Total duration: 3 hours 45 minutes (225 minutes) | Target group: parents | Break: 15 minutes at mid-point
Covers sections 1–3.2 of Chapter III of the theoretical part.
By the end of Workshop 1, parents will be able to protect their devices with antivirus software and regular updates, create strong and unique passwords, activate multi-factor authentication on their key accounts, and recognise the most common types of phishing and online data threats.
- They understand why antivirus software and system updates are the first, indispensable layer of digital defence.
- They can create a strong passphrase using the 'Secret Story' technique and understand why password reuse is dangerous.
- They activate MFA on at least one of their main accounts during the session.
- They can distinguish between different types of personal data and apply a simple check before sharing information online.
- They recognise the red flags of a phishing message and know how to apply the 'Go to the Source' rule.
- They leave with 1–3 concrete security actions they will apply during the coming week.
Workshop 1 Agenda
Time | Activity | Description |
|---|---|---|
00:00–00:15 | Arrival, introduction, ice-breaker | "My digital home" - what protects a physical home vs. a digital one. |
00:15–01:00 | M1: Device Protection & Updates | Antivirus, updates, mobile security, scareware vs. real alerts (sec. 1). |
01:00–01:45 | M2: Strong Passwords & Passphrases | Anatomy of a strong password, passphrase technique, password reuse trap (sec. 2.1–2.2). |
01:45–02:00 | Coffee break | - |
02:00–02:45 | M3: 2FA, MFA & Password Managers | Layers of security, enabling MFA, digital vaults and passkeys (sec. 2.3–2.5). |
02:45–03:30 | M4: Personal Data & Recognising Phishing | What is personal data, cookies, phishing red flags, STOP rule (sec. 3.1–3.2). |
03:30–03:45 | Summary, personal plan, feedback | "One security habit I start today." |
Opening (15 min) - Welcome and Ice-Breaker
Objectives:
- Create a relaxed, non-judgmental atmosphere.
- Introduce the metaphor of the 'digital home' that frames the entire chapter.
Step by step:
- Welcome participants individually; help them write their first name on a name badge (3 min).
- Introduce yourself briefly - your name, role and one sentence about why digital security matters to you personally. Demystify the 'expert' role. (2 min)
- Draw a simple house on the flipchart. Ask: 'What protects your physical home?' Write answers around the house (door, lock, alarm, habits). Then ask: 'What protects your digital home?' Guide participants toward antivirus, passwords, updates, and safe habits. (6 min)
- Briefly announce the workshop agenda and what participants will take home. (1 min)
- Present the group rules: we listen until the end, there are no stupid questions, phones stay on the table - we will use them. (1 min)
🧑🏫 Trainer Note The 'digital home' metaphor is the thread connecting all eight modules - refer back to it whenever useful. If a participant says 'I am not technical at all', respond: 'Then you are exactly the right person for today's workshop.' Do not skip the ice-breaker - it builds the trust that will make the hands-on activities work. Distribute the folders with Chapter III at the beginning, not at the end. |
Module 1 - Device Protection & Updates (45 min)
↪ Correspondence with Part I: Sections 1.1–1.5 - 'Antivirus Software - Necessity or Fad'
Related Chapter | Sections 1.1–1.5 - Antivirus Software and Device Protection |
Duration | 45 minutes |
Target Group | Parents with low/medium level of digital literacy (G2) |
Materials | Projector/screen, participants' smartphones, printed scenario cards (Safe or Unsafe?), flipchart, markers |
Group Size | 8–14 participants |
Handouts | Worksheets 1–4 from the Parent Worksheets Booklet (Workshop 1, Module 1): W1 - Real Alert or Scareware? (Ref. 1.1–1.2); W2 - Safe or Unsafe? (Ref. 1.3–1.4); W3 - What Are We Sharing? (Ref. 3.1); W4 - The Permission Check (Ref. 1.3–1.5) |
Learning Objectives
- The participant understands that antivirus software is one indispensable layer of a broader defence strategy, not a magic solution.
- The participant distinguishes between real security alerts and scareware (fake, fear-based pop-ups).
- The participant can check whether their device has active protection and pending updates.
- The participant applies basic mobile security practices: reviewing app permissions, downloading only from official stores.
Session Plan
Time | Activity | Method | Materials |
|---|---|---|---|
0:00–0:08 | Icebreaker: 'The Digital House' | Group discussion + flipchart | Flipchart, markers |
0:08–0:20 | Activity: Real Alert or Scareware? + Device Check (Worksheet 1) | Group analysis + individual on devices | Projected pop-up examples + smartphones + Worksheet 1 |
0:20–0:30 | Mini-lesson: What threatens our digital home? | Presentation + Q&A | Projector |
0:30–0:42 | Game: Safe or Unsafe? (Worksheet 2) | Small groups | Worksheet 2 |
0:42–0:48 | Activity: What Are We Sharing? (Worksheet 3) | Individual + pairs | Smartphones + Worksheet 4 |
0:48–0:50 | 📋 Wrap-up | Individual | Learning box on Worksheet 3 |
Detailed Activity Guide
🎯 Icebreaker: 'The Digital House' (8 min)
🧑🏫 Trainer Note This activity was introduced in the Workshop opening - if time is short, refer back to it briefly rather than repeating the full exercise. The 'digital home' metaphor will recur throughout all eight modules. Use it consistently. Avoid technical vocabulary. If a participant says 'antivirus', great - if not, guide them there naturally. |
- Draw a simple house outline on the flipchart.
- Ask: 'What protects your physical home?' Write answers: doors, locks, alarm, cameras, good habits.
- Ask: 'What protects your digital home?' Guide toward: antivirus, passwords, updates, screen lock, safe downloading.
- Conclude: 'Just as we would not leave our front door open, we cannot afford gaps in our digital defences. Today we learn the first layer: protecting our devices.'
🎯 Activity: Real Alert or Scareware? - The Pop-up Challenge (12 min)
🧑🏫 Trainer Note Prepare two projected examples BEFORE the session: one real OS notification (e.g. Windows Security or iOS update prompt, screenshot) and one scareware pop-up (readily available via a web search for 'scareware example'). The contrast must be visual and immediate. Project both images side by side if possible. If not, show them sequentially. Participants work on Worksheet 1 while looking at the projected examples - they circle warning signs and complete the quick device check directly on the worksheet. This activity intentionally comes BEFORE the mini-lesson on threat types: the emotional reaction to the scareware ('that looks terrifying!') creates the right conditions for the lesson that follows. Do not reveal the answers immediately - let groups discuss for 2–3 minutes first. |
- Project Pop-up A (scareware example) and Pop-up B (genuine OS notification) on screen.
- Participants open Worksheet 1 and circle every suspicious detail on Pop-up A, then note what makes Pop-up B trustworthy (2 min).
- Small group discussion (2 min): 'What differences did you spot?'
- Plenary debrief (3 min): collect answers on the flipchart. Guide toward: official notifications do not use alarming language, do not appear in the browser, do not display countdown timers, and never ask you to call a number or pay immediately.
- Participants complete their 'scareware rule' and quick device check on Worksheet 1 individually (5 min).
Key message: 'Scareware is designed to bypass rational thinking by triggering panic. Recognising it is the first defence. The second defence is the rule: close the window, never click inside it, then verify through your actual security settings.'
🎯 Mini-lesson: What threatens our digital home? (10 min)
🧑🏫 Trainer Note Build directly on the scareware activity - participants have already seen one real example. Use the four threat types as labels, not lecture topics - one sentence each is enough. The key message is not the taxonomy of threats, but the fact that threats are now automated, invisible, and do not require the user to make an obvious mistake. |
Introduce the four main threat categories with a one-sentence definition each:
- Virus - a program that spreads between files and devices, damaging data.
- Malware - any software designed to damage, monitor, or steal information (viruses are one type of malware).
- Spyware - software that secretly collects personal data and transmits it to third parties.
- Ransomware - malware that encrypts files and demands payment to restore access.
Ask: 'Have you ever received a suspicious pop-up or warning on your device? What did you do?' Allow 2–3 brief responses. Validate any instinct to close, ignore, or verify through settings.
Key message: 'Most cyber threats today do not wait for the user to make an obvious mistake - they actively look for unpatched vulnerabilities. Your behaviour matters, but so does your security software.'
🎯 Hands-on: Device Safety Check (12 min)
🧑🏫 Trainer Note This is integrated into Worksheet 1, right after the pop-up challenge. Participants tick off the quick checks while you guide them step by step on the projector. Walk around the room and support those who need help. Pair more confident participants with those who feel uncertain. Never ask participants to enter passwords or sensitive data during this exercise. Have 2–3 spare devices available for those who have forgotten theirs. |
Guide through the quick checks on Worksheet 1, step by step:
- Protection status: Android → Play Protect; Windows → Windows Security; iPhone → confirm iOS is up to date.
- Pending updates: 'Updates are security repairs. Every ignored notification is an open door.'
- Screen lock: verify PIN, fingerprint, or Face ID is active on every device. 'A locked device buys time to remotely erase data if lost or stolen.'
- One app permission check: Settings → Apps / Privacy → Permission Manager. Ask participants to check just one app's camera/microphone access - 'Does it make sense for this app to need this?'
🎯 Game: Safe or Unsafe? (6 min)
🧑🏫 Trainer Note Participants use Worksheet 2 to record their answers - print physical scenario cards too for tactile group engagement. After each scenario, ask: 'Why?' - the reasoning matters more than the correct answer. Keep the pace fast: this is a game, not a test. |
Scenario | Expected Answer |
|---|---|
Download a free game from an unknown website. | UNSAFE - unofficial sources often bundle malware. |
Install an app from the official Google Play or App Store. | GENERALLY SAFE - always check reviews and permissions first. |
A pop-up says: 'Your phone has 57 viruses! Click SCAN NOW!' | UNSAFE - classic scareware. Close it; verify through official security settings. |
Your operating system prompts you to install a security update. | SAFE - install it. Delays leave known vulnerabilities open. |
A calculator app requests access to your contacts and microphone. | UNSAFE - excessive permissions are a warning sign. |
Key Messages of the Module 1. An antivirus is one essential layer of protection - not a substitute for safe behaviour, but a safety net for the moments when human eyes cannot detect the threat. 2. Updates are security repairs. Delaying them means leaving known vulnerabilities deliberately open. 3. Scareware is designed to cause panic. A real security alert never demands that you call a number or pay immediately. |
Trainer Tips
|
Module 2 - Strong Passwords & Passphrases (45 min)
↪ Correspondence with Part I: Sections 2.1–2.2 - 'The Importance of Passwords in Securing Accounts'
Related Chapter | Sections 2.1–2.2 - Password Anatomy and Password Reuse |
Duration | 45 minutes |
Target Group | Parents with low/medium level of digital literacy (G2) |
Materials | Projector/screen, paper, pens, markers |
Group Size | 8–14 participants |
Handouts | Worksheets 5–6 from the Parent Worksheets Booklet (Workshop 1, Module 2): W5 - Rank the Passwords (Ref. 2.1); W6 - The Password Reuse Trap (Ref. 2.2) |
Learning Objectives
- The participant recognises common password mistakes (short, predictable, based on personal data).
- The participant understands why a long passphrase is often stronger than a short complex password.
- The participant creates their own 'Secret Story' passphrase - a memorable phrase that is hard for machines to guess.
- The participant understands the chain-reaction risk of password reuse through the 'credential stuffing' concept.
Session Plan
Time | Activity | Method | Materials |
|---|---|---|---|
0:00–0:08 | Icebreaker: 'The Secret Code' | Group discussion | Flipchart |
0:08–0:18 | Mini-lesson: Why passwords matter - and how they fail | Presentation + discussion | Projector |
0:18–0:30 | Game: Rank the Passwords | Small groups | Worksheet 4 |
0:30–0:42 | Hands-on: Build a 'Secret Story' Passphrase | Individual + pairs | Paper, pens |
0:42–0:48 | Discussion: The Password Reuse Trap | Group discussion | Flipchart |
0:48–0:50 | 📋 Handout + Wrap-up | Individual | Worksheets 5–6 |
Detailed Activity Guide
🎯 Icebreaker: 'The Secret Code' (8 min)
🧑🏫 Trainer Note This activity connects the abstract concept of passwords to a childhood experience everyone has had. Keep it light and fast - 30 seconds per person maximum. The goal is to surface the emotional logic behind passwords: they protect what matters to us. |
- Ask: 'When you were a child, did you ever have a secret code or hiding place with friends or family?'
- Invite 3–4 volunteers to share briefly.
- Ask: 'Why did you use a secret code? - To keep others out. To identify trusted people. To protect something.'
- Connect: 'Passwords serve exactly the same purpose. They are the keys to our digital lives - and like physical keys, some are much stronger than others.'
🎯 Mini-lesson: Why passwords matter - and how they fail (10 min)
🧑🏫 Trainer Note Start with the 'email as master key' insight - it tends to generate a strong 'aha' moment. Do not go into technical details about hashing algorithms. Focus on the human behaviour that makes passwords weak. The most common reaction is: 'I never thought about how many accounts my email can reset.' Build on this. |
Ask participants: 'How many online accounts do you think you have?' Write a few answers on the flipchart. (Most people underestimate significantly - research suggests the average is 80–100.)
Ask: 'Which account would be most damaging to lose?' Guide toward: email - because it can be used to reset passwords for almost every other service.
Introduce common password mistakes:
- Using personal information: names, birthdays, pet names, birth year.
- Using predictable patterns: 'Password1!', sequences like '12345678', keyboard walks like 'qwerty'.
- Using short passwords - modern computers can test millions of combinations per second.
- Sharing passwords or writing them in visible places.
Introduce the concept of entropy: what makes a password genuinely hard to guess is unpredictability, not just complexity symbols. A 20-character passphrase built from unrelated words is exponentially harder to crack than an 8-character password with symbols, because its unpredictability comes from human memory rather than predictable rules.
🎯 Game: Rank the Passwords (12 min)
🧑🏫 Trainer Note Teams of 3–4 receive worksheet 4. They rank from weakest to strongest before the reveal. The goal is not the correct ranking - it is the discussion. Why did they choose this order? Make it slightly competitive: 'Which group got the ranking exactly right?' |
Card | Password | Strength & Reason |
|---|---|---|
A | 123456 | Very weak - the single most common password globally. |
B | Maria1980 | Weak - personal information, predictable pattern. |
C | Football22! | Weak-medium - common word, predictable substitution. |
D | P@ssw0rd! | Weak despite 'complexity' - follows predictable rules that hacking software knows. |
E | BlueTrainRiverMoon | Strong - long, four unrelated words, no personal data. |
F | i-PlaYeD-bAll-on-SundaY-26-vito! | Very strong - a personal story with irregular capitalisation, a random number, and a name only the creator would use. |
After the reveal, explain the key insight: length and unpredictability beat complexity. Card F is stronger not because of its symbols, but because a machine cannot guess the story behind it.
🎯 Hands-on: Build a 'Secret Story' Passphrase (12 min)
🧑🏫 Trainer Note Do NOT ask participants to reveal real passwords. Ask only: 'How many words did you use?' and 'Was it easier to remember?' Walk around the room and offer help. Some participants will find the creative step difficult - suggest starting with a funny family memory. This activity connects directly to Chapter III's 'Secret Story' activity and the 'Leo and the blue squirrel' example. |
Guide participants through the following steps on paper:
- Think of a funny or unusual memory that only your family would know (e.g., a squirrel eating a blue popsicle at the park).
- Turn it into a short sentence: 'BlueSquirrelAteIt!'
- Now strengthen it: add a random number in a non-obvious place, mix one word from another language, or use irregular capitalisation that is meaningful to you: 'blu3-Squirrel-mangiò-IT!'
- Practice typing it twice. If you can type it from memory, it works.
Debrief in pairs: 'Is it easier to remember than a string of random characters? Why?'
💬 Discussion: The Password Reuse Trap (6 min)
🧑🏫 Trainer Note Draw several houses on the flipchart - this is the 'neighbourhood key' analogy from Chapter III. The 'credential stuffing' concept does not need to be named - just explain the mechanism. |
Draw 5 houses on the flipchart and ask: 'Imagine every house in this street used exactly the same front door key. What would happen if one key were stolen?'
Participants immediately see the problem. Connect: 'Using the same password across multiple accounts creates exactly this risk. One breach in one website - even a small one you have almost forgotten - can cascade into every account you own.'
Ask: 'Which accounts should absolutely have unique passwords?' Guide toward: email, banking, government services, social media.
Key Messages of the Module 1. The strength of a password comes from unpredictability, not just complexity. A long passphrase built from a personal story is much harder for a machine to guess than a short password with symbols. 2. Your email account is the master key to your digital life - it deserves a unique, strong passphrase above all others. 3. Reusing passwords creates a chain reaction: one breach can compromise every account that shares the same key. |
Trainer Tips
|
Module 3 - 2FA, MFA & Password Managers (45 min)
↪ Correspondence with Part I: Sections 2.3–2.5 - '2FA and MFA: The Essential Layers of Security' and 'Digital Vaults and Passkeys'
Related Chapter | Sections 2.3–2.5 - Multi-Factor Authentication, Password Managers, Passkeys |
Duration | 45 minutes |
Target Group | Parents with low/medium level of digital literacy (G2) |
Materials | Projector/screen, smartphones, Worksheet 7 (The Unexpected Notification), flipchart, markers |
Group Size | 8–14 participants |
Handouts | Worksheets 7–8 from the Parent Worksheets Booklet (Workshop 1, Module 3): W7 - Activating 2FA (Ref. 2.3); W8 - My Digital Vault (Ref. 2.4–2.5) |
Learning Objectives
- The participant understands why even a strong password can be stolen and why MFA is the essential safety net.
- The participant can enable Two-Factor Authentication on at least one of their key accounts during the session.
- The participant recognises an unsolicited MFA prompt as a sign that someone is actively trying to break into their account.
- The participant understands the concept and benefit of a password manager (Digital Vault) without feeling technically overwhelmed.
Session Plan
Time | Activity | Method | Materials |
|---|---|---|---|
0:00–0:08 | Icebreaker: 'One Lock or Two?' | Group discussion + flipchart | Flipchart, markers |
0:08–0:18 | Mini-lesson: Why passwords are sometimes not enough | Presentation + discussion | Projector |
0:18–0:33 | Hands-on: Enable MFA - The Master Account Upgrade | Individual on devices | Smartphones |
0:33–0:43 | Group Exercise: The Stolen Password Scenario | Small groups | Scenario cards |
0:43–0:48 | Mini-lesson: Password Managers Made Simple | Short presentation + Q&A | Projector |
0:48–0:50 | 📋 Handout + Wrap-up | Individual | Worksheets 7–8 |
Detailed Activity Guide
🎯 Icebreaker: 'One Lock or Two?' (8 min)
🧑🏫 Trainer Note Draw two simple doors on the flipchart. This is a quick visual exercise, not a long discussion. The analogy 'password = first lock, MFA = second lock' is the key message to establish here. If someone has already heard of 2FA, let them explain it briefly - it validates their knowledge and speeds up the lesson. |
- Draw Door A (one lock) and Door B (lock + security alarm code).
- Ask: 'Which door would you choose to protect something valuable?' (Door B - everyone agrees.)
- Ask: 'Why do we often protect our online accounts with only one lock?' Allow brief answers.
- Conclude: 'A password is the first lock. 2FA adds a second lock - and we are going to activate it today.'
🎯 Mini-lesson: Why passwords are sometimes not enough (10 min)
🧑🏫 Trainer Note Build directly on Module 2. Do not re-explain passwords from scratch. The three scenarios are the core of this section - take 2 minutes each. The Unexpected Notification - what would you do? |
Ask: 'Can even a strong passphrase be stolen?' Let participants think. Guide toward: phishing sites, data breaches in third-party services, shared devices.
Present three real scenarios:
- Scenario 1: A website you use suffers a data breach. Your email and password are published on the dark web - even though you did nothing wrong.
- Scenario 2: You receive a convincing email from what appears to be your bank. You enter your credentials on a fake page.
- Scenario 3: You previously saved your password on a shared family device that another person can access.
Key message: 'MFA does not prevent password theft. It prevents unauthorized access even after the password has been stolen. A hacker with your password but without your phone is locked out of your account.'
Briefly introduce the MFA Fatigue concept: attackers sometimes flood a phone with rapid MFA approval requests, hoping the user will accidentally tap 'Approve' to clear the screen. Rule: 'If you did not start the login, never approve the request.'
🎯 Hands-on: Enable 2FA - The Master Account Upgrade (15 min)
🧑🏫 Trainer Note This is the core practical activity of the module. Every participant should leave having activated MFA on at least one account. Demonstrate live on a platform shown on the projector (Google or email account recommended). Participants follow on their own devices. Walk around the room and provide individual support. Pair confident participants with those who struggle. Never ask participants to enter their password in front of others - they should work on their own device privately. |
Guide participants through the following steps:
- Open account settings on your primary email account.
- Navigate to: Security → Two-Step Verification (or Two-Factor Authentication / MFA).
- Choose a verification method. Explain the options:
- SMS code - quick to set up, but can be intercepted via SIM-swapping. Good starting point.
- Authenticator App (Google Authenticator, Microsoft Authenticator) - generates a time-limited code locally, more secure than SMS.
- Passkey / biometric - the most advanced option; uses fingerprint or Face ID. Explore this if participants are comfortable.
- Complete the activation and store recovery codes in a safe physical location (e.g., printed and kept with important documents at home).
Important reminder: 'If you receive an MFA approval request that you did not initiate, deny it immediately. It means someone has your password and is actively trying to get in. After denying, change your password right away.'
🎯 Group Exercise: The Stolen Password Scenario (10 min)
🧑🏫 Trainer Note Groups of 3 discuss each card for 2 minutes, then share with the room. The goal is to show that the same event (password stolen) has completely different outcomes depending on whether MFA is active. |
Card | Scenario | Discussion Questions |
|---|---|---|
1 | A hacker finds your Facebook password from a data breach. MFA is disabled. | What can the hacker do? What information do they now have access to? What can they do with it? |
2 | A hacker finds your Facebook password from a data breach. MFA is enabled. | What happens when they try to log in? What wall do they hit? What do you see on your phone? |
3 | Someone learns your primary email password. MFA is enabled. | Why is the email account particularly critical? What additional barrier does MFA create here? |
After discussion, summarise: 'Passwords protect accounts from people who do not know the password. MFA protects access even from people who do.'
🎯 Mini-lesson: Password Managers Made Simple (5 min)
🧑🏫 Trainer Note Many participants will react with 'But if someone hacks the manager, they have everything!' - address this proactively. Keep it short. The goal is awareness and a first step, not a full tutorial. Use the 'key cabinet' analogy from Chapter III section 2.4. |
Ask: 'How do you currently manage your passwords?' (Show of hands: I remember them / I write them on paper / I use the browser / I use a manager.)
Introduce the concept: 'A password manager - or Digital Vault - is like a secure key cabinet. It stores all your passwords in an encrypted safe. You only need to remember one Master Passphrase to open it.'
Benefits: generates unique strong passwords for every account, autofills them for you, alerts you if any of your passwords have been leaked in known data breaches.
Examples to mention: Bitwarden (free, open-source), 1Password, or the built-in password manager in iPhone (Passwords app) or Google Chrome.
Key reassurance: 'The manager encrypts everything. Even the service provider cannot see your passwords. If you lose your Master Passphrase, there is no backup - so write it down and keep it safe at home.'
Key Messages of the Module 1. MFA is the essential safety net that protects your account even after your password has been stolen. 2. If you receive an MFA request you did not initiate - deny it and change your password immediately. 3. A password manager removes the impossible task of memorising dozens of unique passwords. You only need to remember one. |
Trainer Tips
|
Module 4 - Personal Data & Recognising Phishing (45 min)
↪ Correspondence with Part I: Sections 3.1–3.2 - 'Protecting Your Family's Online Data', 'Personal Data' and 'Phishing and Social Engineering'
Related Chapter | Sections 3.1–3.2 - What is Personal Data and Phishing / Social Engineering |
Duration | 45 minutes |
Target Group | Parents with low/medium level of digital literacy (G2) |
Materials | Projector/screen, Worksheet 8 (data sorting), Worksheet 9 (phishing examples), flipchart, markers |
Group Size | 8–14 participants |
Handouts | Worksheets 9–10 from the Parent Worksheets Booklet (Workshop 1, Module 4): W9 - Spot the Fake (Ref. 3.2); W10 - My Workshop 1 Action Plan |
Learning Objectives
- The participant understands that personal data extends far beyond names and ID numbers - it includes browsing habits, photos, location, and daily routines.
- The participant understands what website cookies are and can make a conscious choice when encountering a cookie consent banner.
- The participant recognises the red flags of a phishing message: urgency, generic greeting, suspicious sender address, link mismatch.
- The participant applies the 'Go to the Source' rule: never use a link from an alarming message - always navigate directly to the official website.
Session Plan
Time | Activity | Method | Materials |
|---|---|---|---|
0:00–0:08 | Icebreaker: 'What Would a Stranger Know?' | Group discussion + flipchart | Flipchart, markers |
0:08–0:18 | Mini-lesson: What is Personal Data - and Why It Has Value | Presentation + Q&A | Projector |
0:18–0:30 | Activity: Data Sorting Challenge + Cookie Moment | Small groups + discussion | Data-sorting cards |
0:30–0:43 | Activity: Phishing Detective | Small groups | Worksheet |
0:43–0:48 | Discussion: The 'Go to the Source' Rule | Group discussion | Flipchart |
0:48–0:50 | 📋 Handout + Wrap-up | Individual | Worksheets 9–10 |
Detailed Activity Guide
🎯 Icebreaker: 'What Would a Stranger Know?' (8 min)
🧑🏫 Trainer Note This is a powerful opening exercise - participants often surprise themselves. Focus on what can be inferred, not just what is directly stated. A photo with a school uniform and a visible street sign reveals school, neighbourhood, and routine. Keep it non-judgmental - the goal is reflection, not shame. |
- Ask: 'Imagine a stranger could see your last month of social media posts. What could they learn about you and your family?' Write answers on the flipchart.
- Guide toward: name, family members, home area, school name and schedule, daily routines, workplace, places visited, income indicators, children's physical appearance.
- Ask: 'Would you feel comfortable if a stranger knew all of this?' Allow brief discussion.
- Conclude: 'Personal information is valuable. Once shared online, it is very difficult to control where it goes or who uses it.'
🎯 Mini-lesson: What is Personal Data - and Why It Has Value (10 min)
🧑🏫 Trainer Note The key insight to land here: personal data is not just formal identifiers - it is the invisible trail of daily digital life. The GDPR reference is important for European audiences - it reframes privacy as a legal right, not just a good habit. The child identity-theft angle (synthetic identity fraud) tends to generate strong emotional engagement among parents. |
Explain: 'Personal data is any information that can identify a person - directly or indirectly.'
Direct identifiers: name, address, phone number, email, national ID number.
Indirect identifiers: location history, browsing habits, photos (including metadata), school name, daily routines, device fingerprint.
Invisible data: cookie tracking across websites, app permissions, smart-device usage patterns.
Introduce the concept of cookies briefly: small text files that websites store on a device to remember preferences, keep users logged in, or track browsing behaviour across different sites. When a cookie banner appears, participants now have the context to make a meaningful choice - not just click 'Accept All' to make it disappear.
Key message: 'When an app or website is free, we are often paying with data. Recognising this allows us to make conscious choices about what we share.'
Mention child data specifically: children's data is particularly sensitive because their records are clean, unmonitored, and can be exploited for identity fraud for years before it is discovered.
🎯 Activity: Data Sorting Challenge (12 min)
🧑🏫 Trainer Note Groups use Worksheet 8 and sort the listed information into three columns. The 'share carefully' column generates the most discussion - context always matters. The Cookie Moment takes only 3 minutes at the end - show a real cookie banner on the projector and walk through the options together. |
Groups of 3–4 sort cards into three categories:
Safe to Share Publicly | Share Carefully | Keep Private |
|---|---|---|
First name only | Full name | National ID / tax number |
General interest (e.g., 'I love hiking') | Workplace name | Home address and postcode |
Holiday photos (after returning home) | Children's school name | Children's full names + school + photo together |
- | Holiday photos (while still away) | Banking or payment details |
After sorting, discuss: 'Did any card surprise you? Which ones were hardest to categorise?'
Note: cookies are covered in depth in Workshop 2, Module 5, Worksheet 13. Mention briefly here that cookie banners are part of how personal data is collected online - 'when a site is free, you often pay with your data' - then refer participants to the dedicated worksheet in Workshop 2.
🎯 Activity: Phishing Detective (13 min)
🧑🏫 Trainer Note Print three example messages in advance. Groups analyse each one and circle every warning sign they can find. The best examples use real-looking logos (delivery companies, banks) to show how convincing modern phishing has become. Avoid examples from local politics or religion - use universal contexts: delivery, banking, streaming services, schools. |
Groups receive three printed examples (email, SMS, WhatsApp message). For each, they circle every warning sign they notice.
Example | Scenario | Red Flags to Find |
|---|---|---|
A | Email: 'URGENT - Your bank account will be suspended today! Click here to verify.' | Generic greeting ('Dear Customer'), alarming subject, suspicious link (hover reveals: mybank.account-verify.net), pressure to act immediately, no account details. |
B | SMS: 'Your package is waiting. Pay €2.50 delivery fee: [link]' | Unknown sender number, unexpected request, suspicious URL, no tracking number, no sender identification. |
C | WhatsApp: 'Hi, I'm from [School Name] IT support. We need your login to update your account.' | Legitimate organisations never ask for credentials via message, no official school channel, urgency tactic. |
After reviewing together, ask: 'What made these messages convincing despite the warning signs?' Guide toward: familiar branding, emotional urgency, appearing to come from a trusted institution.
💬 Discussion: The 'Go to the Source' Rule (5 min)
Introduce the rule: 'If you receive an alarming message from a bank, school, delivery company, or government agency - never use the link or phone number provided in that message. Open a new browser tab and navigate directly to the official website you already know. If the problem is real, you will see it there. If it is not, you have just avoided a trap.'
Ask: 'Has anyone here already done something like this without knowing it had a name?' Often participants have.
Key Messages of the Module 1. Personal data is your family's digital identity - it extends far beyond names and includes the invisible trail of everyday digital life. 2. When something online is free, you are often paying with your data. Recognising this is the first step to managing it. 3. The most effective protection against phishing is the 'Go to the Source' rule: never follow a link from an alarming message - always navigate independently. |
Trainer Tips
|
Objectives:
- Summarise the four modules in four simple messages.
- Personal plan: 1–3 concrete actions for the coming week.
- Collect feedback.
Step by step:
- Visual summary on the flipchart (3 min): recap the four key messages in one sentence each. 'Update your devices. Create a strong passphrase. Activate MFA on your email. Pause before clicking.'
- 'One habit I start today' circle (5 min): each participant says in one sentence the single security action they will take this week.
- Referral to Chapter III (2 min): 'At home, re-read Chapter III of your guide - everything we discussed today is there, with additional examples and step-by-step guides.'
- Feedback form - Annex A (3 min).
- Announcing Workshop 2: date, location, topics. (2 min)
Final message for participants - Workshop 1: 'Protecting your digital home does not require expert knowledge. It requires four habits: keep your devices updated, use strong and unique passwords, add a second lock with MFA, and pause before sharing or clicking. You have taken all four steps today. Thank you.'
WORKSHOP 2
Protecting Your Family Online
Total duration: 3 hours 45 minutes (225 minutes) | Target group: parents | Break: 15 minutes at mid-point
Covers sections 3.3–5.5 of Chapter III of the theoretical part.
By the end of Workshop 2, parents will be able to use public Wi-Fi networks safely, manage privacy settings on smart home devices and cloud accounts, establish a Family Digital Understanding, configure parental controls appropriate to their children's ages, and respond effectively when their child encounters an online risk.
- They understand the risks of public Wi-Fi and know how a VPN provides a practical layer of protection.
- They can identify what data their smart TV, voice assistant, or connected toy may be collecting and know how to audit privacy settings.
- They can draft a simple, co-designed Family Digital Understanding with clear rules, responsibilities, and consequences.
- They can configure at least one parental control feature on a family device during the session.
- They recognise the warning signs of cyberbullying, grooming, harmful content exposure, and gaming scams.
- They know how to respond when a child discloses an online incident: listen, reassure, document, act.
- They leave with 1–3 concrete family safety actions to implement before the next week.
Time | Activity | Description |
|---|---|---|
00:00–00:15 | Recap + ice-breaker | What did we apply from Workshop 1? + Opinion Barometer. |
00:15–01:00 | M5: Public Wi-Fi, VPNs & Secure Websites | Risks of open networks, VPN basics, HTTPS vs. HTTP (sec. 3.3–3.5). |
01:00–01:45 | M6: Smart Devices, Cloud & Family Digital Contract | Privacy on connected home devices, cloud settings, drafting the Understanding (sec. 3.4 + 4.1–4.2). |
01:45–02:00 | Coffee break | - |
02:00–02:45 | M7: Parental Controls, Screen Time & Leading by Example | Hands-on with tools, age-appropriate limits, adult digital behaviour (sec. 4.3–4.5). |
02:45–03:30 | M8: Online Risks - Cyberbullying to Digital Resilience | Threats, warning signs, communication, LISTEN-REASSURE-DOCUMENT-ACT (sec. 5). |
03:30–03:45 | Final summary, personal plan, feedback | "One thing I will do for my family this week." |
Opening (15 min) - Recap and Ice-Breaker
Objectives:
- Reactivate the connections established in Workshop 1.
- Identify what participants actually applied during the week.
Step by step:
- Welcome participants, name badges (2 min).
- Quick circle: 'My name is... and since the last workshop I tried / I noticed / I changed...' (5 min).
- Opinion Barometer (6 min): Three corners of the room - YES / NO / NOT SURE. Read statements; participants move physically: 'I know if my Smart TV has a microphone' • 'I have a rule at home about phone use at dinner' • 'I know what my child does online after school' • 'I would feel confident responding if my child reported an online problem.'
- Announce the agenda for Workshop 2. (2 min)
🧑🏫 Trainer Note The Barometer is especially powerful here because it surfaces the gap between intention (Workshop 1) and action - without any judgment. Validate all changes made during the week, however small. 'You checked your app permissions? That is exactly what we hoped for.' Do not comment on Barometer positions - simply ask 'Why did you choose here?' and listen. |
Module 5 - Public Wi-Fi, VPNs & Secure Websites (45 min)
↪ Correspondence with Part I: Sections 3.3–3.5 - 'Public Wi-Fi Risks and VPNs', 'Recognising Secure Websites'
Related Chapter | Sections 3.3–3.5 - Public Wi-Fi, VPNs, HTTPS vs. HTTP |
Duration | 45 minutes |
Target Group | Parents with low/medium level of digital literacy (G2) |
Materials | Projector/screen, smartphones, Worksheet 11 (Wi-Fi Risk Map), flipchart, markers |
Group Size | 8–14 participants |
Handouts | Worksheets 11–13 from the Parent Worksheets Booklet (Workshop 2, Module 5): W11 - Public Wi-Fi Risks (Ref. 3.3); W12 - The Padlock Inspection (Ref. 3.5); W13 - Cookies: Our Digital Footprints (Ref. 3.1) |
Learning Objectives
- The participant understands why public Wi-Fi networks are inherently risky and can identify the most dangerous situations.
- The participant understands what a VPN does in practical terms - it encrypts the connection so that intercepted data is unreadable - and knows how to activate one.
- The participant recognises the HTTPS padlock and understands both what it guarantees (encrypted connection) and what it does not guarantee (the site itself is trustworthy).
- The participant knows the 'Forget This Network' habit and can apply it after leaving a public place.
Session Plan
Time | Activity | Method | Materials |
|---|---|---|---|
0:00–0:08 | Icebreaker: 'The Glass Room' | Group discussion | Flipchart |
0:08–0:18 | Mini-lesson: Why public Wi-Fi is a risk - and what attackers do | Presentation + discussion | Projector |
0:18–0:30 | Activity: The Wi-Fi Risk Map | Small groups | Worksheet 11 |
0:30–0:40 | Mini-lesson: VPNs and HTTPS - two practical shields | Presentation + live demo | Projector + smartphones |
0:40–0:48 | Hands-on: The Hotspot Check | Individual on devices | Smartphones |
0:48–0:50 | 📋 Handout + Wrap-up | Individual | Worksheets 11–13 |
Detailed Activity Guide
🎯 Icebreaker: 'The Glass Room' (8 min)
🧑🏫 Trainer Note This analogy comes directly from Chapter III section 3.3. Use the exact image: 'a room with glass walls where anyone can see what you are doing.' The goal is to create an immediate, visceral understanding of what 'open network' means - no technical explanation needed yet. |
- Ask: 'Have you ever connected to a free Wi-Fi network in a café, airport, or hotel?' (Almost everyone raises their hand.)
- Ask: 'What did you use it for?' Write answers: email, social media, banking, shopping, watching videos.
- Introduce the metaphor: 'Imagine that room had glass walls and everyone could watch exactly what you were doing on your device. That is essentially what an open public Wi-Fi network is from a security perspective.'
- Pause. Let the image land. Then: 'Today we learn how to draw the curtains.'
🎯 Mini-lesson: Why public Wi-Fi is a risk - and what attackers do (10 min)
🧑🏫 Trainer Note Introduce Man-in-the-Middle and Evil Twin attacks using simple language, not technical names. The 'Free_Airport_WiFi' Evil Twin example resonates strongly with families who travel. Keep this conceptual - the practical defence comes in the next activities. |
- Explain: 'When you connect to a public Wi-Fi, your device joins a shared space with everyone else at that location. If the network is not encrypted, someone with the right tools can see the data flowing between your device and the internet.'
- Introduce the interception concept simply: 'An attacker can position themselves between your phone and the network router, capturing everything that passes through.'
- Introduce the Evil Twin concept: 'Attackers sometimes create a fake Wi-Fi network with a legitimate-sounding name - Free_Airport_WiFi, Hotel_Guest, CafeInternet. Once you connect, they can redirect you to fake login pages or capture your data.'
- Ask: 'Which of the things you said you use public Wi-Fi for would be most dangerous if someone could read them?' Guide toward: banking, email login, entering passwords, shopping.
🎯 Activity: The Wi-Fi Risk Map (12 min)
🧑🏫 Trainer Note Prepare scenario cards. Groups discuss and rank each situation from LOW to HIGH risk. The goal is not a perfect risk taxonomy - it is helping participants build intuition about when to be careful. |
Scenario | Risk Level | Why |
|---|---|---|
Watching a YouTube video on café Wi-Fi | Low-Medium | Data is not sensitive; no login credentials entered. |
Checking your bank balance on airport Wi-Fi | HIGH | Bank login credentials and account details at risk. |
Entering a password on a hotel Wi-Fi network | HIGH | Password could be intercepted. |
Letting children play a downloaded game on public Wi-Fi | Medium | Lower direct risk if no login or in-app purchase involved. |
Accessing your work email on a library Wi-Fi | HIGH | Professional credentials and potentially sensitive data at risk. |
🎯 Mini-lesson: VPNs and HTTPS - two practical shields (10 min)
🧑🏫 Trainer Note A VPN should be explained functionally, not technically. The 'encrypted tunnel' metaphor is enough. The HTTPS section must include the critical caveat: HTTPS means the connection is encrypted, NOT that the website is trustworthy. Show a real browser padlock on the projector. Let participants find it on a website they use. |
VPN - the encrypted tunnel:
- 'A VPN is software that wraps your internet connection in an encrypted layer. Even if someone intercepts it, all they see is scrambled, unreadable data.'
- 'For families, the most important use case is protecting sensitive activities - banking, emails, passwords - when using public Wi-Fi.'
- Examples of reputable VPNs to mention (without recommending): ProtonVPN (free tier available), NordVPN, the VPN built into some routers.
- Important caveat: 'A VPN protects your connection - it does not protect you from phishing, malicious apps, or clicking on suspicious links.'
HTTPS - the padlock:
- 'A website starting with HTTPS encrypts the communication between your browser and the site. Look for the padlock icon in the address bar.'
- Critical distinction: 'The padlock means the connection is secure. It does not mean the website itself is honest. A scam site can have HTTPS too - it just means the scam is delivered securely to you.'
- 'Always check the full address. A single changed letter - paypa1.com instead of paypal.com - is enough to send you to a fake site.'
🎯 Hands-on: The Hotspot Check (8 min)
🧑🏫 Trainer Note This is a direct application of the 'Forget the Network' tip from Chapter III section 3.3. Walk through the steps on the projector. Participants follow on their own phones. |
- Ask participants to open their Wi-Fi settings. Count how many open networks (no padlock) are visible.
- Guide: 'Find a network you have connected to before in a public place. Use the Forget option.' (iPhone: tap ℹ → Forget This Network. Android: long-press network name → Forget.)
- Explain: 'This prevents your phone from automatically connecting to that network - or a fake network with the same name - next time you are nearby.'
- Remind: 'Enable the setting that requires permission before joining new networks, rather than connecting automatically.'
Key Messages of the Module 1. Public Wi-Fi is a shared space - treat it like a public conversation that others can hear. Never use it for sensitive tasks without a VPN. 2. A VPN encrypts your connection so that intercepted data is unreadable. It is a practical, easy-to-use tool - not just for tech experts. 3. HTTPS means the connection is encrypted. It does not mean the website is trustworthy. Always check the full address carefully. |
Trainer Tips
|
Module 6 - Smart Devices, Cloud Privacy & Family Digital Contract (45 min)
↪ Correspondence with Part I: Section 3.4 - 'Privacy on the Internet, in the Cloud and on Connected Home Devices' and Section 4.1 - 'Establishing a Family Digital Understanding'
Related Chapter | Section 3.4 - Smart Devices and Cloud Privacy; Section 4.1 - Family Digital Understanding |
Duration | 45 minutes |
Target Group | Parents with low/medium level of digital literacy (G2) |
Materials | Projector/screen, smartphones, 'Device Mute Walk' list, Family Agreement template (flipchart or printed), markers |
Group Size | 8–14 participants |
Handouts | Worksheets 14–16 from the Parent Worksheets Booklet (Workshop 2, Module 6): W14 - The 'Device Mute' Walk (Ref. 3.4) - completed during session; W15 - The 'Device Basket' Challenge (Ref. 4.4–4.5) - completed during session; W16 - Our Family Digital Understanding (Ref. 4.1) - distributed at end of module, to be completed at home with the whole family |
Learning Objectives
- The participant understands that Smart TVs, voice assistants, and connected toys collect data passively and knows how to audit their privacy settings.
- The participant understands that cloud backups exist and are running on their device - and knows how to review what is being backed up and who has access.
- The participant drafts the basic structure of a Family Digital Understanding - a written, co-designed agreement covering screen-free zones, reporting of problems, and basic security commitments.
Session Plan
Time | Activity | Method | Materials |
|---|---|---|---|
0:00–0:08 | Icebreaker: 'Does Your TV Listen?' | Group discussion | Flipchart |
0:08–0:18 | Mini-lesson: The Connected Home - what is watching and listening | Presentation + discussion | Projector |
0:18–0:28 | Hands-on: Cloud & Smart Device Privacy Audit | Individual on devices | Smartphones |
0:28–0:40 | Activity: Draft a Family Digital Understanding | Individual + pairs | Agreement template |
0:40–0:48 | Discussion: What Makes a Digital Agreement Work? | Group discussion | Flipchart |
0:48–0:50 | 📋 Handout + Wrap-up | Individual | W14–W15 (completed during session); W16 (take-home) |
Detailed Activity Guide
🎯 Icebreaker: 'Does Your TV Listen?' (8 min)
🧑🏫 Trainer Note Many parents have never thought of a Smart TV as a data-collecting device. The initial reaction is often disbelief. Keep the opening question light and curious, not alarmist. The goal is not to create fear about smart devices - it is to create awareness that they require privacy management, just like smartphones. |
- Ask: 'How many of you have a Smart TV at home? A voice assistant like Alexa or Google Home? Any connected toys for your children?'
- Ask: 'Do you think your Smart TV knows what you watch? Could it know when you are at home?'
- Allow reactions. Many participants will be surprised. Validate: 'You are not wrong to be surprised - most people set up smart devices and never look at the privacy settings again.'
- Conclude: 'Today we look at the invisible side of the connected home - and we take control of it.'
🎯 Mini-lesson: The Connected Home - what is watching and listening (10 min)
🧑🏫 Trainer Note Reference the European research findings from Chapter III section 3.4 briefly - it adds authority without being academic. The key message is not 'throw away your smart devices' but 'manage them actively, just as you manage your phone.' Mention the GDPR right to be forgotten and data minimisation - participants have legal tools available to them. |
- Smart TVs: often collect viewing habits through Automatic Content Recognition (ACR), which identifies what you watch even from external devices. Many have integrated microphones for voice control that remain active unless manually disabled.
- Voice assistants: record short audio clips when they detect a wake word - and sometimes when they do not. These recordings are stored on remote servers and reviewed by human contractors in quality-improvement programmes.
- Connected toys and baby monitors: many use weak security (default passwords, unencrypted connections), meaning they can be accessed remotely if not properly secured.
- Cloud storage: most families have automatic cloud backup running on their phones without realising it. Photos, contacts, documents, and device settings are copied to remote servers linked to their Google or Apple account.
Key message: 'Under GDPR, you have the right to know what data your devices collect, the right to limit it, and the right to demand it be deleted. These are legal rights - not favours.'
🎯 Hands-on: Cloud & Smart Device Privacy Audit (10 min)
🧑🏫 Trainer Note This connects directly to the 'Device Mute Walk' and 'Invisible Audit' activities from Chapter III. Focus on the two most universally owned devices: their smartphone and (if applicable) Smart TV. Never ask participants to change settings they are not comfortable with. The goal is awareness. |
On smartphones:
- Open Settings → Privacy → Location Services: identify which apps have 'Always On' location access and change to 'While Using' or 'Off' where appropriate.
- Open Settings → Privacy → Microphone: check which apps have microphone access and remove it from any app that does not need it.
- Check cloud backup status (iPhone: Settings → [Name] → iCloud; Android: Settings → Google → Backup). Are you aware of what is being backed up?
For Smart TVs (general guidance - no device required):
- Most Smart TVs have a Privacy or Data Sharing menu in Settings. Look for: Automatic Content Recognition (ACR), Voice Data Collection, Data Sharing with Third Parties.
- Disable ACR if found. Disable voice control microphone unless actively using it.
- Recommend running a brief check at home using the TV remote.
🎯 Activity: Draft a Family Digital Understanding (12 min)
🧑🏫 Trainer Note Use the Family Digital Understanding template on the flipchart or a printed sheet. Emphasise that this is a collaborative document - children should be involved in writing it at home. The parental clauses (rules that also apply to adults) are the most important element - they transform the contract from a list of restrictions into a family commitment. Connect this to section 4.1 in Chapter III - the 'Family Drafting Session' activity. |
Guide participants to complete the following four sections:
Section | Example Content |
|---|---|
Screen-free times and zones | No devices at family meals. All devices charged outside bedrooms by 9:30 PM. |
Security commitments | Always ask before downloading an app. Never share passwords outside the family. Report suspicious messages. |
Reporting clause | If something uncomfortable, confusing or worrying happens online, we talk about it together - without punishment. |
Parental clauses | Parents will not use phones during family time without explaining why. We apply the same rules to ourselves. |
Invite 2–3 participants to share one item from their draft. Discuss: 'What makes this item realistic and enforceable?'
💬 Discussion: What Makes a Digital Agreement Work? (8 min)
- Ask: 'What is the difference between rules imposed from above and rules drafted together?'
- Key insight from Chapter III: children are significantly more likely to respect boundaries they helped design. The agreement should be printed, signed by every family member, and displayed somewhere visible.
- Ask: 'What is the most important single rule you wrote today?' Let participants share. Note the variety - there is no single right answer.
Key Messages of the Module 1. Smart devices collect data passively and silently - managing their privacy settings is as important as managing your phone. 2. Cloud storage means your family's photos, contacts, and documents exist on remote servers. Review what is being backed up and who has access. 3. A Family Digital Understanding works best when children help design it. Rules built together are respected more than rules imposed alone. |
Trainer Tips
|
Module 7 - Parental Controls, Screen Time & Leading by Example (45 min)
↪ Correspondence with Part I: Sections 4.2–4.5 - 'Parental Controls within the European Regulatory Landscape', 'Monitoring vs. Spying', 'Managing Screen Time', 'Leading by Example'
Related Chapter | Sections 4.2–4.5 - Parental Controls, Monitoring vs. Spying, Screen Time, Adult Modelling |
Duration | 45 minutes |
Target Group | Parents with low/medium level of digital literacy (G2) |
Materials | Projector/screen, smartphones, Worksheet 15 (Monitoring or Spying?), flipchart, markers |
Group Size | 8–14 participants |
Handouts | Worksheet 17 from the Parent Worksheets Booklet (Workshop 2, Module 7): W17 - Parental Controls: Monitoring, Not Spying (Ref. 4.2–4.3) |
Learning Objectives
- The participant can configure at least one parental control feature on a family device during the session (Screen Time on iPhone or Digital Wellbeing on Android).
- The participant understands the operational and ethical distinction between transparent monitoring and covert spying, and can explain why covert surveillance is counterproductive.
- The participant applies age-appropriate screen time guidance and understands why blanket rules designed for young children do not work for teenagers.
- The participant recognises the concept of 'technoference' and identifies at least one concrete change in their own digital habits.
Session Plan
Time | Activity | Method | Materials |
|---|---|---|---|
0:00–0:08 | Icebreaker: 'What Rules Exist at Home?' | Group discussion + flipchart | Flipchart, markers |
0:08–0:18 | Hands-on: Configure a Parental Control Feature | Individual on devices | Smartphones |
0:18–0:28 | Activity: Monitoring or Spying? | Small groups | Scenario cards |
0:28–0:38 | Mini-lesson: Screen Time by Age + Leading by Example | Presentation + discussion | Projector |
0:38–0:48 | Activity: The 'Device Basket' Challenge Planning | Individual reflection | Flipchart |
0:48–0:50 | 📋 Handout + Wrap-up | Individual | Worksheet 17 |
Detailed Activity Guide
🎯 Icebreaker: 'What Rules Exist at Home?' (8 min)
🧑🏫 Trainer Note Begin with offline rules - homework before TV, bedtime, family meals - before moving to digital rules. The goal is to surface the gap: most families have clear offline rules and much vaguer digital ones. Avoid framing this as a judgement. Many parents feel guilty about screen time - normalise the challenge. |
- Ask: 'What rules already exist in your home?' Write answers on the flipchart. Expect: bedtime, homework first, family meals, chores.
- Ask: 'Do you have equally clear rules for smartphones, tablets, gaming, and social media?' Expect a much less confident response.
- Key insight: 'Most families have very clear offline rules and much vaguer digital ones. That is completely normal - digital devices are new, and the rules are still being worked out. Today we build them together.'
🎯 Hands-on: Configure a Parental Control Feature (10 min)
🧑🏫 Trainer Note Demonstrate live on a device shown on the projector. Keep the demo to one specific feature - Screen Time App Limits is the most universally accessible. Participants follow on their own devices. Walk around and support those who need help. Emphasise: the goal is not maximum restriction - it is informed, age-appropriate management. |
iPhone - Screen Time:
- Settings → Screen Time → Turn On Screen Time.
- App Limits → Add Limit → select a category (e.g., Social Networking or Games) → set a daily limit (e.g., 1 hour).
- Create a Screen Time Passcode - different from the device passcode - so the child cannot change the settings.
- Downtime → set overnight hours (e.g., 9:30 PM to 7:00 AM) during which most apps are blocked.
- For full remote management: enable Family Sharing and link the child's Apple ID - settings can then be managed remotely from the parent's own device.
Android - Digital Wellbeing:
- Settings → Digital Wellbeing & Parental Controls.
- Tap an app → set a daily timer.
- For cross-device management: link to Google Family Link (families.google.com/familylink).
Remind participants: for the most robust setup, use Family Sharing (iPhone) or Google Family Link (Android) - this allows the parent to manage all settings remotely from their own device and covers all linked devices simultaneously.
🎯 Activity: Monitoring or Spying? (10 min)
🧑🏫 Trainer Note This is the most ethically charged activity of Workshop 2. Handle it with sensitivity. The goal is not to make parents feel judged - it is to help them understand that transparency is both more ethical and more effective. Reference the UCL research finding from Chapter III section 4.3: hidden monitoring apps often have worse security than transparent ones, ironically exposing the child's data to external hackers. |
Groups receive scenario cards and must decide: is this Monitoring or Spying?
Scenario | Answer | Why |
|---|---|---|
A parent installs Screen Time and shows their teenager exactly what data it records. | Monitoring | Transparent, educational, and the child is aware. |
A parent installs a hidden app that logs all keystrokes and messages without telling the child. | Spying | Covert, excessive, damages trust - and often legally ambiguous. |
Parents and child review the Screen Time weekly report together. | Monitoring | Collaborative, uses data as an educational tool, not a surveillance weapon. |
A parent reads all of a teenager's private messages regularly without their knowledge. | Spying | Covert and disproportionate. Undermines the child's developing autonomy and trust. |
Key message from Chapter III: 'Monitoring and spying differ not by the data they collect, but by the transparency of their application. A monitoring tool that the child knows about is a safety net. A hidden surveillance app is a trap - for trust, for the relationship, and often for the child's own data security.'
🎯 Mini-lesson: Screen Time by Age + Leading by Example (10 min)
🧑🏫 Trainer Note Keep the age guidance very brief - one sentence per age group. The detail is in Chapter III section 4.4. The Leading by Example section tends to generate the most personal reflection. Give it space. The 'technoference' concept does not need its name - describe the behaviour and let parents recognise it. |
Screen time guidance by age (from Chapter III section 4.4):
- Under 2: avoid screens except video calling.
- 2–5 years: up to 1 hour of high-quality, co-viewed content per day.
- 6–12 years: balance digital use with offline responsibilities - impact on sleep, homework, and exercise matters more than a fixed limit.
- Teenagers: focus on self-regulation and habit formation, not hard limits. Protect sleep and discourage compulsive use patterns.
Leading by example - ask participants:
- 'When was the last time you checked your phone during a family meal or a conversation with your child?'
- 'How do you think your child interprets that?' - Guide toward: 'If adults can look at their phones whenever they want, why can't I?'
Key insight from Chapter III: 'Children do not learn digital discipline from rules. They learn it from what they observe at home every day. A parent who models healthy digital habits makes every other rule more believable.'
🎯 Activity: The 'Device Basket' Challenge Planning (10 min)
🧑🏫 Trainer Note This is a commitment-building exercise - participants plan to implement the 'Device Basket' activity from Chapter III section 4.5. The key is that it applies to everyone - parents included. Emphasise this. Ask participants to choose a specific, upcoming family moment to try it. |
Ask participants to complete on paper:
- 'When will I try the Device Basket this week?' (e.g., Sunday dinner, Saturday afternoon activity.)
- 'Who will be involved?' (All family members, including parents.)
- 'What offline activity will we do during that time?' (Board game, cooking together, walk, reading.)
- 'What is the single rule I will commit to modelling myself?'
Invite 2–3 participants to share their plan. Ask: 'What do you expect the hardest part to be?' (Usually: their own phone habits, not the children's.)
Key Messages of the Module 1. Parental controls are a useful structural guardrail - but they work best when paired with open communication and transparency, not as hidden surveillance. 2. Screen time rules must evolve as children grow. Rules designed for a seven-year-old will not work - and may backfire - with a fifteen-year-old. 3. The most powerful parental control tool is adult behaviour. Children do not follow rules - they follow examples. |
Trainer Tips
|
Module 8 - Online Risks for Children: from Cyberbullying to Digital Resilience (60 min)
↪ Correspondence with Part I: Section 5 - 'Risks to Which Children May Be Exposed Online'
Related Chapter | Section 5 - Cyberbullying, Grooming, Inappropriate Content, Gaming Scams, Digital Resilience |
Duration | 60 minutes (extended module) |
Target Group | Parents with low/medium level of digital literacy (G2) |
Materials | Projector/screen, Worksheet 17 (Warning Signs), Worksheet 19 (Role-Play scenario), flipchart, markers |
Group Size | 8–14 participants |
Handouts | Worksheets 18–20 from the Parent Worksheets Booklet (Workshop 2, Module 8): W18 - Would You Notice the Warning Signs? (Ref. 5.1–5.2); W19 - Rabbit Holes & Gaming Scams; W20 - LISTEN–REASSURE–DOCUMENT–ACT (Ref. 5.5); W21 - My Family Digital Resilience Plan (Ref. 5.5) |
Learning Objectives
- The participant recognises the four main online risk categories affecting children and their behavioural warning signs.
- The participant understands why children often do not disclose online problems - and what makes disclosure more likely.
- The participant practises the LISTEN - REASSURE - DOCUMENT - ACT response framework using realistic scenarios.
- The participant understands what digital resilience means: not the absence of online risk, but the confidence, knowledge, and family support to respond effectively when something goes wrong.
Session Plan
Time | Activity | Method | Materials |
|---|---|---|---|
0:00–0:08 | Icebreaker: 'Would You Notice?' | Group discussion + flipchart | Flipchart, markers |
0:08–0:22 | Activity: Risk Category Overview + Warning Signs Detective | Small groups + plenary | Scenario cards |
0:22–0:30 | Discussion: Why Don't Children Always Tell Us? | Guided discussion | Flipchart |
0:30–0:47 | Role-Play: The Parent Response (LISTEN–REASSURE–DOCUMENT–ACT) | Pairs | Role-play cards |
0:47–0:55 | Mini-lesson: Building Digital Resilience | Short presentation + discussion | Projector |
0:55–1:00 | 📋 Handout + Wrap-up | Individual | Worksheets 18–20 |
Detailed Activity Guide
🎯 Icebreaker: 'Would You Notice?' (8 min)
🧑🏫 Trainer Note The goal is to surface the uncomfortable truth that online problems rarely announce themselves directly - they appear as behavioural changes. Keep it empathetic. Many parents feel guilty about not having noticed warning signs sooner. This exercise primes participants to think about behaviour rather than devices. |
- Ask: 'If your child was experiencing a serious online problem right now, how would you know?' Write answers on the flipchart.
- Guide toward: mood changes, withdrawal, sudden anxiety around devices, avoiding school, changes in sleep, loss of interest in usual activities, secretiveness.
- Ask: 'Have you ever noticed a change in your child's behaviour that you could not explain at the time?' Allow brief, voluntary sharing.
- Conclude: 'Children do not usually say I am being bullied online. They show it in other ways. Recognising those signs is our first protective tool.'
🎯 Activity: Risk Category Overview + Warning Signs Detective (14 min)
🧑🏫 Trainer Note Present the four risk categories in two minutes total - this is an overview, not a lecture. The Warning Signs Detective is the main activity: groups receive one scenario each and identify warning signs. Avoid sensationalist language, especially for grooming. Focus on observable behaviours, not graphic scenarios. |
Brief overview of the four main risk categories (2 min each):
Risk | Core Mechanism | Key Warning Signs |
|---|---|---|
Cyberbullying | Peer harassment that follows the child into the home through their devices, 24/7. | Emotional volatility around notifications; reluctance to attend school; sudden withdrawal from activities; device shielding. |
Grooming | An adult builds gradual trust with a child online, migrating them to private, unmonitored channels. | Secretive about a new 'online friend'; anxiety when device is away; adult vocabulary; unexplained gifts. |
Inappropriate Content / Algorithmic Rabbit Holes | Recommendation algorithms progressively push extreme content. | Sudden shifts in language, views, or values; withdrawal from real-world relationships; changes in eating or appearance. |
Gaming Scams & Dark Patterns | Predatory monetisation design and social manipulation inside games. | Rage or anxiety about missing limited-time events; requesting money urgently; treating gaming as a stressful obligation. |
Warning Signs Detective (12 min):
Assign one scenario per group. Groups read it and identify: (1) which risk category this might be; (2) what specific warning signs are present; (3) what the parent should NOT do first.
Scenario | Details |
|---|---|
A | A thirteen-year-old who used to love gaming with friends now panics every time his phone shows a notification and becomes furious when his parents touch his device. |
B | A fifteen-year-old girl has started using adult terminology, become secretive about an online friend 'who really understands her', and has stopped spending time with her school friends. |
C | A twelve-year-old who was calm and sociable has begun making comments at dinner about how 'certain people' are responsible for society's problems, using language his parents do not recognise. |
D | A ten-year-old had a meltdown when a limited-time game character was taken down and has been asking to use a parent's credit card for 'just a small purchase' every few days. |
Groups share findings. Summarise on the flipchart: one warning sign per scenario.
💬 Discussion: Why Don't Children Always Tell Us? (8 min)
🧑🏫 Trainer Note This is the most emotionally sensitive discussion of the entire guide. Handle with care. Do not ask participants to share specific incidents unless they volunteer. The key insight - 'children come to us when they believe they will be heard, not judged' - should feel like a revelation, not a lecture. |
- Ask: 'Why might a child hide an online problem from their parents?' Write all answers without comment.
- Common responses: fear of punishment, embarrassment, fear of losing device access, worry that parents will not understand, belief that it will get worse if they tell.
- Ask: 'Looking at this list - how many of these fears could we address by changing how we respond?'
- Key insight from Chapter III section 5.5: 'The first condition of resilience is trust. If a child knows that disclosure will be met with emotional support - not panic, not device confiscation - they are much more likely to come to us when something goes wrong.'
- Challenge: 'What is one thing you could say to your child today that would make them feel safer asking for help?' Invite a few volunteers.
🎯 Role-Play: The Parent Response - LISTEN–REASSURE–DOCUMENT–ACT (17 min)
🧑🏫 Trainer Note This is the most important practical activity of Workshop 2. Every participant should practise all four steps. Pairs rotate: one plays the parent, one plays the child disclosing the problem. After each scenario, ask the 'child' role: 'How did you feel during that conversation? Would you come back to that parent with another problem?' Use the 'wrong version' and 'right version' contrast - this is very effective and used in Chapter 1 as well. |
Introduce the four-step framework:
Step | What to do | What NOT to do |
|---|---|---|
LISTEN | Allow the child to explain fully without interruption. Ask open questions: 'Can you show me?', 'When did this start?' | Do not interrupt, minimise, or immediately jump to solutions. |
REASSURE | Show support and thank them for telling you. 'Thank you for coming to me. We will deal with this together. You did the right thing.' | Do not say: 'Why didn't you tell me sooner?', 'What did you do to provoke this?' |
DOCUMENT | Save screenshots, preserve evidence. Do not delete harmful messages - they are legal evidence. | Do not immediately delete or report before preserving evidence. |
ACT | Decide on next steps together: blocking the account, reporting to the platform, contacting the school, or involving authorities if necessary. | Do not act unilaterally without explaining to the child what you are doing and why. |
Role-play scenarios (pairs choose one):
- 'Someone keeps sending me insulting messages in the class group chat and other people are laughing along.'
- 'A person I met in an online game says we are best friends and wants to move to a private app where we can talk just us two.'
- 'I clicked on a link that promised free game credits and now my account is acting strangely.'
After each role-play, ask the 'child' role: 'How did that conversation feel? Would you come back with another problem?' Then ask the 'parent' role: 'Which step was hardest?'
🎯 Mini-lesson: Building Digital Resilience (8 min)
🧑🏫 Trainer Note This is the closing mini-lesson of the entire guide. It should feel like an arrival, not a beginning. Resilience is the key shift from this chapter: from passive protection (filters, rules) to active competence (knowing what to do when something goes wrong). The three-layer model - Prevention, Response, Recovery - is the takeaway structure. |
Introduce the concept from Chapter III section 5.5: 'Digital resilience is not the absence of online risk. No technical guardrail is foolproof. Resilience means knowing what to do next when something goes wrong - and having the confidence and family support to do it.'
The three-layer model:
- Prevention: age-appropriate settings, parental guidance, digital literacy. Reduces initial exposure.
- Response: clear reporting and support procedures. What to do when something happens.
- Recovery: discussion, reassurance, and practical lessons. Helps the child rebuild confidence and learn without shame.
A resilient child is one who:
- Knows exactly which adult to tell and how to save evidence.
- Understands that coming to a parent with an online problem will result in support, not punishment.
- Can identify when an online space is becoming emotionally unhealthy and knows how to step away.
Final insight: 'Technical controls matter - but they are only part of the solution. Children need the confidence, knowledge, and family support to act when those controls are not enough. That is what we have been building today.'
Key Messages of the Module 1. Online risks rarely announce themselves. They appear as changes in behaviour - and a parent who recognises those changes is the most effective safeguard. 2. Children come to us when they believe they will be heard, not judged. LISTEN - REASSURE - DOCUMENT - ACT. 3. Digital resilience means not the absence of risk, but the confidence and family support to respond effectively when something goes wrong. |
Trainer Tips
|
Objectives:
- Summarise both workshops with four key ideas.
- Final personal plan: 1–3 concrete actions for the coming month.
- Feedback and thanks.
Step by step:
- 'Four ideas I take home' (3 min): write on the flipchart: Update & Protect. Strong Keys. MFA. Pause & Think. Trusted Adult.
- 'One thing I will do for my family this week' (5 min): each participant shares one sentence.
- 30-day personal plan worksheet (3 min): 'What will I do in the next 30 days? (maximum 3 things).'
- Feedback form - Annex A (3 min).
- Thanks and Annex C (useful resources) printed for each person. (1 min)
Final message for participants - Workshop 2: 'Protecting your family online does not require technical expertise. It requires awareness, a few consistent habits, and - above all - a home where children feel safe to talk to you. You have all of those. Thank you for taking these steps with us.'