Your digital footprint
Everything you post, like or search leaves a trace. All those traces together are your digital footprint. It is very hard to delete, and other people can see more of it than you think.
The test: would I be fine with a teacher, a grandparent or a future boss seeing this?
Keep private: home address, school, phone number, passwords, live location, school uniform in photos.
Photo metadata (called EXIF data) can store the exact GPS position where a photo was taken. Many apps remove it; some do not.
Set accounts to private. Check who can see posts, who can message you, and whether your location is shared.
"Deleted" is not gone. Others may have screenshots. Copies can stay on servers and in archives.
Active or passive?
For each trace, decide: did you choose to share it (active), or was it collected without you noticing (passive)?
Why do free apps collect so much? They earn money from adverts. The more an app knows about you, the better it can target adverts, and the more advertisers pay. A common saying: "if the product is free, you are the product".
People online, privacy and reporting
Most people online are who they say they are. But some are not, and you cannot tell from a profile picture. So the rules are about protecting yourself, not about being scared.
- People may not be who they say. A profile photo, age and name can all be fake.
- Never share personal details or images with someone you only know online. Never meet them alone.
- Be suspicious if someone asks you to keep secrets, move to a private app, or send photos. That pattern is called grooming.
- Use privacy settings: private account, only friends can message, location off, tagging needs approval.
Uncomfortable? Stop, block, report, keep evidence, tell a trusted adult. The same for cyberbullying.
Age limits: most social media apps require users to be at least 13. That is because of data law: in the UK a child can agree to an app using their data from 13. In Spain it is 14 (LOPDGDD, art. 7). Under that age, a parent must agree.
Phishing and scams
Phishing is a fake message that pretends to come from someone you trust. It tries to make you click a link, open a file, or type in a password or card number. The name comes from "fishing": throwing out bait to see who bites.
Spot the red flags
This is a different fake message. Tap every part you think is suspicious. Some parts are fine: tapping them tells you why.
Tap a part of the email.
| Scam type | How it arrives | Tell-tale sign |
|---|---|---|
| Phishing | Email to lots of people | Generic greeting, fake link |
| Spear phishing | Email aimed at one person, using their real details | Feels personal, but still pushes urgency |
| Smishing | Text message (SMS) | "Your parcel is waiting, pay £1.45" |
| Vishing | Phone call (voice) | "This is your bank, read me the code we sent" |
| Pharming | A fake website that looks real | The address is slightly wrong |
| Gaming scams | Chat in a game | Free skins or currency if you "log in" on a site |
Don't use the link in the message. Go to the real website or app yourself, or phone the number on the back of your card. Real banks never ask for your full password or a code by message.
Why does urgency work? When we feel rushed or scared, we skip checking. Scammers use pressure on purpose. This is called social engineering: hacking people instead of computers. Topic 17 (Year 9) goes deeper.
Judging information
Anyone can publish anything online. So before you believe or share something, check it. Five questions do most of the work.
Who made it? A named expert, a news organisation, a company, or an anonymous account?
When was it made? Old news shared as new is very common.
Can you find it elsewhere from reliable sources? If only one site says it, be careful.
Why was it made: to inform, to sell, or to make you angry? Content that makes you angry gets shared more, so some people make it on purpose.
Could it be edited or AI-made? Images, voices and video can all be faked now. These fakes are called deepfakes.
| Word | Meaning | Example |
|---|---|---|
| Misinformation | False, but shared by mistake | Your aunt shares an old storm photo thinking it's today's |
| Disinformation | False, and spread on purpose to mislead | A fake "news" site invents a story to get clicks |
| Clickbait | A headline made to get clicks, not to inform | "You won't BELIEVE what happened next…" |
| Filter bubble | Recommendation algorithms keep showing you more of what you already like | You only ever see one side of an argument |
Reverse image search (Google Lens, TinEye) shows where else a photo has appeared, and when. It quickly catches old photos reused with a new story.
UK law 1: the Computer Misuse Act 1990
The Computer Misuse Act makes hacking a crime. It was passed in 1990, after two men who got into Prince Philip's email account could not be convicted of anything: there was no law yet.
| Section | Offence | Maximum | Added |
|---|---|---|---|
| s1 | Unauthorised access to computer material | 2 years | 1990 (was 6 months until 2006) |
| s2 | Unauthorised access with intent to commit or help further offences | 5 years | 1990 |
| s3 | Unauthorised acts with intent to impair (or reckless about impairing) a computer | 10 years | 1990, widened 2006 |
| s3ZA | Unauthorised acts causing, or risking, serious damage (e.g. to the economy, national security, human welfare) | 14 years, or life if it risks lives or national security | 2015 |
| s3A | Making, supplying or obtaining tools to commit the other offences | 2 years | 2006 |
AQA 8525 and OCR J277 both expect the main offences: s1, s2, s3. OCR lists the Act by name in its legislation section; AQA covers it under cyber security and the impact of technology. The extra sections (3ZA, 3A) are bonus depth.
"I only looked" is not a defence. Access without permission is the offence, even if nothing is changed. Neither is "the password was easy" or "it was on a sticky note". What matters is authorisation: did the owner say you could?
Ethical hackers (penetration testers) break into systems legally, because the owner has given written permission first. Same skills, different authorisation.
UK law 2: data protection (DPA 2018 and UK GDPR)
The Data Protection Act 2018 and the UK GDPR control how organisations use personal data: any information that identifies a living person. Your name, photo, email, location, even your IP address.
Your rights
| Right | In plain words |
|---|---|
| To be informed | Be told what's collected and why (a privacy notice). |
| Of access | Ask for a copy of your data: a subject access request. Usually free; answer within one month. |
| To rectification | Get wrong data corrected. |
| To erasure | Get data deleted in many cases: the "right to be forgotten". |
| To restrict processing | Make them pause using it, e.g. while a mistake is checked. |
| To data portability | Take your data to another service in a common format. |
| To object | Say no, e.g. to direct marketing. They must stop. |
| About automated decisions | Safeguards when a computer alone makes a big decision about you, such as a loan. |
The Data (Use and Access) Act 2025 (Royal Assent 19 June 2025) amends the DPA 2018 and UK GDPR. It comes into force in stages. The 7 principles stay the same. Some changes: a list of "recognised legitimate interests" (such as crime prevention and safeguarding) that organisations can rely on; searches for a subject access request only need to be "reasonable and proportionate"; some low-risk cookies no longer need consent; and online services likely to be used by children must take extra care of children's data. The regulator, the ICO, becomes the Information Commission.
The regulator in the UK is the ICO (Information Commissioner's Office). Maximum fine: £17.5 million or 4% of worldwide yearly turnover, whichever is higher. In Spain the regulator is the AEPD; the EU maximum is €20 million or 4%.
Data protection is about organisations using personal data. It does not make it illegal for you to know a friend's phone number. And it is not the law that punishes hacking: that's the Computer Misuse Act. A data breach after a hack can involve both laws: the hacker breaks the CMA; the company may have broken data protection law if its security was poor (principle 6).
UK law 3: copyright, and licences
The Copyright, Designs and Patents Act 1988 (CDPA) protects creative work: writing, music, art, photos, films, and software code. It is automatic: no form to fill in, no © symbol needed.
How long? Usually the creator's lifetime + 70 years. A sound recording: 70 years from when it is released.
What's banned? Copying, sharing, selling, showing in public or adapting the work without permission. Also downloading from illegal sites.
Exceptions ("fair dealing"): small parts for criticism and review, quotation, private study, non-commercial research, teaching (illustration for instruction), and parody. You must use only what you need, and give credit.
Software counts as a literary work. Copying an app or game without a licence is software piracy.
Licences: the owner's permission, written down
| Licence | Can you see the code? | Can you change and share it? | Example |
|---|---|---|---|
| Proprietary | No | No: you buy the right to use it | Microsoft Office, most games |
| Open source | Yes | Yes, under the licence's rules | Firefox, Python, Linux, Scratch |
| Creative Commons | (for media, not code) | Yes, with conditions, like "credit me" | Wikipedia images, many photos |
| Public domain | – | Yes, anything | Shakespeare; CC0 works |
Build a Creative Commons licence
You made a drawing. Answer two questions to choose how others may use it.
The same laws in Spain
Spain has laws that do the same jobs. The ideas are the same; the names and numbers differ. Spain is in the EU, so EU law (like the EU GDPR) applies directly.
| Area | UK | Spain | Notes |
|---|---|---|---|
| Hacking | Computer Misuse Act 1990 | Código Penal: art. 197 bis (acceso ilegal, illegal access), art. 197 ter (hacking tools), art. 264 (daños informáticos: damaging data), art. 264 bis (stopping a system working) | 197 bis: 6 months to 2 years. 264 and 264 bis: 6 months to 3 years (more if serious) |
| Personal data | UK GDPR + DPA 2018, amended by the Data (Use and Access) Act 2025 | EU GDPR + LOPDGDD (Ley Orgánica 3/2018) | Same 7 principles. Regulator: ICO / AEPD. Age of digital consent: 13 / 14 |
| Copyright | CDPA 1988 | Ley de Propiedad Intelectual (LPI, Real Decreto Legislativo 1/1996) | Both: automatic, life + 70 years. In Spain, moral rights (to be named, to protect the work) can't be given up |
| Child protection | Online Safety Act 2023; KCSIE guidance for schools | LOPIVI (Ley Orgánica 8/2021) | LOPIVI: every school needs a wellbeing and protection coordinator and protocols, including for cyberbullying |
A student in Madrid guesses a classmate's Instagram password and reads her messages. In the UK that's CMA s1. In Spain it is art. 197 bis of the Código Penal (acceso ilegal a un sistema informático). Under-14s in Spain can't be tried criminally, and 14 to 17-year-olds go through the youth justice law (Ley Orgánica 5/2000); in England and Wales the age of criminal responsibility is 10.
The LOPDGDD adds a list of digital rights (Title X), such as the right to digital disconnection from work, and digital education in schools. And the EU AI Act (2024) bans some uses of AI in Spain, such as social scoring.
Environmental impact
Digital feels weightless, but it isn't. Devices are made from mined metals, run on electricity, and end up as waste. Most of a phone's impact happens before you even switch it on.
| Fact | Number |
|---|---|
| E-waste made worldwide in 2022 (Global E-waste Monitor 2024) | 62 million tonnes |
| How much of it was properly collected and recycled | about 22% |
| Data centres' share of world electricity in 2024 (IEA) | about 1.5%, and growing fast with AI |
| People offline in 2024 (ITU) | about 2.6 billion: a third of the world |
Technology also helps the environment: smart meters, route planning that saves fuel, video calls instead of flights, climate models. Ethics questions rarely have a one-sided answer.
In the UK, the WEEE Regulations 2013 make sellers take back old electricals. In Spain the same EU rule is Real Decreto 110/2015: large electronics shops must take back a very small old device (like a phone) for free, even if you buy nothing.
Ethics: legal is not the same as right
Laws say what you must do. Ethics asks what you should do. Many tech questions have no law yet, or good people disagree. The skill is to see every side.
Dilemma deck
Read the dilemma. Choose where you lean. Then see the arguments on both sides.
| Theme | The question |
|---|---|
| AI bias | AI learns from past data. If the past was unfair, the AI copies it. In 2018 a big company dropped an AI CV-sorter that had learned to mark down CVs mentioning "women's". |
| Surveillance | Privacy vs safety: should governments read messages, or scan faces in crowds, to catch criminals? |
| Jobs | Automation removes some jobs and creates others. Who gets the new ones? |
| Digital divide | People without devices, internet or skills fall behind: in school, banking, health and jobs. |
| Accessibility | Tech can include disabled people (screen readers, captions) or shut them out, depending on design. |
Screen time and wellbeing
Many apps are designed to keep you scrolling. That is not an accident: more time in the app means more adverts seen. This is called persuasive design.
| Design trick | What it does | Push back |
|---|---|---|
| Infinite scroll, autoplay | Removes the natural "stop" point | Set a timer; turn autoplay off |
| Streaks | Makes you feel you'll lose something if you skip a day | Notice the feeling: it's designed |
| Notifications | Pulls you back in (the trigger) | Turn off all but messages from people |
| Likes and follower counts | Turns friendship into a score | Hide like counts where the app allows |
It's not only how long but what and when. Making, learning and talking to friends is different from endless scrolling. Phones out of the bedroom at night helps sleep more than any app limit.
The UK's Children's Code (Age Appropriate Design Code, from the ICO, 2021) says apps likely to be used by children must have high privacy settings by default, and must not use "nudge" tricks to get children to give up privacy. It comes from data protection law (Step 6).
Common mix-ups
These are the mistakes almost everyone makes at first. Read the left side, then the right.
Logging into someone's account is fine if you don't change anything.
Unauthorised access alone is an offence: CMA section 1. Spain: Código Penal art. 197 bis.
Copyright needs a © symbol, or must be registered.
Copyright is automatic the moment an original work is made.
If it's on Google Images, it's free to use.
Being findable doesn't mean free. Check the licence. Use Creative Commons search filters.
Giving credit makes any copying legal.
Credit is only enough if the licence says so (CC BY) or it's fair dealing. Otherwise you need permission.
The Data Protection Act is the hacking law.
DPA = how organisations handle personal data. CMA = breaking into computers.
Deleting a post removes it for ever.
Screenshots, shares and server copies can last. Think before posting.
Only gullible people fall for phishing.
Good phishing fools experts. It uses urgency and real details. Checking habits matter more than being "clever".
If it's legal, it's ethical.
Law is the minimum. Many apps are legal but still designed to hook you.
Check yourself
Quick questions first. Then endless scenario practice: a wrong answer explains the reasoning, step by step.