Students sort what an app records into data given and data collected as it is used, judge each sign-up field against the app's purpose, and set an account to its most private while keeping its purpose (AC9TDI8P14 nodes 1 to 3). A 5E mission lesson.
Cyber safety and privacy · Protect your accounts · about 40 minutes · Open the student lesson
Classroom resources
Load these into Waypoints Prepare: choose Load URL and paste the copied address, or download the file and import it. In Prepare, the worksheet's Teacher edition shows the answers; the student copy hides them.
SlidesDownload Present from the browser, or export to PowerPoint or PDF.
WorksheetDownload Print the student copy; the Teacher edition has the answers.
Students will be able to
I can name data an app collects without my typing it.
I can judge whether data is needed for an app's purpose.
I can set my own privacy settings and explain the trade-off.
Timing
Engage and Explore 10 min · Explain 8 min · Elaborate 16 min · Evaluate 6 min
Before class
Try the board yourself. Ava and the club app are made up.
The one idea: collect only what the purpose needs, and check your own settings, because they often start open.
Typical width (node 1): have pairs open the privacy section of one app they use (or a printed privacy policy) and list three things it collects, at least one collected as they use it.
Running the lesson
Engage: ask what an app might know that you never told it.
Explore: ask which collected-as-used items surprised them.
Explain: model the purpose test on one field aloud.
Elaborate: ask why the phone number changed from Not needed to Needed.
Evaluate: discuss which of their own settings they'd change.
The hard part (on purpose)
Students mark everything Not needed. Ask what would stop working: an app needs some data to do its job.
When students get stuck
What you will see
A question to ask
The fix
A student keeps extra data just in case (Sam's mistake).
Would the app still do its job without it?
If yes, don't collect it.
A student turns meeting reminders off too.
Why did Ava join the app?
Keep what the purpose needs; turn off the rest.
Answers to the checks
Engage: what does it know?: Ava types her name, school email and one poll answer into the club app. What else could the app know about her? Lots. As she uses the app it can record where her phone is, which pages she opens and for how long, when she signs in, and her device.
Explore: given or collected?: Sort everything the app recorded about Ava: did she give it, or was it collected as she used the app?
Four she gave (name, email, photo, poll answer), four collected as she used it (location, pages and time, device, sign-in times). The collected half is easy to forget.
Explain: does it need it?: Sam builds the sign-up form. Click the line where it first goes wrong. line 3 Line 3: news about meetings needs no birth date or home address. Data kept in case can still leak, and adds to every member's footprint.
News about meetings: The app's purpose is news about meetings. Mark every field and setting Needed or Not needed.
Name, year level and school email. Everything else is footprint without a purpose.
The excursion: Now the same form is for the excursion to the science museum. Mark each one again.
A parent or carer phone becomes needed: someone must be reachable on the day. The purpose decides, not the field.
Elaborate: Ava's settings: Ava's settings came open. Make her account as private as it can be while she still hears about meetings.
Profile members only, location off, ask before tags, ads off, reminders on. Settings often start open; checking them is how you manage your footprint.
The quiz app: A free quiz app asks to see your contacts and your location. Its purpose is quizzes. What should you do? Say no to both: quizzes don't need them Test each permission against the purpose. If it isn't needed, don't allow it.
Solutions
One possible solution for each task. Other correct programs are fine.
Elaborate: the sign-up form › News about meetings
Open task: any program that does what the step asks.
Elaborate: the sign-up form › The excursion
Open task: any program that does what the step asks.
Elaborate: Ava's settings
Open task: any program that does what the step asks.
Stretch and support
Stretch: Compare what two apps you use collect (their privacy pages) and decide which collects more than its purpose needs.
Support: The purpose test on a card: what is the app for? Would it still work without this?
Exit ticket
Name one piece of data an app collects without you typing it, and one sign-up field a club newsletter doesn't need.
Location, pages opened, sign-in times or device. A home address or date of birth.
What each step is for
Engage: what does it know?: Committing to what an app knows tests the new move: apps collect data you never type.
Explore: given or collected?: Students sort a week of data and meet the passive half of a footprint by getting some wrong first.
Explain: does it need it?: The teacher models judging one field against the app's purpose. Sam collects in case, the misconception planted after the method.
Elaborate: the sign-up form: One change at a time: the same form for two purposes, so the same field can be needed for one and not the other.
Elaborate: Ava's settings: Managing one's own footprint: students set an account to its most private while keeping what the app is for, and read each setting's trade-off.