I am not sure where you are, but this is usually standard. You can’t film someone at a place where there’s some expected form of privacy and use that footage publicly.

Talking about GDPR, the fact they had to ask is proof it works. It’s an opt in. Your friend now has the option to say yes if they want to share it, but the default is no.

There are also provisions for withdrawing consent after giving it. The agreement can’t go above that law.

What ? It's the opposite, it allow you to access and delete the data, even if you gave consent one time. And your image concern a lot of other old laws, even if you sell it you can get it back later.

Art.7(3): "The data subject shall have the right to withdraw his or her consent at any time."

https://gdpr-info.eu/art-7-gdpr/

The only thing which would make that outrageous would be an element of force (which would make it not consent anyway, but I digress). Instead, you're giving an example that explicitly allows for a denial. That's exactly as it always should have been, so I really don't understand what the point is that you're trying to make here.

Under the GDPR, consent must be revokable, at any time, and as easy to withdraw consent as to give it. So you could sign that. Then 5 minutes later withdraw consent.

Additionally consent must be "freely given". If you would be punished (e.g. expelled from school) then you haven't given consent, so they can't use it.

Is that a GDPR issue, or a copyright/"release" issue?

(note that privacy and GDPR issues apply differently for children)

> natural rights to their data which they would otherwise have

This is not a thing. Data has traditionally "belonged" to the entity doing the recording of the data.