The headmaster made a good decision.
In NJ during the time between when Megan of Megan’s Law was abducted and murdered, and the passage of Megan’s Law, a child predator used a school website to window shop for his next victim.
It’s illegal, a misdemeanor, in NJ to distribute pictures of children through official government publications without written consent of a guardian now, but the law is rarely if ever enforced. There is a NJ State Board of Education approved waiver form out there that is used as a template by school systems, libraries, etc.
Regardless of how one may feel on this issue, I'm wondering if it might have been a better idea to simply post no pictures at all that feature children in any way?
When they post the pictures but then cover up the faces with these garish smiley faces, it mainly serves to call attention to their policy and away from the activity or achievement being highlighted in the accompanying article.
It takes about two seconds to add password protection to a website. That solution would address the problem you describe and still allow parents and kids to enjoy the pictures.