Unit 1, Day 5: Privacy and Your Digital Footprint

Lesson 5 of 6 in Unit 1, Spot It, Lock It, Recover

School-year day: Day 5 of 180
Time: 20-minute core + 30-minute extension (50 minutes in all)

Teacher Talk with MystrS. Checked October 27, 2026 (Pacific time). Tags: Cyber.

Existing lessons: /cyber/public-wifi-risks/, /teach-it-this-week/public-wifi-risks/, /cyber/contactless-rfid-card-theft/, /teach-it-this-week/contactless-rfid-card-theft/, /cyber/card-skimmers/, /cyber/safe-signal/

Goal: Students will be able to:

Sort what is fine to share, what to change first, and what never to share.
Audit a made-up app-permission screen without using real personal profiles.
Name one safer choice for public Wi-Fi logins.

Materials:

Projector
Share / Change / Never sorting mat per pair
Made-up social profile card and made-up app permission list
Exit tickets

Core (20 min)

Warm-up. Prompt: "A photo of your student ID is on a public post. What is one risk?" Students write one sentence. Keep answers general; do not collect real ID stories. (3 min)
Teach. Digital footprint: what stays online or in apps about you. App permissions: camera, mic, contacts, location; turn off what the app does not need. Oversharing: full birthdate plus school plus address on a public profile helps impostors. Public Wi-Fi: avoid logging into important accounts on open networks when you can wait (/cyber/public-wifi-risks/). Teacher FERPA / COPPA note: do not require under-13 students to create consumer accounts; do not collect home addresses or phone numbers as class work. (7 min)
Activity, Share / Change / Never. Pairs sort chips: full home address on a public profile (Never); school sports win photo with no address (Share with care); location tagging every post (Change first); contacts permission for a flashlight app (Change first); student ID barcode photo (Never or delete); favorite pizza topping in a private chat (Share); SSN from a surprise text form (Never); bank app on public Wi-Fi (Change first: wait for a safer network). Debrief two chips. (7 min)
Exit ticket. Name one permission you would turn off on a made-up app, and one thing that should never go on a public profile. (3 min)

Extension (up to 30 min)

Permission audit demo: teacher projects a made-up permission screen. Students vote which toggles to turn off. If phones are allowed by policy, students may audit silently and write only the permission name changed, never the account email. (10 min)
Footprint timeline for made-up athlete Sam: what Sam posted, what a coach or employer might see, what to lock down first. (10 min)
Optional physical privacy bridge: skim /teach-it-this-week/contactless-rfid-card-theft/ or /teach-it-this-week/card-skimmers/. Keep calm and age-appropriate. (10 min)

Check for understanding: Student correctly sorts at least six of eight chips, and names one Never item with a clear reason.

Differentiation and EL / IEP supports:

EL: three-column mat with icons; word bank (permission, location, profile, public, private).
IEP / 504: fewer chips (six); matching instead of writing OK.
Advanced: short Acceptable Use note on why a school might ban posting photos of other students' IDs.
COPPA / FERPA: no real under-13 account creation; no harvesting personal data for a class spreadsheet.

Standards (from our standards map):

CSTA 2026: S1-CYB-PP-14; HS-SYS-SE-32; MS-DAT-IM-28 / related data privacy practices as mapped
CSTA 2017: 2-IC-23 where adopted; 2-NI-05
NICE: PD-WRL-003; OG-WRL-005 (teacher framing)
ISTE Student Digital Citizen (2.1.a / 2.1.b) only if your district uses ISTE; skip otherwise
NSPFE: Managing Risk

Certification alignment (ISC2 CC): Domain 1.1 Privacy; Domain 5.1 data handling concepts at awareness level. Outline: English, Revised 01-2026, effective September 1, 2026. https://www.isc2.org/certifications/cc/cc-certification-exam-outline

Sources

CISA: Limit Your Digital Footprint, checked October 27, 2026.
CISA: Manage Application Permissions for Privacy and Security, checked October 27, 2026.
FTC: Protecting Your Child's Privacy Online, teacher FERPA/COPPA awareness, checked October 27, 2026.
CyberSandberg public-wifi-risks article/lesson, checked October 27, 2026.
ISC2 CC Exam Outline, Revised 01-2026, checked October 27, 2026.