The internet is mostly safe and fun, but you need to follow some important rules to protect yourself. Never share your passwords with anyone. Don't click links from people you don't know or trust. Never give out personal information like your address or phone number. If something feels wrong or scary online, tell an adult right away.
Discuss real-life scenarios with children: 'What would you do if a website asked for your birthday?' or 'What if someone online asked where you live?' Role-play safe responses.
You already know how to connect to the internet and why strong, unique passwords matter. Those two skills address the entry points — getting online and protecting your accounts. This topic zooms out to the ongoing habits and judgments that keep you safe across everything you do online, not just at the moment of account creation.
The most important principle is that the internet is public by default. When you post something — a photo, a comment, your location, a status update — assume it can be seen by anyone, not just the people you intended. Even "private" settings can be changed by the platform, accounts can be compromised, and screenshots can be taken and shared anywhere. This is why the rule "never post personal information you wouldn't share with a stranger" is not an exaggeration. Personal information includes not just your address and phone number, but also your school or workplace, your daily schedule, and photos that contain location data or recognizable landmarks in the background. And once something is posted, deleting it from your account does not guarantee it is gone — copies may already exist elsewhere.
Links and attachments are the most common path through which harm reaches online users. Messages designed to produce urgency — "Your account will be suspended," "You've won a prize," "Someone shared a photo of you" — are engineered to make you act before you think. Before clicking any unfamiliar link: did I expect this message? Do I recognize the sender from a real-world relationship? Does the link's actual URL match what the sender claims? Legitimate companies and institutions almost never ask for your password, payment details, or personal identification through an unsolicited email or message. When in doubt, navigate directly to the organization's website by typing the address yourself rather than following a link.
The third habit is knowing what to do when something feels wrong. Trust your instincts: if a conversation makes you uncomfortable, if someone is asking for personal information or images that don't feel right, if an offer seems too good to be true — these feelings are worth acting on. Blocking accounts, reporting to the platform, and telling a trusted adult or friend are all appropriate responses. The fact that an interaction happens online does not make it less real, less serious, or less worth addressing. Online and offline life are continuous — the same judgment you apply in person belongs on a screen too.