The line at thirteen
A count is honest. A list would be a leak wearing a transparency badge.
The most useful thing we can tell a middle school is exactly where the line falls, exactly what it blocks, and exactly what it does not touch. The second most useful is why the one number we do publish stops where it does.
What the line blocks, precisely
It blocks publication of a student’s image to somebody outside the school community where that student is under thirteen, or where their date of birth is missing or unknown. It is applied before any permission is consulted and it has no override, for a parent or for the school.
It does not block a family from seeing their own student. It does not block staff from doing their jobs within their roles. It does not block a student appearing in the school’s own internal systems, in a class list, or on an identification card. And it is not the thing deciding whether a student is in the yearbook — that is the family’s own permission, which is a separate question with a separate answer.
People tend to hear “blocked” and imagine a child erased from the school’s records. It is much narrower than that: it is a door onto the outside, and only that door.
Why a partially-held gallery shows a number and not a name
When a visitor opens a gallery a school has published, some frames may have been dropped. The view says how many. It never says which students they were, and it never labels a gap.
The reasoning is short. In a middle school, the held students are disproportionately the youngest ones and the ones whose families made a deliberate choice. A list of who was held is therefore a list of exactly the children a school has undertaken to be careful about — handed to whoever clicked the link.
Transparency about a mechanism is not the same as transparency about the people it protects. We are as specific as we can be about how the gate works, at length, right here. We are deliberately unhelpful about who it caught.
Inside the school, this is different, and it should be. A member of staff with the right role can see the roster and each student’s own state, because administering a school requires knowing who has agreed to what.
The distinction is between administration and publication. One is a job somebody is accountable for; the other is a page a stranger can open. Collapsing the two is how a well-meant transparency feature becomes the leak.
The yearbook is a different question, and this is where people get confused
The age floor governs publication to people outside the school community. A yearbook distributed inside that community is not that, so the deciding question for the book is the family’s own publication permission rather than the student’s age.
Which produces a genuinely confusing pair of facts, so here they are side by side. A twelve-year-old whose family has agreed can be in the yearbook and cannot be in the gallery on the school’s public website. A thirteen-year-old whose family has not agreed is in neither.
Both gates have to allow a use before it happens. Neither one overrides the other. The reason to hold the images and the permissions in one place is that the book is composed out of the gated library rather than from a folder of files copied earlier in the year — which is what allows a withdrawal in March to reach a book that prints in May.
Three edges a middle-school office should know about
A birthday removes a block; it does not grant a permission. A student who turns thirteen with no active family agreement on file stays unpublished, exactly as before. The permission defaults closed and silence is not a yes.
A blank date of birth behaves as under thirteen. Not as unknown-therefore-proceed. It is the least glamorous data-quality problem you have and it is the one with the most visible consequence, because it is the difference between a student being in a published gallery and not.
A group frame needs everyone in it to clear both gates. One student under the line, or one family who said no, and the whole photograph is not published. This is why the team picture is the recurring argument of the autumn, and there is no crop-and-blur alternative here: a crop is a judgement made once by whoever was in a hurry, and a blur is a claim about software that a parent has no way of checking.
How a photograph reaches the right student
A permission-checked lookup against the school’s own roster: a name and an id. Your teachers already know who was in the room, so the interesting alternative — sorting by recognising faces — would answer a question the roster has already answered, and pay for the answer with a stored biometric template for a twelve-year-old.
That capability exists in the wider platform. It is off unless a parent switches it on for their own child, it is never bundled into a publication permission, and where it is on the template is a set of numbers derived from a photograph rather than a saved picture of a face. It stays inside the private cloud we run ourselves and is never sent to an outside service. Withdrawal stops the matching at the point of asking rather than on a delay.
The part we have not finished, in ordinary type. Destroying one of those stored templates at the end of its retention window is not something we can demonstrate from one end to the other. So we will not tell you it happens nightly, on withdrawal, or at the end of the window.
How it is built to fail is the part we can tell you: when the cleanup cannot actually destroy a template it stops and raises a standing alarm rather than marking one gone, and that alarm stays where a school can see it. A quiet failure would be worse and it is the one it was designed against. When the whole chain can be shown, this section will say so.
The questions the line raises
What happens on a student's thirteenth birthday?
The floor stops applying to them, and their family's publication permission becomes the deciding question instead. Nothing is published automatically: the permission defaults closed, so a student who crosses the line without an active family agreement stays unpublished. Crossing the line removes a block; it does not grant anything.
What if a date of birth is missing from the roster?
The student is treated exactly as an under-thirteen student is: held. An unknown age is a reason to stop rather than a reason to proceed. In a middle school this matters much more than it does lower down, because lower down the whole roster is held anyway -- here a blank field is the difference between a student being in a published gallery and not.
Does the yearbook itself follow the thirteen line?
The age floor governs publication to the open web. A yearbook distributed inside the school community is not that, so the governing question for the book is the family's own publication permission. This distinction genuinely confuses people, and the honest summary is: the age floor decides the public website, the family's permission decides the book, and both have to allow a use before it happens.
Can a parent override the floor for their own child?
No. It is not a permission with a default; it sits underneath the permissions. A family who actively wants their twelve-year-old in a public gallery cannot have that, and neither can the school.
How is a photograph attached to the right student in the first place?
A permission-checked lookup against the school's own roster -- a name and an id. Face matching exists in the wider platform, it is off unless a parent turns it on for their own child, and it is never bundled into a publication permission. At this age we would think hard before offering it at all.
What have you not finished?
One thing, stated here rather than in a footnote. Where a parent has switched face matching on, the system stores a template -- a set of numbers derived from a photograph, not a saved picture of a face. Destroying that template at the end of its retention window is not something we can demonstrate from one end to the other. The cleanup is built to stop and raise a standing alarm rather than mark a template gone when it cannot actually destroy it. When the whole chain can be shown, this will say so.