What it inherits
There is no such thing as yearbook law
There is only what governs the people in the book, and that is decided by how old they are and by who has the standing to speak for them. Four bands, four different answers, one object.
Why the object does not carry the rules
Because a photograph of an eleven-year-old is governed by what governs an eleven-year-old, wherever it ends up.
If a yearbook had its own separate rulebook, then a student’s protection would depend on which product an adult chose to put them in — a picture in the gallery would be treated one way and the identical picture in the book another. That is exactly backwards, and it is how a system ends up with a hole shaped like whichever output nobody thought about.
So the book inherits. What follows is what it inherits, band by band, and the differences are larger than most advisers expect.
The four bands
Elementary
An age floor with no override, and a district form that governs everything else.
Every student is under thirteen, so publication to the open web is refused before any permission is consulted. The book itself is not the open web, so what decides whether a student is in it is the family’s own permission — usually collected on a district release form in an August packet.
The practical consequence for an adviser: your book is governed by paperwork somebody else administers, and the most common failure is that the paperwork and the pages live in different places. The other consequence is that nothing from the book can be reused on the school website, whatever the form says.
Middle
The same floor, but now it splits your roster in half.
Grades six to eight straddle a thirteenth birthday, so the same rule clears some students and holds others — in one class, in one photograph, with every family having agreed. This is the only band where that happens.
For the book it matters most in group frames: a seventh-grade team is routinely split, and a frame is publishable only where everybody in it may be published. The yearbook itself is governed by family permission rather than by age, which produces the genuinely confusing pair — a twelve-year-old can be in the book and not on the school website.
High school
The floor barely fires, so the family’s permission is doing all the work — and the editors are minors.
Almost nobody is under thirteen, so the whole question becomes whether a family has actively agreed and whether that agreement is still current. It defaults closed and silence is not a yes.
Two things are specific to this band. The senior section is frequently made of photographs a studio owns rather than the school. And your editors are themselves protected: a student holding an editor role is walled out of anything that sends imagery beyond the school, before their role is even considered.
College and university
No floor at all, and the person in the photograph is the person who decides.
Subjects are adults. There is no guardian, no age gate, and no form in an August packet — there is a competent person who can be asked directly and who can also, years later, ask you to stop.
For a book that produces a specific problem the school bands do not have: somebody who agreed at twenty may withdraw at forty, and the volumes are already on shelves. What withdrawal reaches is what has not been printed. Everything else is a conversation your institution has rather than a setting anybody can change.
The pair of facts that confuses everybody
It is worth stating on its own, because advisers hit it every year and it sounds like a contradiction.
A twelve-year-old whose family has agreed can be in the yearbook, and cannot be in the gallery on the school’s public website.
Both are true at once. The age floor governs publication to people outside the school community; a book distributed inside that community is not that. So the book turns on the family’s permission and the website turns on the student’s age, and each gate has to allow a use before it happens.
The reason to know this is not academic. It is that a communications office asking for “the yearbook photographs” for the school website is asking for something the system will refuse, and the refusal will look like a fault to somebody who has just seen the same photograph in print.
The whole-school book
A K-12 school making one book is carrying two regimes in one object, and it is worth naming before production rather than during it.
The elementary half sits under a floor that the high-school half does not. Anything shared between the two halves — a whole-school photograph, a cross-grade event, a spread about a family with children in three grades — inherits the stricter answer for the students who need it.
Nothing about that is difficult to operate. It is difficult to discover in April, which is why it is here rather than in a support article. An adviser who knows in September which spreads cross the line has a different year from one who finds out at proofing.
How a photograph reaches the right person
A permission-checked lookup against the school’s own roster: a name and an id. Deliberately dull, because the school already knows who was in the room, and the interesting alternative costs a stored biometric template for every student in the building.
Face matching exists in the wider platform. It is off unless a parent or an adult subject switches it on for themselves, it is never bundled into a publication permission, and where it is on the template is a set of numbers derived from a photograph rather than a saved picture of a face. It stays inside the private cloud we run ourselves and is never sent to an outside service. Withdrawal stops the matching at the point of asking.
The part we have not finished, in the same type as everything else. Destroying a stored template at the end of its retention window is not something we can demonstrate from one end to the other. So we will not tell you it happens nightly, on withdrawal, or at the end of the window.
What we can tell you is how it fails: the cleanup stops and raises a standing alarm rather than marking a template gone when it cannot actually destroy it, and that alarm stays where a school can see it. When the whole chain can be shown, this will say so.
The questions this raises
Why does a yearbook not have its own rules?
Because the rules attach to the people in it rather than to the object. A photograph of an eleven-year-old is governed by what governs an eleven-year-old, whether it ends up in a book, a gallery or a corridor. Building a separate rulebook for the book would mean a student's protection depended on which product an adult chose to put them in, which is exactly backwards.
Is a yearbook the same as publishing on the open web?
No, and the distinction matters most in the youngest bands. The age floor governs publication to people outside the school community. A book distributed inside that community is not that, so the deciding question for the book is the family's own permission rather than the student's age. Both gates have to allow a use before it happens, and neither overrides the other.
So a twelve-year-old can be in the book but not the website?
With their family's permission, yes -- and that pair of facts confuses almost everybody the first time. It is the clearest example of why this site does not state one rule: the answer genuinely depends on which output you mean and how old the student is.
What about a K-12 school that makes one book for the whole school?
Then it is carrying two regimes in one object, and the elementary half is under a floor the high-school half is not. That is a real complication and it is worth naming before production rather than during it -- particularly for anything shared, like a whole-school photograph.
Our editors are students. Does that change anything?
In a middle or high school it does, and materially: a student holding an editor role is still a minor, and is walled out of the operations that send imagery outside the school before their role's own permissions are considered. They can compose, select, caption and publish inside the school. In higher education the staff are adults and that particular wall does not apply.
What have you not finished?
One thing, stated here rather than in a footnote. Where face matching has been switched on by a parent or an adult subject, the system stores a template -- a set of numbers derived from a photograph, not a saved picture of a face. Destroying that template at the end of its retention window is not something we can demonstrate from one end to the other. The cleanup stops and raises a standing alarm rather than marking a template gone when it cannot actually destroy it. When the whole chain can be shown, this will say so.