Schools and school districts use social media for a variety of reasons, but alongside the benefits of schools' social media use come potential risks to students' privacy. Using a novel dataset of around 18 million Facebook posts by schools and districts in the United States, we explore the extent to which personally identifiable information of students may be revealed. We find that around 4.9 million posts depict one or more students' faces, and approximately 726,000 posts also identify the full name of one or more students. We also examine which Facebook page characteristics and structural factors might be associated with posts that depict or identify students. We find that districts with a higher student poverty rate and districts that share a greater number of posts were more likely to depict students. We discuss these findings and recommendations for educational leaders and researchers through the lens of data ethics.