The Identity Vault

Last Updated: April 2026 · 10 min read

There’s a 17-year-old girl in Arizona who, by the time she finished high school, was already $725,000 in debt. Her case is one of the clearest examples of how sharenting affects child identity theft and why most parents never see it coming.

The scary thing is that she had never bought anything or even signed her name. 42 different accounts consisting of credit cards, mortgages and auto loans were opened by 8 different individuals. Her family didn’t even know it was happening. These accounts were opened by a social security number that should have been completely unused. Her family discovered it years after the damage began. But by then, it was too late to stop.

Her case is the most extreme one Carnegie Mellon researchers documented in their landmark 2011 child identity theft study. But the pattern that made it possible isn’t extreme at all. It’s the same pattern playing out in millions of American families right now, often starting with something completely innocent: a parent posting a photo.

This article isn’t here to make you feel guilty about the cute pictures of your kids on Facebook. Almost every parent does it. The point is to show you exactly how those photos turn into something dangerous, and what to do differently going forward — without giving up the joy of sharing your family’s life.

What Sharenting Actually Is

The word sharenting is a blend of sharing and parenting. It describes the everyday practice of parents posting photos, videos, and stories about their children on social media. Sharing those first day of school photos and posts. A childs first lost tooth. The game winning soccer goal. That special birthday cake.

Almost every parent does it. The 2018 report from the Office of the Children’s Commissioner for England found that the average child has roughly 1,300 photos and videos of them shared online by their parents before age 13. Updated 2025 research suggests that number is now closer to 1,500 photos by age 5.

This isn’t a moral failing. Sharing your kids is one of the great pleasures of having them. Grandparents who live far away. Friends who watched you become a parent. Family group chats. The impulse is completely natural. But the world we’re sharing into has changed dramatically, and most parents haven’t updated their habits to match.This is how sharenting can affect a childs identity and lead to identity theft even before families know it has happened.

How Photos Become Identity Theft

Here’s the part most parents miss. A single photo isn’t dangerous. A pattern of photos posted over time is.

Identity thieves aren’t sitting on Facebook scrolling through your account. They’re using automated tools that scrape information from public profiles and assemble it into searchable databases. The data they’re looking for isn’t a Social Security number. They get those from data breaches. What they need from social media is everything else.

A profile of a child needs the full legal name (often in the post or as a tag). It also needs the date of birth (Happy 7th birthday Emma! with a date stamp). The hometown matters too (location data on photos). So does the school name (visible on uniforms, sports jerseys, in photo captions). The pet’s name is useful (Look at Buddy and Emma! is a common security question answer). The mother’s maiden name fills another gap (often inferable from family photos and tagged relatives). And finally, a clear photo of the face (now usable for AI verification systems).

How Thieves Assemble a Stolen Identity

By the time your child is 13, an automated profile of them is more complete than the one in their pediatrician’s records. And unlike the pediatrician’s records, this one is searchable from anywhere.

The Modern Twist: AI and Facial Recognition

The risk used to stop there. It doesn’t anymore.

Photos of children posted on social media are now being scraped at scale to train artificial intelligence systems. Human Rights Watch found over 170 photos of Brazilian children embedded in the LAION-5B dataset. That dataset trains image generators like Stable Diffusion. The University of Washington’s MegaFace dataset used Flickr family photos to build facial recognition technology that ended up in databases used by Google, Amazon, Microsoft, and government agencies.

Clearview AI built a facial recognition tool now used by law enforcement worldwide by scraping billions of photos from Facebook, Instagram, and LinkedIn. Parents have found their children’s faces in police identification databases without ever giving permission. The company has faced lawsuits and fines. But the photos are already in the system.

This means a clear photo of your child’s face that you posted in 2018 may now be training data for AI systems that can age-progress their face into adulthood. It may be source material in facial recognition databases used by private companies. And it may be fed into deepfake generation tools that combine real faces with fabricated bodies and contexts.

The most disturbing emerging use case is AI-generated child sexual abuse material. Law enforcement agencies in multiple countries have warned that publicly posted photos of real children are being used as source material to generate synthetic abuse imagery. A single clear facial image can be enough.

The Cases That Should Stop You Cold

Statistics are easy to dismiss. Stories aren’t.

Zach Friesen — $40,000 Houseboat at Age 7

Zach Friesen discovered his identity had been stolen when he was 17 and applied for his first student loan. The application was denied because there was already a $40,000 houseboat in his name, taken out when he was 7 years old. His family believes the theft happened at a doctor’s office. By the time he found out, the thief had been using his identity for a decade.

The 17-Year-Old Arizona Girl — $725,000 in Debt

A 17-year-old Arizona girl in the Carnegie Mellon study had $725,000 in fraudulent debt across 42 accounts opened by 8 different people. Investigators determined the thieves used her clean Social Security number, paired with information that anyone in her extended social network could have known about her, to spin up a fake life that ran in parallel to her real one for years.

The 5-Month-Old Infant

A 5-month-old infant in the same study had her Social Security number used to apply for credit before she could roll over.

These aren’t outliers. They’re what’s at the far end of a spectrum that starts with normal, well-meaning parents posting normal, well-meaning photos.

What to Stop Posting Today

You don’t have to delete every photo or vanish from the internet. But there are specific things worth stopping immediately. Because each one removes a piece of the puzzle a thief or AI system needs.

Full Birthdays Paired With Names

Happy 8th birthday to my Emma! with a date-stamped photo gives away her exact date of birth. Post the photo, drop the age. Or wait a week.

School Logos and Uniforms

A photo of your kid in their soccer uniform with the school crest visible tells a stranger which school to find them at. Photograph from angles where logos aren’t visible, or skip those photos publicly.

Location Tags and Geotagged Photos

Facebook, Instagram, and most cameras embed GPS data automatically. Turn off location services for your camera app and disable location tagging in your social media privacy settings.

First Day of School Signs

Those cute chalkboards with name, grade, school, teacher’s name, what they want to be when they grow up are a complete identification packet for one photo. Take the picture, but keep it for the family album.

Bath Time, Potty Training, and Embarrassing Moments

This isn’t an identity theft issue, but it’s an issue your future teenager will care about. Posts you make today about a 4-year-old will follow them into job interviews and dating in 15 years.

Photos From Your Kid’s Bedroom or Showing Your Home

Address identification is now possible from background details: the house number on the door, the street sign visible through a window, identifiable landmarks.

What’s Actually Safe to Share

Sharing isn’t the enemy. Sharing without thinking is. Here’s a framework that lets you keep posting without building the profile.

Use a Truly Private Account

Most parents have private accounts with 800+ followers including people they barely remember. A truly private account has 30-80 people. All of them are people you’d hand a copy of your kid’s birth certificate to. If you wouldn’t, remove them.

Photograph From the Back, Side, or With Faces Obscured

A photo of your kid jumping into a pool from behind, or a hand holding a tooth, or a family hike where everyone’s faces are turned away. These capture the moment without contributing to a facial recognition profile.

Wait a Few Weeks Before Posting

A photo posted live tells the world where your kid is right now. The same photo posted three weeks later has lost its real-time tracking value. So build the habit of saving moments to share later.

Use Private Photo-Sharing Platforms

Apps like Tinybeans, FamilyAlbum, Cluster, or even just a shared family photo album in iCloud or Google Photos let grandparents and close family see the photos. The audience is the same people you actually wanted to share with anyway.

Apply the Front-Page Test

Before any post, ask: would I be comfortable if this exact photo and caption ended up on the front page of a newspaper next to my child’s name? If not, it goes in the family album, not the public feed.

Auditing What’s Already Out There

The photos you’ve already posted don’t just disappear because you’ve changed your habits. Here’s how to start cleaning up what’s already public.

Search Yourself

Google your name, then your child’s name, then your name plus your child’s name. See what comes up. Look at what photos and details are findable by anyone.

Audit Your Social Media in One Sitting

Go through Facebook, Instagram, TikTok, and any other platform you’ve used. For each, review every post that mentions or pictures your child. Delete or restrict the ones that combine name, birthday, school, or face. You don’t have to do all of it, but the worst offenders are obvious once you start looking.

Check Privacy Settings on Every Account

Most platforms have changed their defaults multiple times since you signed up. The setting that said friends only in 2017 may now mean friends and friends of friends and people in your network. So reset every privacy setting to the most restrictive option.

Disable Facial Recognition Features

Facebook, Instagram, Google Photos, and Apple Photos all offer facial recognition that creates biometric profiles. Turn each one off in account settings.

Check Have I Been Trained

The website haveibeentrained.com lets you search whether your photos appear in AI training datasets like LAION-5B. If they do, you can request removal. However, once a model is trained, the data can’t be unlearned.

Talk to Grandparents and Friends

Your privacy settings don’t matter if Grandma is reposting every photo to her public Facebook account. This conversation is uncomfortable but necessary. Frame it as protecting the kid, not criticizing them.

What to Tell Your Kid

When your child is old enough to ask, they deserve a real answer about what was posted before they could consent.

Show them what’s findable. Let them see their digital footprint. Help them understand that the version of childhood that lives online wasn’t curated by them. And that going forward, you want their input on what gets posted.

Then teach them the rules they’ll need for their own posting. By the time they have their own accounts, they should already know never to post their full birthday in any combination with their name. Location tags at home or school should be off-limits. Photos with school logos, addresses, or street signs visible should never go up. Friends’ full names shouldn’t appear in their posts. And anything posted should be assumed permanent.

They’ll be more privacy-conscious than you expected once they understand the stakes.

The Bigger Picture

The 17-year-old in Arizona didn’t know she was $725,000 in debt because nobody was watching her credit. Zach Friesen lost a decade of credit history because nobody monitored his data. The thieves who built fraudulent identities on those kids didn’t need access to anything secret. They needed pieces of information that lived in plain sight.

Every photo of your child you post adds a piece to that puzzle. Most of those pieces will never be used. But you don’t get to choose which ones will. Because you won’t know it’s happening until your kid is 18 and trying to rent their first apartment.

The good news is that the protective work is genuinely simple. Lock down your social media. Stop the high-risk posts. Move your sharing to private platforms. And freeze your child’s credit at all four bureaus. So even if a thief has assembled a complete profile, they can’t actually open accounts with it.

That last step is the real backstop. Sharenting awareness reduces the chance that a profile gets built. A credit freeze ensures that even if one does, it can’t be used for the financial damage that ruined Zach Friesen’s first job application or buried that Arizona teenager under three-quarters of a million dollars in debt.

Your child will never know you did any of this. And that’s the point. The protection that matters most is the kind they never have to know about. Because it stops the damage before they ever notice it could have happened.