Risks and guardrails7 of 11
What they know about you
Using something free means giving away information about yourself, and that information lasts far longer and travels much further than anyone expects.
How to explain it, by age
Same idea every time. What changes is how much of the machinery a kid can hold, so pick the version that fits and go up a band when it stops being interesting.
Ages 4-6
Keep it to permanence and to asking. "When you put a picture on the internet, it can be very hard to get back, so we ask before we share pictures of anyone." Include yourself in the rule, out loud, because that is what makes it a house rule rather than a restriction on her.
Try this
Ask her permission before posting a photograph of her, genuinely, and accept no as an answer. Doing it once teaches more than any explanation.
Listen for
Her asking before sharing something of somebody else's. Consent is the concept at this age, not data.
If she already has more access than most. If she uses a shared device, show her where photographs go when she takes them.
Ages 7-9
Introduce the record. "Apps keep a list of what you do. What you watched, how long, what you searched. They use it to choose what to show you next. It is not a person reading it, it is a computer keeping a list, and the list does not get thrown away."
Try this
Look at the watch history or search history on a service you both use. The length of it is the point. She will be surprised, which is the correct reaction.
Listen for
Her asking who can see it. That question is exactly right and leads naturally to the next band.
If she already has more access than most. Show her how to clear a history, and be honest that clearing the view is not the same as the company deleting it.
Ages 10-12
Introduce inference, which is the part that surprises people. "The interesting thing is not the facts you typed in. It is what can be worked out from your behaviour. When you are awake. Where you go. Who you spend time with. What you paused on. From that you can be sorted into categories you never chose and would probably not agree with."
Try this
Look together at the inferred-interests page in a service she uses, which most large platforms provide. The wrong guesses are as instructive as the right ones, because both show a profile being built without her.
Listen for
Her distinguishing what she told them from what they worked out. That distinction is the concept.
If she already has more access than most. Introduce the idea that this data is bought and sold between companies she has never used.
Ages 13+
Extend to permanence and consequence. Data collected now persists into a future neither of you can see, and gets combined with data from elsewhere. Then be specific rather than ominous: what actually goes wrong is usually mundane. An old post read by someone it was not written for, a location history revealing more than intended, a leaked database from a company that folded years ago.
Try this
Have him check his email address on a breach-notification service and see which companies have already lost his data. The list is usually long and includes services he has forgotten.
Listen for
Him reasoning about who benefits and who carries the risk, rather than simply resolving to be careful.
If she already has more access than most. Discuss why privacy is a collective problem rather than an individual one: his choices are constrained by what everyone around him has already agreed to.
Permanence, not danger
The instinct is to teach this through fear: strangers, predators, ruined futures. It backfires twice. It frightens children about the rarest outcomes, and it makes them hide the ordinary problems, which are the ones you can actually help with.
Permanence works better and happens to be more accurate. Things last. They travel. You cannot reliably take them back. That is a rule about how the world works rather than a warning about villains, and children apply rules more readily than they apply fears.
Start with your own behaviour
This is the concept where adults are least credible.
A child who has been photographed and posted for a decade, without ever being asked, will notice the inconsistency the moment you raise this. Asking her permission before you post, and honouring a refusal, is worth more than the whole conversation. It also gives her a script she can use with her own friends, which is where most of this actually plays out.
Misconceptions to address
- That deleting something removes it. It disappears from view. Copies, backups and screenshots do not care.
- That private settings mean private. It means fewer people, not none, and the company still holds all of it.
- That having nothing to hide makes it fine. The information is used to influence what you see and what you are offered, which affects everyone regardless of what they are hiding.
- Adults post photographs of their children publicly for years and then ask those children to be careful online.
Running this with a class
Have the class list everything a phone could know about a person over one ordinary day: location, timing, who they messaged, what they searched, how long they lingered. Build the list on the board. Then ask what someone could work out from it. The class arrives at inference on its own, which is the real idea.
The decision this connects to
Last reviewed August 2026