Here is an uncomfortable truth to carry into this lesson: your pupils know the platforms better than you do, and they know it. If you walk in warning them about apps by name, you will be a year out of date and they will write you off in the first five minutes. What they do not have, and what you do, is pattern recognition. They have never seen how a throwaway post resurfaces in a police investigation, a university admissions check or a job interview six years later. They have not seen how quickly "someone I met in a game" becomes a safeguarding file. Teach the patterns and the principles, let them supply the platform knowledge, and the lesson becomes a conversation instead of a lecture.
This lesson is the foundation stone for the rest of the online strand in this series. Grooming, cyberbullying and sextortion each get their own dedicated pack, so resist the urge to cover everything here. The job today is narrower: digital footprints, personal information, recognising risk, and building the reflex of telling someone early. Get that reflex established and every other online lesson lands more easily.
By the end of the lesson pupils should be able to explain what a digital footprint is and why it is effectively permanent, identify which personal details matter and how they leak, recognise the early signs of a risky online interaction, and know how and when to report, block and tell.
KCSIE 2026 frames online safety around four categories of risk that are worth having in your head as you teach, even though you will not use the labels with pupils: content, what they see; contact, who reaches them; conduct, what they do; and commerce, how they are monetised. This lesson touches all four. It is also worth knowing that the Online Safety Act 2023 now places enforceable duties on platforms to protect children, with Ofcom setting codes of practice on age assurance and harmful content. Pupils often believe the internet is a lawless space where nothing can be done. It is not, and telling them the law has caught up is genuinely empowering.
One more piece of context has changed since older resources were written: artificial intelligence. Pupils are using AI tools daily, and AI also now powers convincing fake profiles, fake images and fake voices. KCSIE 2026 addresses deepfakes and AI-generated content directly. You do not need to be an AI expert to teach this lesson; you need only land one idea, which is that seeing is no longer believing, and that verifying through a second channel, asking a person face to face, checking with an adult, is the new basic hygiene.
When I reviewed online cases involving young people, the same three leaks came up over and over. Location, given away not by announcing an address but by accumulation: a school uniform in a photo, a street sign in the background, a regular check-in at the same park. Access, meaning shared passwords, usually shared with a best friend or partner, which becomes a weapon the day the friendship ends. And audience, the belief that a private account or a disappearing message is actually private, when screenshots exist and half the followers are friends of friends of strangers. If your pupils leave understanding those three leaks, this lesson has done its job.
| Time | Activity |
|---|---|
| 5 mins | Starter. Ask for a show of hands: who has posted something they later deleted? Then the follow-up question that sets up the whole lesson: who else might still have a copy? Let the discomfort of that question do the work. |
| 10 mins | The digital footprint. Explain the two halves: the trail you leave on purpose, posts, comments, photos, and the trail you leave without noticing, searches, location data, tagged photos taken by others. Use the "sixth former applying for an apprenticeship" scenario to make permanence concrete, because consequences at 17 feel real to a 13-year-old in a way that consequences at 40 do not. |
| 15 mins | Risk recognition activity. Using the handout profiles, pupils play investigator: what can you work out about this person from what they have posted? Groups typically extract school, area, routine, family details and current location, and the realisation that they did it in ten minutes with no special tools is the most memorable moment in the lesson. |
| 10 mins | Protecting yourself. Cover the practical set: strong separate passwords and never sharing them, even with a best mate; privacy settings reviewed termly, because platforms change them; think before posting, using the "would I be happy for my head of year and my nan to see this" test; and location off by default. |
| 10 mins | Scenario discussion. Work through the handout scenarios: a stranger in a game asking which school you go to, a quiz that wants your date of birth and pet's name, a link from a hacked friend's account. For each, the same two questions: what is really being asked for here, and what would you do? Draw out that the pet's name and date of birth are password recovery answers, which reframes "harmless quiz" instantly. |
| 5 mins | Plenary. Every pupil writes down one thing they will change on their accounts tonight, and the name of the adult they would tell if something online worried them. Naming the adult matters; research and plain experience agree that children who have pre-decided who to tell, tell sooner. |
Online safety lessons surface disclosures about everything, not just online matters, because they open the door to talking about private life. Be ready for the pupil who mentions a chat that "got weird", an account they are scared of, or something a family member does online. Anything touching sexual content, images, threats or contact with adults goes to your DSL the same day, and the full grooming pack in this series gives you the detailed handling guidance. Do not examine or ask to see a pupil's phone or accounts; note what the pupil tells you and pass it on. Remember too that KCSIE 2026 expects schools to review filtering and monitoring annually, so if a pupil shows you a gap, something harmful reachable on school devices, that is valuable intelligence for your IT lead and DSL, not just a discipline matter.
Handle the investigator activity with care in a class where a pupil is subject to safeguarding arrangements, is in care, or has a family member whose location is protected. Check the profiles you use are the fictional ones supplied, and never run the exercise on real pupils' accounts, however much the class begs.
The internet remembers, even when you delete, so the time to think is before you post. Personal information leaks in dribs and drabs, and small details add up to a full picture faster than anyone expects. Seeing is no longer believing, so verify anything important through a second route. And nothing that happens online is too embarrassing or too small to tell an adult about, because early telling is what keeps small problems small.
For pupils: a trusted adult at home or school, Childline on 0800 1111, CEOP at ceop.police.uk for anything involving sexual contact or pressure online, and the platforms' own report and block tools, which pupils should actually practise using. For staff: your DSL, the Professionals Online Safety Helpline on 0344 381 4772, and the UK Safer Internet Centre's resources for schools. Internet Matters and Parent Zone offer solid material to send home, because the strongest version of this lesson is the one parents reinforce at the dinner table.