Hello Brothers and Sisters in the Lord

I have a naturally detail-oriented personality, and I notice compliance gaps fairly easily. But in church settings I have often closed an eye, telling myself it doesn't matter as much as it would at workplace setting.

Over time I realised that was the wrong instinct. Being in a congregation setting doesn't mean lowering our standards. If anything, the people we serve deserve our best care and attention.

This issue came out of that conviction. Photo and media consent might feel like an administrative burden, but getting it right is one of the ways we honour the people in our care. I will be using this at my church and I hope it serves yours too.

Jackson

Somewhere in your church office, or on a shared drive, or in a spreadsheet you haven't opened for a while, there are photo consent forms. Some signatures are recent. Some go back five years, maybe more. Different systems, same idea.

Whatever holds them, the form itself was probably last updated some time before COVID.

It mentions the church bulletin. It mentions the noticeboard. If it's a newer version, it mentions the website.

It does not mention the livestream. It does not mention social media.

It does not mention what happens when that livestream ends and the full recording is automatically published as a public video. It does not mention the 30-second sermon clip a volunteer is editing for Reels right now. It does not mention Canva's AI image tools, which weren't in wide use when most of those forms were signed.

That form was built for a different media world. One Sunday photo. A printed bulletin or email. Maybe a static image on the website's About page. That world has changed.

Let’s walk through what actually happens at a Sunday service in 2026. A camera pans the room during worship. The stream goes live to YouTube, or Facebook, or Vimeo, or Resi, depending on your setup. The recording auto-publishes the moment the benediction finishes. Someone on the media or marketing team pulls a sermon highlight, drops it into a vertical template, posts it as a Reel by Wednesday. The graphic for next week's service is generated in Canva using an AI tool that may or may not be storing the prompt and the output on a server in another country.

Four pieces of media published, often by four different volunteers, none of them cross-checking the consent record before they hit publish.

Most teams reading this know there's a gap. What fewer teams know is where the legal floor sits.

Under the Privacy Act 1988, a photograph of an identifiable person at worship is classified as sensitive information. Same legal category as health information. The reason is straightforward: the photo reveals the person's religious affiliation. That classification doesn't change because the photo is on a livestream instead of a bulletin.

Most small Australian churches are exempt from the Privacy Act under the small business exemption (turnover under $3 million). That exemption is currently in force and hasn't changed, despite a lot of online noise suggesting otherwise. So the Privacy Act floor, for most small churches, is low.

But the Privacy Act is not the only framework that applies. A statutory tort for serious invasions of privacy commenced in June 2025 and covers all entities regardless of size or turnover. Safeguarding obligations around children's images sit under state-level Working With Children Check schemes and denominational frameworks. The common law has long protected information shared in circumstances of trust. Exemption from the Privacy Act 1988 does not mean no other rules apply.

This is worth thinking about more carefully. The legal floor and the standard we hold ourselves to are not the same line. A church can be exempt from the Privacy Act and still be handling a category of information the law treats with extra care. The exemption tells you what you're allowed to do. It doesn't tell you what you should do.

Your people walk into your service trusting that the church will not use their face in ways they haven't agreed to. That isn't a legal question. It's a matter of trust. And the form in the folder was built to honour a promise that no longer matches what the church actually does.

That's the gap. It's not a moral failure. The form was fine for what it was for. The world changed, and the form hasn't kept up.

A consent form is a pastoral promise. It is how your church says to its people: we will not use your face in ways you haven't agreed to. That promise deserves a current answer, not relying on consent form that is no longer relevant.

A current promise covers four things the old form didn't: livestream, recordings auto-published to public platforms (whether that's YouTube, Facebook, Vimeo or anywhere else), short-form social content, and AI tools. It separates adults from minors, because the consent conversation is different. And it includes a discreet way for people to opt out without explaining why, because some people in your congregation have safety reasons they will never tell you about.

One action this week. Find someone on your team. Pull up your current consent form, wherever it lives. Read it together. Ask one question: does this form still describe what we actually do?

If the answer is yes, you're done. If the answer is no, the work begins. Both are useful answers.

Or, if even that feels like one more thing on a long list, just download the Toolbox below, put it on the next leadership meeting agenda, and let the conversation start there.

The Toolbox below has the resource bundle that goes with this issue.

Photo and Media Consent: A Complete Bundle for Australian Churches

Three documents, designed to work together.

The administrator's guide. The practical how-to for whoever is running this at your church. Covers who should own the form, how to collect consent without making it a project, how to communicate consent choices to the people producing your media, the annual review process, what to do when someone asks you to remove their image, and guidance for independent churches without a denominational framework to lean on.

The full consent form. A fully editable form built for what churches actually do in 2026. Includes a plain-English explainer written for the person being asked to sign. Adult and minor sections kept separate, livestream as its own category, auto-publishing to public platforms flagged explicitly, short-form social content as a distinct consent choice, AI image tools addressed with the OAIC's current guidance cited, and a confidential opt-out for people with safety reasons.

The starter consent form. A shorter version for churches not ready for the full form from day one. Also includes its own plain-English explainer. Covers the four most common consent categories: internal use, public website and livestream, short-form social content, and AI image tools. Adults only. When your church is ready to move up, existing signatures remain valid for the categories they covered.