is consulted and it has no override, for a parent or for the school.
It does not block a family from seeing their own student. It does not block staff from doing their jobs within their roles. It does not block a student appearing in the school’s own internal systems, in a class list, or on an identification card. And it is not the thing deciding whether a student is in the yearbook — that is the family’s own permission, which is a separate question with a separate answer.
People tend to hear “blocked” and imagine a child erased from the school’s records. It is much narrower than that: it is a door onto the outside, and only that door.
Why a partially-held gallery shows a number and not a name
When a visitor opens a gallery a school has published, some frames may have been dropped. The view says how many. It never says which students they were, and it never labels a gap.
The reasoning is short. In a middle school, the held students are disproportionately the youngest ones and the ones whose families made a deliberate choice. A list of who was held is therefore a list of exactly the children a school has undertaken to be careful about — handed to whoever clicked the link.
Transparency about a mechanism is not the same as transparency about the people it protects. We are as specific as we can be about how the gate works, at length, right here. We are deliberately unhelpful about who it caught.
Inside the school, this is different, and it should be. A member of staff with the right role can see the roster and each student’s own state, because administering a school requires knowing who has agreed to what.
The distinction is between administration and publication. One is a job somebody is accountable for; the other is a page a stranger can open. Collapsing the two is how a well-meant transparency feature becomes the leak.
The yearbook is a different question, and this is where people get confused
The age floor governs publication to people outside the school community. A yearbook distributed inside that community is not that, so the deciding question for the book is the family’s own publication permission rather than the student’s age.
Which produces a genuinely confusing pair of facts, so here they are side by side. A twelve-year-old whose family has agreed can be in the yearbook and cannot be in the gallery on the school’s public website. A thirteen-year-old whose family has not agreed is in neither.
Both gates have to allow a use before it happens. Neither one overrides the other. The reason to hold the images and the permissions in one place is that the book is composed out of the gated library rather than from a folder of files copied earlier in the year — which is what allows a withdrawal in March to reach a book that prints in May.
Three edges a middle-school office should know about
A birthday removes a block; it does not grant a permission. A student who turns thirteen with no active family agreement on file stays unpublished, exactly as before. The permission defaults closed and silence is not a yes.
A blank date of birth behaves as under thirteen. Not as unknown-therefore-proceed. It is the least glamorous data-quality problem you have and it is the one with the most visible consequence, because it is the difference between a student being in a published gallery and not.
A group frame needs everyone in it to clear both gates. One student under the line, or one family who said no, and the whole photograph is not published. This is why the team picture is the recurring argument of the autumn, and there is no crop-and-blur alternative here: a crop is a judgement made once by whoever was in a hurry, and a blur is a claim about software that a parent has no way of checking.
How a photograph reaches the right student
A permission-checked lookup against the school’s own roster: a name and an id. Your teachers already know who was in the room, so the interesting alternative — sorting by recognising faces — would answer a question the roster has already answered, and pay for the answer with a stored biometric template for a twelve-year-old.
That capability exists in the wider platform. It is off unless a parent switches it on for their own child, it is never bundled into a publication permission, and where it is on the template is a set of numbers derived from a photograph rather than a saved picture of a face. It stays inside the private cloud we run ourselves and is never sent to an outside service. Withdrawal stops the matching at the point of asking rather than on a delay.
The part we have not finished, in ordinary type. Face matching is off by default and is not wired in the shipping configuration, so no face template is computed from a student’s photograph today. We are not going to let that sentence stand in for the harder one behind it.
What is built is the clock, not the shredder. A stored template would carry a deadline — 365 days unless a district sets its own, and a setting that cannot be read falls back to that default rather than to none — and a nightly pass decides which templates are past theirs. That pass is registered unconditionally wherever the durable database is, because a retention schedule written into law is not an optional job, and while the lane is off each pass writes an honest line into an append-only record saying it scanned nothing and destroyed nothing.
What is not built is the piece that destroys the sealed copy. Because it is missing, the pass stops and fails loudly the moment anything is genuinely due, rather than deleting the record that points at a template while the sealed copy would still exist. It does not skip quietly, and a run that goes silent is watched for in its own right, so a job that has stopped shows up instead of merely being absent. That is the whole honest position: the clock is real, the destruction is not demonstrated from one end to the other, and we will not say otherwise until it can be shown.
The questions the line raises
What happens on a student's thirteenth birthday?
The floor stops applying to them, and their family's publication permission becomes the deciding question instead. Nothing is published automatically: the permission defaults closed, so a student who crosses the line without an active family agreement stays unpublished. Crossing the line removes a block; it does not grant anything.
What if a date of birth is missing from the roster?
The student is treated exactly as an under-thirteen student is: held. An unknown age is a reason to stop rather than a reason to proceed. In a middle school this matters much more than it does lower down, because lower down the whole roster is held anyway -- here a blank field is the difference between a student being in a published gallery and not.
Does the yearbook itself follow the thirteen line?
The age floor governs publication to the open web. A yearbook distributed inside the school community is not that, so the governing question for the book is the family's own publication permission. This distinction genuinely confuses people, and the honest summary is: the age floor decides the public website, the family's permission decides the book, and both have to allow a use before it happens.
Can a parent override the floor for their own child?
No. It is not a permission with a default; it sits underneath the permissions. A family who actively wants their twelve-year-old in a public gallery cannot have that, and neither can the school.
How is a photograph attached to the right student in the first place?
A permission-checked lookup against the school's own roster -- a name and an id., it is not turned on in the software we run, and it is never bundled into a publication permission. At this age we would think hard before offering it at all.
What have you not finished?
One thing, stated here rather than in a footnote. Face matching is off by default and is not wired in the shipping configuration, so no face template is computed from a student's photograph today. The part we cannot demonstrate from one end to the other sits behind that: destruction. A stored template would carry a deadline of 365 days unless a district sets its own, a setting that cannot be read falls back to that default rather than to no deadline, and a nightly pass decides which templates are past theirs. The component that destroys the sealed copy is not wired. So the pass is built to halt and fail loudly the moment something is genuinely due, rather than delete the record that points at a template and leave the sealed copy alive, and it does not skip quietly. When the whole chain can be shown, this will say so.