Protecting Personal Information Online

Active learning works for this topic because digital safety skills require hands-on practice. Students need to test their own strategies in realistic, low-risk situations to understand the consequences of weak passwords or misjudged privacy settings.

• Year 7
• Technologies
• 4 activities
• 25 min–40 min

Learning Objectives

1. Design a secure password strategy incorporating length, character variety, and avoidance of personal information.
2. Analyze suspicious emails and websites to identify indicators of phishing attempts.
3. Evaluate the privacy settings of common online platforms to justify appropriate data sharing levels.
4. Create a digital citizenship plan that outlines responsible online information management.

Role Play

⏱ 35 min·Pairs

Role-Play: Phishing Hunt

Distribute printed mock emails and websites to pairs. Students list three phishing indicators per item, such as fake links or pressure tactics, then swap with another pair for verification. Groups report top red flags to the class.

Prepare & details

Design a strategy for creating and managing secure passwords.

Facilitation Tip: For the Phishing Hunt, assign roles like ‘hacker’ and ‘user’ to keep the simulation active and focused on specific red flags.

Setup: Open space or rearranged desks for scenario staging

Materials: Character cards with backstory and goals, Scenario briefing sheet

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Role Play

⏱ 40 min·Small Groups

Password Strength Challenge: Small Groups

Provide criteria sheets for strong passwords. Groups generate five examples, test them using an online strength checker, and refine based on results. Each group shares one winning password and explains its features.

Prepare & details

Evaluate the authenticity of suspicious emails or websites.

Facilitation Tip: In the Password Strength Challenge, provide a timer and rotation so groups test each other’s passwords under pressure.

Setup: Open space or rearranged desks for scenario staging

Materials: Character cards with backstory and goals, Scenario briefing sheet

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Role Play

⏱ 30 min·Whole Class

Privacy Audit Trail: Whole Class Demo

Project common social media platforms. As a class, walk through adjusting settings step-by-step, voting on best options via hand signals. Students then apply changes to demo accounts and note personal takeaways.

Prepare & details

Justify the importance of managing privacy settings on social media and other platforms.

Facilitation Tip: During the Privacy Audit Trail, project a live social media profile so the whole class spots visibility gaps together.

Setup: Open space or rearranged desks for scenario staging

Materials: Character cards with backstory and goals, Scenario briefing sheet

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Role Play

⏱ 25 min·Individual

Strategy Design Sprint: Individual to Pairs

Individuals brainstorm a personal password management plan. Pair up to critique and improve plans using a checklist. Pairs present final strategies with justifications to the group.

Prepare & details

Design a strategy for creating and managing secure passwords.

Setup: Open space or rearranged desks for scenario staging

Materials: Character cards with backstory and goals, Scenario briefing sheet

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Teaching This Topic

Teach this topic through cycles of demonstration, practice, and reflection. Start with concrete examples students recognize, then guide them to abstract rules. Avoid overwhelming them with too many technical details at once. Research shows that spaced repetition of safety checks helps habits form, so revisit strategies in later lessons.

What to Expect

Successful learning looks like students confidently identifying phishing cues, creating passwords that resist cracking attempts, and adjusting privacy settings with clear reasoning. Assessment should show they can apply strategies beyond the classroom.

Watch Out for These Misconceptions

Common Misconception

During Password Strength Challenge, watch for students assuming personal details make passwords secure.

What to Teach Instead

Provide a live password cracker tool during the challenge so groups see how quickly simple passwords fail, then guide them to replace dictionary words and birthdays with random combinations.

Common Misconception

During Privacy Audit Trail, watch for students believing default privacy settings protect them.

What to Teach Instead

Have students screenshot a social media profile before and after changing settings, then compare visibility with peers to highlight gaps in default protections.

Common Misconception

During Role-Play: Phishing Hunt, watch for students dismissing phishing emails from familiar senders.

What to Teach Instead

Use spoofed email addresses in the role-play that mimic real contacts, then prompt students to verify sender details beyond the display name during the debrief.

Assessment Ideas

Quick Check

After Role-Play: Phishing Hunt, present students with 3-4 example emails. Ask them to circle any suspicious elements and write one sentence explaining why each is a potential phishing attempt.

Discussion Prompt

After Privacy Audit Trail, pose the question: ‘Imagine a new social media app asks for access to your contacts, location, and microphone. What questions would you ask about their privacy policy, and what settings would you adjust before signing up? Why?’ Facilitate a class discussion on their responses.

Exit Ticket

After Strategy Design Sprint, give students a card with a scenario: ‘You receive a text message saying your online game account is locked and you need to click a link to verify your details.’ Ask them to write two specific actions they would take and one reason why those actions are important for protecting their information.

Extensions & Scaffolding

• Challenge: Students create a ‘phishing quiz’ with five deceptive emails, then swap with peers to test recognition skills.
• Scaffolding: Provide a checklist of phishing clues for students to reference during the role-play.
• Deeper exploration: Assign a research task on how data brokers collect and sell personal information, tying privacy settings to real-world consequences.

Key Vocabulary

Phishing	A fraudulent attempt to obtain sensitive information, such as usernames, passwords, and credit card details, by disguising oneself as a trustworthy entity in an electronic communication.
Two-factor authentication (2FA)	A security process that requires two different forms of identification to access an account, adding an extra layer of protection beyond just a password.
URL	Uniform Resource Locator, the address of a webpage on the internet. Phishing attempts often use slightly altered or misspelled URLs to trick users.
Privacy settings	Controls offered by online services that allow users to manage who can see their information, posts, and profile details.
Data breach	An incident where sensitive, protected, or confidential data is copied, transmitted, viewed, stolen, or used by an unauthorized individual.