I told them I don't want to but was told it's standard.
This is what you can say:
"Yes, I understand it's standard, but I don't want to."
In case they repeat their request, you just repeat the same thing:
"Yes, I understand everyone is doing it, but I don't want to."
If they say your request is silly. Just agree with that, but don't change your stance.
"Yes, I understand that this refusal seems silly to you, but this is my right. Under the GDPR, I don't need to explain myself or my reasoning."
In other words, even they try to shame you or imply something with your non-compliance, don't even try to argue that part, just hold your ground.
This is the beauty of the situation. You don't need to justify your reasoning. You don't need to convince them of anything. You don't need to convince them that you're a good guy. You don't even need to defend yourself. The only thing you have to say is that you don't want to.
And if they continue insisting, write this out over email, so you have a timestamped record of your refusal. And be sure to communicate over that email that it's not just the picture that you don't want on there, you don't want your last/full name on there as well (because if you're not explicit or assertive about this, it's very likely that they will try putting your name up there with a blank picture frame). And if you really want to make sure your last name doesn't appear on that web page, create a bot that monitors that web page every 24 hours and checks for your last name.