The internet safety lesson that works at KS4 is not the one that warns pupils about the internet. They have lived their whole conscious lives online and they will spot condescension in the first thirty seconds. What they have not necessarily done is think structurally about the systems they swim in: how their data becomes a product, how algorithms shape what they believe, how a permanent record is being built of a person who is still becoming themselves, and how the same AI tools they use for homework are being used to deceive them. This lesson treats them as near-adults about to inherit full responsibility for their digital lives, and gives them the systems-level literacy that the earlier lessons could only gesture at.
The other shift at this age is stakes. A KS4 pupil's digital footprint is about to be read by college admissions tutors, apprenticeship employers and, in a few short years, the people deciding whether to hire them. Their financial life is beginning, which brings scams engineered specifically for young people. And their capacity to cause harm to others online, not just suffer it, is now real, with real legal consequences. KCSIE 2026's framing of online safety around content, contact, conduct and commerce maps neatly onto this cohort, and the conduct and commerce strands, largely theoretical lower down, are live here.
By the end of the lesson pupils should be able to explain how the attention economy and recommendation algorithms shape what they see and think, manage a digital footprint with future employment and study in mind, recognise the scams engineered for young people including money muling and investment fraud, navigate AI-generated deception, and understand their own legal responsibility for what they post and share.
Give this cohort the machinery, because they are ready for it and nobody else is telling them. The products they use free are funded by their attention and their data, and the design goal of every feed is time on app, which is why infinite scroll, autoplay, streaks and notifications exist. This is not a conspiracy, it is a business model, and understanding it is the difference between using the tools and being used by them. The recommendation algorithm is the sharp end: it learns what holds each person and serves more of it, which quietly narrows what a young person sees, hardens what they believe by feeding them agreement, and, as covered in depth in the Prevent and hate speech packs, can walk a curious teenager toward extreme content one recommendation at a time. Teaching pupils to notice their feed shaping them, and to deliberately break their own filter bubble, is genuine protection.
The fraud aimed at this age group got noticeably more sophisticated over my time, and it stopped looking like fraud. The recruitment for money muling arrives as a peer offering easy money on a normal social platform, dressed with photos of cash and watches. Investment and crypto scams are pitched by accounts that look like successful young people, sometimes using deepfaked videos of celebrities. Job scams target school leavers with fake vacancies that harvest bank and ID details. What these share is that they are engineered for exactly the optimism and inexperience of a 15 to 17-year-old, and they arrive inside platforms pupils trust. The single most protective habit I could give a young person was a reflex: if money is offered for almost nothing, or a return sounds too good, the missing risk is being carried by you, and you cannot yet see how.
Move the digital footprint conversation from abstract permanence to concrete consequence, because this cohort is close enough to hiring for it to bite. Admissions tutors and employers do look, and a public account is a public document. The point is not fear but authorship: a young person can deliberately curate a footprint that helps them, lock down what should be private, and understand that screenshots make even deleted and disappearing content potentially permanent. This is also where you address their conduct, since at this age they are creators, not just consumers. A pupil who shares a deepfake, joins a pile-on, or forwards an intimate image is now doing something with real legal weight, covered in the cyberbullying and grooming packs, and the footprint records it. Authorship cuts both ways: you are building a record of who you are, so build it on purpose.
| Time | Activity |
|---|---|
| 5 mins | Starter. Ask: what did the last thing you watched or scrolled want from you? Push past "to entertain me" to the honest answer, your time and your data, and use that to open the attention economy. |
| 12 mins | The systems. The business model of free platforms, the mechanics of recommendation algorithms, and the filter bubble. Have pupils reverse-engineer their own feeds: what does the algorithm think you are, and is it right? This is engaging precisely because it is about them, not at them. |
| 12 mins | Scams engineered for you. Money muling, investment and crypto fraud, job scams, and deepfaked endorsements, using the handout examples. The reflex to install: unexplained easy money and too-good returns mean hidden risk that lands on you. Link muling explicitly to the county lines pack, because they are the same trap wearing different clothes. |
| 12 mins | The footprint and authorship. Curate versus leak, employer and admissions reality, and conduct with legal weight. Practical task: pupils audit their own most-used account against a short checklist and note one change to make. Then the harder reflection, what does your footprint currently say about who you are, and is that who you mean to be? |
| 12 mins | AI and deception. Deepfakes, cloned voices, AI-written scam messages, and fake profiles at scale. The survival skill: verify anything important through a second channel, and treat urgency plus a request for money or data as the classic tell. Tie to KCSIE 2026's explicit deepfake content. |
| 7 mins | Plenary. Each pupil commits to one systems-level habit: breaking their filter bubble, the too-good-to-be-true reflex, a footprint change, or second-channel verification. Share a few aloud. |
This lesson surfaces fraud involvement, image issues, and exposure to extreme content, and each has its own route. A pupil who reveals they are muling money is very likely being exploited and criminally exposed at once, so this goes to the DSL with the county lines framing in mind, not treated as a discipline matter. Anything touching intimate images, contact from adults, or sexual content follows the grooming pack's protocols and reaches the DSL the same day. Disclosure of radicalising content connects to the Prevent pack and your Prevent lead. Remember too that KCSIE 2026 requires an annual review of filtering and monitoring: if pupils reveal that harmful content is reachable on school devices or networks, that is intelligence for your DSL and IT lead, logged and acted on, not just noted.
Handle the footprint-audit activity carefully. Never have pupils display real accounts to the class, keep the audit private to each pupil, and be conscious that a pupil in care or with a protected address may have footprint concerns that are genuinely serious rather than reputational.
Free platforms sell your attention and data, and the feed is engineered to hold you, so notice it shaping you and break the bubble on purpose. The scams aimed at your age are built for your optimism and arrive inside apps you trust: easy money and too-good returns mean the risk is hidden and it is yours. Your footprint is a document employers and colleges will read, so author it deliberately. AI means seeing is not believing, and second-channel verification is now basic hygiene. And what you post and share carries real legal weight now, because you are a creator, not just a viewer.
For pupils: the school safeguarding team for anything involving their safety, Childline on 0800 1111 up to 19, CEOP at ceop.police.uk for online sexual pressure, and Action Fraud (actionfraud.police.uk, 0300 123 2040) for scams and fraud. If a pupil thinks they have been drawn into money muling, the honest route is telling a trusted adult early, exactly as in the county lines pack. For staff: your DSL, the Professionals Online Safety Helpline on 0344 381 4772, and the UK Safer Internet Centre and Internet Matters for classroom and home-facing resources. Cifas and the major banks publish strong anti-muling material aimed at exactly this age group and worth putting in front of parents.