What makes a parent's photo consent valid, and does it have to be in writing?

Under POPIA, consent is "any voluntary, specific and informed expression of will" giving permission for the processing (s1). For a child's information it must also be given before the processing starts (s35(1)(a)).

In practice that means:

• Voluntary: the parent or guardian must have a real choice.
• Specific: it covers the uses you name (for example the club website and social media), not any future use.
• Informed: the parent knows what will be collected and why, as section 18 requires.

In writing? POPIA does not prescribe a form for consent. But the club bears the burden of proving that consent was given (s11(2)(a)), so keep a record of each consent: who gave it, for which child, which uses, and when.

Consent can be withdrawn at any time; this doesn't make earlier processing unlawful (s11(2)(b)).

Source: POPIA (Act 4 of 2013) ss 1, 11, 18, 35.