Grade by Grade
A. Literacy Connections and Applications · Literacy for Life: Transferable Skills, Digital Media Literacy and Diverse Voices

Online Safety, Privacy, Well-Being and Etiquette

A2 A2.2About 65 minutes
Learning goals
  • I can manage my privacy, personal data and account security with specific actions.
  • I can recognize scams and phishing by analyzing the language and design of a message.
  • I can explain how online habits affect my well-being and others', and choose habits that help.
  • I can follow online etiquette and seek permission, and I know what to do and who to ask if something goes wrong.

Words to know

personal information
Details that identify you or can locate you: full name, address, school, phone number, birthday, photos, passwords, location.
personal data
Information collected about you as you use apps and websites, like searches, location history, contacts and viewing habits.
privacy settings
Controls that let you choose who can see your posts and profile and who can contact you.
phishing
A trick message (email, text or direct message) that pretends to be from someone trusted to get you to click a link or give personal information.
passphrase
A long password made of several unrelated words, easy for you to remember and hard for others to guess.
multi-factor authentication (MFA)
A second check, such as a code sent to your phone or an authenticator app, needed to log in, in addition to your password.
netiquette
Polite and respectful behaviour online.

Remember from Grade 8

In Grade 8 you protected your privacy while researching and thought about how feeds are curated. Grade 9 goes deeper into security (scams, passphrases, account protection), personal data (what apps collect and why), well-being (yours and others'), and etiquette, the unwritten rules of communicating well online.

Let's start with a buzz

It's 9:47 p.m. and your phone buzzes: "URGENT: your parcel is on hold!" You did order a hoodie last week... Your thumb hovers over the link.

Scammers count on that moment. Reading online messages critically is one of the most practical literacy skills you'll ever learn.

Reading a message like a detective

Phishing messages are carefully written texts. You can analyze them with the same skills you use for any text: purpose, audience, word choice, design. Common clues:

  1. Generic greeting: "Dear customer" instead of your name.
  2. Urgency or fear: "within 2 hours", "your account will be closed". Pressure stops you from thinking.
  3. Odd links: web addresses that are slightly wrong, use unusual endings, or are shortened so you can't see them.
  4. Requests for personal or payment information: real companies don't ask for your password or full card number by text.
  5. Too good to be true: "You won a free phone!" for a contest you never entered.
  6. Mistakes in spelling or design, though newer scams (some written with AI tools) can look polished, so don't rely on this clue alone.
Text message from: +1 (555) 010-4477Dear customer,URGENT: your parcel is on hold!Pay a $1.99 fee within 2 hoursor it will be returned:pkg-delivery-help.co/payEnter your name, addressand card number to release it.1 Generic greeting2 Urgency: act now!3 Odd web address4 Asks for personaland payment infoDon't tap the link. Check by going to the real company's website or app yourself.
An invented phishing text with four warning signs labelled. The safe move is to not tap the link, and to check your order in the real store's app or website.

Privacy, personal data and security

Personal information (your full name, address, school, phone number, birthday, photos, location) can be used to find you, pretend to be you, or pressure you. Personal data is collected as you use apps: what you search, watch and click, where you are, who your contacts are. Companies use it to target ads and recommendations; data can also leak in a security breach.

Actions that help:

  • Use privacy settings: private accounts, approve followers, limit who can message you, turn on tag review.
  • Check app permissions: does a flashlight app really need your contacts and location? Turn off what isn't needed.
  • Turn off location sharing in posts, and avoid posting where you are while you're there.
  • Use a long, unique passphrase for each important account (for example four random words, like maple-trumpet-glacier-sock, which is just an example: never use one you've seen published). A password manager can help remember them.
  • Turn on multi-factor authentication (MFA).
  • Install updates; they often fix security holes.
  • Never share passwords, even with close friends.
Layers of protection: each one blocks what the others missThink before you click or sharePrivacy settings: who can see and contact youSoftware and app updatesMulti-factor authentication (a code or app check)A long, unique passphrase for each account
No single step is perfect, so use layers. A strong passphrase, MFA, updates, privacy settings and careful thinking each block different risks.

Well-being: yours and others'

Online spaces can be fun, creative and connecting. They can also affect sleep, mood and self-esteem.

  • Notice how you feel. After scrolling, do you feel inspired or worse about yourself? Highlight reels aren't real life; many images are edited or filtered.
  • Protect your sleep. Turn off notifications at night or charge your phone outside your bedroom.
  • Curate your feed. Mute or unfollow accounts that make you feel bad; follow ones that teach or inspire you.
  • Think about others' well-being too. A comment that seems funny to you can hurt someone. Don't pile on.

Etiquette and permission

  • Tone is hard to read in text. Short replies ("k.") or ALL CAPS can seem angry. Re-read before sending.
  • Respect the space. Stay on topic in class discussion boards; don't flood group chats.
  • Ask before adding someone to a group chat, sharing a screenshot of a private conversation, or forwarding their message.
  • Disagree respectfully: respond to the idea, not the person.

If something goes wrong

Don't reply to a scammer or harasser. Do take screenshots, block and report the account, and tell a trusted adult. If you clicked a bad link or shared a password, change your passwords right away and tell an adult. Help is also available from Kids Help Phone (1-800-668-6868, or text CONNECT to 686868) and Cybertip.ca.

Worked example

Let's analyze a direct message

A new account messages you: "hey!! saw ur art on the school page, ur so talented. im a talent scout for a game company. send me ur full name, school and a pic and i can get u a paid internship. dont tell ur parents yet, its a surprise 😉" Analyze the language and decide what to do.

  1. Purpose: it claims to offer an opportunity, but it asks for personal information (name, school, photo).
  2. Flattery: "ur so talented" lowers your guard. Flattery is a common technique in manipulative messages.
  3. Secrecy: "dont tell ur parents" is the biggest red flag. Real opportunities for teens involve parents or guardians and schools.
  4. Credibility: a brand-new account, no company name, no official email address. You can't verify who this is.
  5. Decide: don't reply or send anything. Screenshot, block, report the account to the platform, and tell a trusted adult.

This message is not safe. Flattery, requests for personal information and especially secrecy are warning signs. Screenshot, block, report and tell a trusted adult.

The secrecy rule

Any message that says "don't tell anyone" or "don't tell your parents" is a reason to tell a trusted adult right away. You will not be in trouble for asking.

Just for fun

I changed my password to incorrect.

Now whenever I forget it, the computer reminds me: "Your password is incorrect." (Please don't actually do this. Use a long passphrase!)

Hands-on activity

Privacy and security check-up

You need: your phone, tablet or computer, a grown-up, paper and a pencil.

  1. Pick two apps you use. In each, find the privacy settings. Write down who can see your posts, who can message you, and whether tag review is on. Change anything you aren't comfortable with.
  2. Go to your device's app permissions (usually in Settings). Find one app with a permission it doesn't need (for example, location for a game). Turn it off.
  3. Check whether your most important account (email, often) has multi-factor authentication. With a grown-up, turn it on if it's available.
  4. Make a family "what to do if" card: if you get a scam, if someone is mean, if you clicked a bad link. Write the steps and stick it on the fridge.

What to look for: specific settings checked, at least one change made, and a clear action card.

Your turn

1

List four clues that a message might be phishing.

2

What is the difference between personal information and personal data?

3

What is multi-factor authentication?

4

Why is maple-trumpet-glacier-sock style better than Hockey12?

5

Name two habits that protect your well-being online.

6

Why can short replies like "k." cause problems?

7

What four steps should you take if someone harasses you online?

More practice: warm-up

1

Is your school's name personal information?

2

Should you share your password with your best friend?

3

What does netiquette mean?

4

True or false: real banks often ask for your full password by text message.

5

Why should you install updates?

More practice: on your own

1

A quiz app asks for access to your contacts, microphone and location. Evaluate whether you should allow it.

2

Your friend posts a story from the cottage that shows the lake, the cottage sign and says "here all week!" What privacy risks do you see?

3

Rewrite this message to show good netiquette: "WHY DID NOBODY DO THEIR PART OF THE SLIDES???"

4

Explain how scrolling through edited highlight reels might affect someone's well-being.

5

You want to post a screenshot of a funny group-chat conversation on your public story. What should you do first?

Challenge

1

Write your own invented phishing message (3 to 4 sentences) that includes three warning signs. Then label each sign.

2

Some people say "I have nothing to hide, so privacy doesn't matter." Respond with two reasons privacy matters even for people who do nothing wrong.

3

Design a 5-rule netiquette and well-being agreement for a class group chat, and explain the reason for one rule.

Check your understanding

Quiz

1.

Which is the biggest red flag in an online message from a stranger?

2.

Which is the strongest choice for a password?

3.

What does multi-factor authentication add?

4.

Which is an example of personal data collected by an app?

5.

A message says: "Your account will be closed in 1 hour. Click here!" This uses which technique?

6.

What should you do first if you clicked a suspicious link and entered your password?

For parents and teachers

What this lesson teaches: A2.2 asks students to navigate online environments safely, manage their privacy, personal data and security, and interact in ways that support their own and others' well-being, including seeking permission.

How to help: Do the check-up together. Turn on multi-factor authentication for your teen's email. Agree on family rules for phones at night. Most importantly, promise that your teen won't lose their device just for telling you about a problem; teens often hide trouble for that reason.

Sensitive topic: the direct-message example shows grooming-style warning signs (flattery, requests for photos, secrecy). It is kept general. Help is available from Cybertip.ca and Kids Help Phone (1-800-668-6868, text CONNECT to 686868).

Common difficulties: assuming polished messages must be real; confusing privacy settings (who sees posts) with data collection (what the company collects).