Hello {{first_name}}. A comms lead said a version of this to me on a call this spring, and I've come back to it most weeks since:

This week, for the 3,484 of us here, it's about the stories you've already published, and the fact that consent doesn't stay still just because your website does.

Last week I asked what's hardest about telling the story of how your organisation began. Almost everyone who answered picked the same thing: the worry that it looks like you're using someone's grief or hardship to get attention.

What nobody picked is the interesting part. Not one person said they didn't know what to say. Nobody said it felt stale, or that they had no founding moment to point to, or that they weren't sure whose permission they needed.

So the block isn't craft. You know the story. You can write it. What stops you is a question about whether you're entitled to.

That instinct is worth keeping. It's just pointed at the wrong moment. Here's your action this week. Take the one story you've been hesitant about and ask a single question of it: if the person at the centre of this read it today, would they recognise themselves, and would they be glad?

If yes, publish it. If you don't know, that's what the rest of this edition is about.

Recently, I had two calls, a day apart, with people who'd never met and work in completely different parts of the sector. One runs communications for youth mental health services. The other leads a health programme within the NHS. Both, unprompted, told me the same thing.

The first put it like this: "If you tell me at 17 that you're really happy to be photographed, or to have me quoted, that may be how you feel at 17. But at 21 you may not feel quite so happy."

The second went further. "When people consent, they're consenting at that period of their life." Then she gave me the example I haven't been able to forget. Someone might be willing, at the time, to say publicly that they were in hardship and using a food bank. Years later, that's not an image they want on the internet of them and their children queuing for food.

Both of them were describing the same thing, and our sector has no name for it. So here it is.

It was given by a specific person, at a specific point in their life, in a specific world. All three of those move. Your published archive doesn't move at all.

At this point most people tell me they're covered, because their consent form says the person can withdraw at any time.

I've read a lot of those forms. Mine included. And the clause is real. But think about what it actually asks of someone.

To withdraw, they have to contact the organisation that helped them. Identify themselves, again, as the person in that story. Explain why they've changed their mind. Then ask a favour of an organisation they may still need, or may never want to hear from again.

The person most likely to want their story taken down is the person least likely to ask you to take it down.

That clause doesn't protect them. It transfers the work to the one person in the arrangement with the least power, and then lets everyone else feel covered. Nobody ever asks you to take it down, and you read that silence as consent. It isn't. It's the sound of a burden sitting somewhere it shouldn't.

The duty is yours. And it isn't a duty to wait. It's a duty to go and ask.

Sometimes it isn't the person who moves. It's the ground under them.

As I mentioned in last week's edition of this newsletter, since 2019 my foundation has run Out and Proud Parents Day on 30 July. Every year we publish the stories of parents who love their LGBTQ+ children, many from religious and culturally conservative backgrounds, and not all of them were accepting on day one. Some were physically sick when they found out. Those interviews go out with faces and names, because visibility is the entire point.

This year, for the first time in seven years, we asked parents not to appear publicly. We invited them to share anonymously instead.

Nothing about the stories changed. Nothing about the parents changed. What changed is that it's now too dangerous for some of those children, particularly trans children, and particularly families outside the UK.

The consent we hold from 2019 is still valid. The world it was given in is gone.

I sat with that for a while, because it points somewhere uncomfortable. Seven years of properly consented, willingly given, public stories are still online, and every one of them was agreed under conditions that no longer exist. I'm not writing this from the other side of the problem. I'm in it.

You'd never keep a case file for seven years without reviewing it. You have a retention policy for data. You have a review cycle for safeguarding. You'd flag it immediately if a risk assessment hadn't been looked at since 2019.

Then you publish a photograph of a fifteen-year-old and it stays on your website until the site gets rebuilt.

The gap isn't ethical carelessness. Everyone I speak to about this cares enormously. The gap is that consent got filed as a legal formality rather than as a live record, so it went into a drawer instead of onto a calendar. A signed form feels finished. That's the whole problem.

And the archive doesn't sit still while you're not looking at it. It gets indexed. It gets scraped into training data. It shows up when a new employer searches a name, or when a classmate does. A story you published in 2021 is doing work in 2026 that you never planned and can't see.

It doesn't mean publishing less. The sector already has too much of that reflex, and I've written before about what it costs an organisation to tell no human stories at all because silence feels safer.

Nor does it mean going back and stripping your website tonight.

And please don't read it as a reason to treat everyone whose story you've told as fragile. Most people, when you check, are glad it's still out there. Some will be pleased you asked. A few will want one detail changed rather than the whole thing pulled.

What it means is that a story needs a review date the same way a policy does, and that going back to ask is a normal piece of housekeeping rather than an admission that something went wrong.

We covered how to get consent properly in Edition 7 (Consent) -, and how to gather a story without harming the person in Edition 26 (Trauma-informed storytelling). Both are about the moment of asking. This is about the seven years afterwards, which is where almost all of the risk actually lives, and where almost nobody is looking.

Their yes was real. Go and find out if it still is.

Five moves. Move 1 takes a minute per story from now on. Moves 2 to 5 are how you deal with what's already published.

1. Give every story a review date, not just a consent date. At the moment you publish, write down when you'll look at it again. Twelve months is a sensible default. Make it six if the person was under 18, still using your services, or in crisis when they agreed. The date goes in the same place as the signed form, and it goes in a calendar.

2. Write down the triggers that override the calendar. Some events reset the clock straight away, whatever the review date says. Agree them when you gather the story. They usually include: the person turns 18, they leave your service, a legal case concludes, a perpetrator is released, their immigration status changes, or the public climate around their identity shifts. One of those happens, you review now.

3. Do the asking. Don't wait to be told. You go to them, not the other way round. It's one message and it doesn't need a preamble: "Your story is still on our website and still being used in our funding applications. Are you still happy with that?" Give them a genuine option to say take it down, change it, or leave it. Then honour whichever one they choose without asking them to justify it.

4. Know where it all is before somebody asks. Most organisations can't act on the withdrawal request they hope never comes, because no one holds the list. One shared record: the person, the story, every place it's published, the image file names, who signed it off, the review date. If someone rang tomorrow, you should be able to act in an hour, not a fortnight.

5. Retire honestly, and say what you can't undo. Printed annual reports, broadcast footage, press coverage and anything already scraped can't be recalled. Say so plainly at the start, not at the point someone asks. Then be specific about what you can do: remove it from the website, stop using it in bids, delete it from the image library, ask partners to take it down. Do those things, and then tell the person exactly what you did.

One record per published story. Fill it in when you publish, and again at every review. It sits alongside the consent form from Edition 7, it doesn't replace it.

If you do one thing with this edition, make it the smallest one. Pick a single story you published more than two years ago. Find out where it's still living. Then send one message to the person in it.

You'll almost certainly be told to leave it up. That's fine. The point isn't the answer. The point is that from now on, somebody is asking.

My newsletter, with a framework, a template and an AI prompt like these every Thursday: www.impactstoryteller.org

Until next week, please take care.

Warm regards,

Matt Mahmood-Ogston
Award-winning impact storyteller, photographer and charity CEO.
Follow me on LinkedIn