Strictly speaking, if they don't mention in the T&Cs of the ticket that photos maybe taken, stored, published and shared then yes, unless the T&Cs explicitly say by buying the ticket you agree ( in in the case of children parents agree ) to having that data stored, published and shared - and to...
Any data - including photos - to do with under 16s has a special rating within GDPR. Anyone using it has to get explicit permission to use it and explain exactly what they plan to use it for. The problem for many organisations is that they may have obtained permission to use the data originally...