Sharing personal details and photos of children online, a practice known as 'sharenting,' can expose them to significant risks, including identity theft and the creation of synthetic identities, according to cybersecurity expert Izabella Stueflotten.

Stueflotten, who is also a mother of four and a VP of strategy at a major cybersecurity agency, explains that seemingly innocent posts like baby photos or birthday announcements can provide threat actors with crucial information. This data, gathered by automated bots scanning the internet, forms a digital footprint that can be exploited long before a child is old enough to manage their online presence. Details such as a child's date of birth, first name, school, and even the name of a first pet are often shared, which can be used to bypass security questions for online banking and other services.

"Your child is the one who is facing the long-term consequences of having this digital footprint before they have even said their first words," Stueflotten stated.

These digital breadcrumbs, combined with facial data from uploaded photos, can be used for 'face spoofing' to create fake digital representations of a child. This technology can potentially fool 2D facial recognition systems, commonly found on smartphones, using high-resolution images. The expert noted that while 3D facial recognition might be more advanced, 2D systems are already vulnerable.

Stueflotten also highlighted concerns regarding social media platform terms and conditions. She pointed to Meta's terms of service, which grant the company a broad license to use user-generated content. This includes the potential for photos to be used in experimental features, such as AI image generation, without explicit consent. For example, Stueflotten questioned whether parents would opt into features if they knew their child's photos could be used to create AI-generated images by strangers.

"Any public profile photos or public albums can be ‘scraped’ to train AI models without explicit consent," she said.

To mitigate these risks, Stueflotten recommends several protective measures for parents:

  • Limit Sharing: Avoid posting photos of children and consider deleting existing ones that contain identifying information.
  • Data Stripping: If sharing photos, remove location tagging and metadata (EXIF data) before uploading. Ensure photos do not include visible landmarks, street signs, or school logos.
  • Review Terms and Privacy Settings: Understand platform terms of service, especially regarding AI training. Opt out of experimental features and set accounts to private. Regularly review and delete old photos and inactive connections.
  • Separate Accounts: Create separate, distinct email accounts with false birth dates solely for social media use, keeping them separate from sensitive accounts like banking or government services.

Stueflotten emphasized that protecting a child's digital identity is as critical as safeguarding their physical safety, as the consequences of compromised data can lead to significant financial, personal safety, and reputational harm.