Key Stage 3 computing · Digital literacy and online safety

KS3 online privacy and security: a guide for parents

By Key Stage 3, most children have their own accounts and devices, so computing lessons turn to the practical side of staying safe: protecting their online identity and privacy, keeping accounts secure and using technology respectfully and responsibly. Pupils learn how passwords and two-step checks work, what personal information is and why it matters, how scams try to trick people and how to think ahead about what stays online.

Online identity, privacy and security, explained

The programme of study asks pupils to understand a range of ways to use technology safely, respectfully, responsibly and securely, including protecting their online identity and privacy. This page covers the identity, privacy and security part. Recognising inappropriate content, contact and conduct, and knowing how to report concerns, is covered in a companion topic, though the two overlap in real life. For a teenager, the lessons become practical rather than rules to follow, because they are making their own decisions about accounts, photos and who to talk to.

Online identity is the version of a person that other people see: a username, a profile picture, posts, comments, game names and whatever others post about them. It builds up into a digital footprint, the trail of information left by what you share and what others share about you. Pupils learn that this trail can be copied, screenshotted and shared on, so deleting a post does not guarantee it is gone. They are taught to think before posting, to be careful about sharing details such as full name, school, address, location and routines, and to treat other people’s information and photos with the same care.

Security is about stopping other people getting into accounts or devices. The most important habit is a strong, unique password for each account. Length matters more than complexity, and many schools teach the idea of combining three random words, because a long password is hard to guess but easy to remember. Reusing a password is one of the biggest risks, because if one site is breached, criminals try the same details elsewhere. Two-step verification adds a second check, such as a code sent to a phone, so a stolen password alone is not enough. Keeping devices and apps up to date, which closes gaps that malware (harmful software) uses, locking screens and being careful on public Wi-Fi are covered too.

Scams and phishing are a regular classroom topic. Phishing messages pretend to come from a trusted sender, such as a bank, a delivery company or a friend, and rush the reader into clicking a link or sharing a password. Pupils learn warning signs: urgency, threats, unexpected prizes, requests for passwords or codes, odd sender addresses and links that do not go where they claim. The safe response is to stop, not click, check through a different route, and tell someone. Teenagers also learn that accounts they think nobody would want, including game and social accounts, are valuable to criminals.

Privacy settings come up as well. Children learn how to check who can see their posts, who can contact them and what location information their apps share, and to read what an app asks permission to do. They also learn that companies collect data about what people do online, partly to personalise adverts, and that this is another reason to share thoughtfully. Throughout, the message is that if something goes wrong, the right step is to tell a trusted adult early, because most problems are easier to fix quickly.

Words your child will hear

Online identity: How a person appears online, through their profile, posts, comments and what others share about them.
Digital footprint: The trail of information left by everything you do and share online.
Privacy settings: Controls that decide who can see your content, contact you and use your information.
Two-step verification: A second check, such as a code sent to your phone, needed in addition to a password.
Phishing: A message that pretends to be from a trusted source to trick you into clicking, paying or giving away details.
Malware: Harmful software that can steal information or damage a device.
Personal information: Details that identify you or could be used to find you, such as your name, address, school and birthday.

What the National Curriculum says

The programme of study for Key Stage 3 says:

Pupils should be taught to understand a range of ways to use technology safely, respectfully, responsibly and securely, including protecting their online identity and privacy; recognise inappropriate content, contact and conduct, and know how to report concerns
Aim: pupils are responsible, competent, confident and creative users of information and communication technology.

Objectives from the National Curriculum in England, © Crown copyright, used under the Open Government Licence v3.0.

Try it: checking a suspicious message

A message arrives: ‘Your account will be closed in 24 hours. Tap here to confirm your password.’ It looks like it is from a service your child uses. How should they decide what to do?

Notice the pressure. A deadline of 24 hours and the threat of losing the account are meant to stop you thinking. Real services rarely ask for a password in a message.
Check the sender and the link without clicking. Does the sender address match the company exactly? On many devices, pressing and holding a link shows where it really leads. A mismatch is a strong warning.
Do not use the link. Instead, open the service yourself, by the app you already have or by typing the address you know, and check for any real notices in your account.
Tell someone and report it. Show an adult, use the report or junk option on the message and delete it. If you did click or type a password, change that password straight away, change it anywhere else you used it and tell an adult.
Make the account harder to take over. Turn on two-step verification and check that the password is long and not used anywhere else.

The message shows classic phishing signs: urgency, a threat and a request for a password. The safe response is not to click, to check through the official route, to report it and tell an adult, and to protect the account with a unique password and two-step verification.

Common mistakes and how to help

Thinking a private account means nothing can spread

Privacy settings really do limit who sees content, so it is easy to treat them as a guarantee.

What helps: Explain that people who can see a post can screenshot it or share it, and a friendship can change. Settings reduce risk, but the safest approach is to share only what you would accept being seen more widely.

Believing that deleting a post removes it for good

It disappears from the profile, and any copies are out of sight.

What helps: Talk through how a post can be saved, shared or archived before it is deleted. Deleting still helps, but thinking beforehand is far more effective.

Reusing one password with small changes, or choosing a short complicated one

Remembering lots of passwords is hard, and symbols in a short password feel secure.

What helps: A long phrase of random words is stronger than a short jumble, and every important account needs its own. Explain that a password manager built into a device or browser can help remember them, and make sure the main email account is the most protected.

Assuming ‘I would never fall for a scam’ or ‘nobody would want my account’

Scams in school lessons look obvious, but real ones are convincing, and often arrive from a hacked friend’s account.

What helps: Share how clever the real ones are and make clear that anyone can be caught. Agree that nobody will be in trouble for clicking something, because telling quickly is what limits the damage.

How to help at home

Do a privacy check-up together. Sit down with your teenager and go through the settings of one account that they use. Let them lead and explain what each setting does. Offer suggestions rather than taking over the device.
Set up two-step verification. Choose one important account, such as email, and add a second check. Doing it once makes it feel ordinary, and your child can then do the same for other accounts.
Talk about the footprint. Ask what someone would learn about them from their public posts and how they would feel if a future employer or a relative read them. Keep the tone curious, not accusing.
Play ‘spot the scam’. Look at a suspicious email or text you have received and ask your teenager what gives it away. Swap roles by inviting them to challenge you, because adults get caught out too.
Agree a no-blame rule. Decide together that if something goes wrong, such as a hacked account or a message that worries them, they can tell you without losing their device. That agreement is the most protective thing in this topic.

Builds on

Key Stage 2: Acceptable online behaviour
Key Stage 2: Reporting concerns online

Leads on to

Key Stage 4: Digital media skills
Key Stage 4: Online safety and privacy as technology changes
Key Stage 4: Reporting online concerns