I was at a security briefing aimed at parents conducted by a reputable private security firm run by former FBI folks.
Their advice- adopt a “no photo” policy, make sure Grandma understands why so she’s not constantly posting on Facebook the cute “look at my naked grandson in the bathtub” pictures to her bridge club, don’t make distinctions between “good” and “bad”-- just no photos. Your kid’s nursery school shouldn’t be posting photos of your kid with “Little Georgie won the citizenship award for putting away his blocks” and your kids HS shouldn’t be posting photos of your kid winning awards. The schools which have a need for social media and PR can either blur the faces or be meticulous about password protected sections of their site (with an administrator who knows the families so they aren’t randomly accepting everyone who tries to gain access).
Minors should not be having their images posted publicly without their consent, period full stop. One of the thought provoking issues these folks presented was that the VERY disturbing trends of young girls images being altered and sent online to predators usually begins VERY innocently. And then not.
In the OP’s case, there is NO reason for an organization to use the kid’s photo if the family does not provide consent, and the OP shouldn’t feel at all awkward about taking a “no photo online” stance. There are plenty of ways to publicize the good work that an organization does in supporting higher education without photographs. Just knowing that Joey from Nevada wrote a heartwarming essay about “what the Constitution means to me” with a photoshopped picture of the Constitution should be sufficient.