School Online Safety and Online Harms Curriculum Progression Plan

This plan may be used by [school name] where online-safety and online-harms teaching is included in relationships education, relationships and sex education, health education, computing or citizenship. Content should be adapted to the relevant key stage, the age and development of pupils, and their needs.

How to use the progression

Teaching should revisit core ideas as pupils develop, moving from recognition and simple protective actions towards evaluation, informed decision-making, understanding consequences and seeking support. The Education for a Connected World framework may be consulted as an optional source of age-specific advice about the online knowledge and skills pupils should have the opportunity to develop at different stages of their lives.

Schools should select suitable examples, language and activities for each class or cohort. Topics involving illegal content, sexual material, grooming, abuse or violence should be handled in an age-appropriate and safeguarding-aware way.

Primary progression

Developing understanding and safer everyday choices

Pupils should have opportunities to understand that some online activities and content have age restrictions, why age verification exists and why age restrictions can warn that content may be disturbing or unsuitable for younger viewers. Teaching may introduce the meaning of the digital age of consent in an age-appropriate way.

Pupils should explore how information, comments and images can be shared, tagged and traced; what a digital footprint is; why content can be difficult to remove; and how information shared online can affect future prospects or enable identity theft and targeted approaches by fraudsters.

Pupils should learn that information online can be false, misleading, exaggerated or presented as authentic because it is widely shared. They should practise pausing before sharing, checking what they see and considering the consequences of sharing information that may not be true.

Pupils should learn to recognise suspicious websites, fake URLs, scam emails and offers that appear too good to be true. They should understand that entering information into an insecure website can create risks, and know who they can approach if they are harmed, targeted or groomed.

Pupils should explore how websites, apps and games can collect personal data, including through cookies, games and surveys. They should consider what information they share, how to limit data collection, how privacy settings work and why acting quickly matters if something goes wrong, such as a data breach.

Pupils should recognise that notifications, incentives, advertising and other design features can encourage people to stay online or spend money. They should practise identifying when online content or design is trying to attract attention or influence a choice.

Personal safety, abuse and help-seeking

Pupils should learn to recognise unsafe contact, fake profiles, grooming behaviours, harmful challenges, live-streaming risks and online abuse in ways that are appropriate to their age and development. They should know how to stop engaging, preserve their safety, tell a trusted adult and use the reporting or support routes available to them.

Teaching should make clear that abuse is never the fault of the child who is abused and that victim blaming is wrong.

Secondary progression

Rights, restrictions and responsibility

Pupils should deepen their understanding of online age restrictions, age verification and the reasons that age-inappropriate content may be harmful. They should understand the meaning of the digital age of consent, including that it is the minimum age of 13 at which a young person can agree to share information and sign up to social media without parental consent under the General Data Protection Regulations.

Pupils should evaluate how digital footprints develop through information, comments and images; how content is shared, tagged and traced; and how online activity may affect future university or job applications. They should consider identity-theft risks, targeted approaches by fraudsters and the consequences of creating, possessing or sharing illegal online content.

Information quality and misinformation

Pupils should distinguish between disinformation, misinformation, malinformation and online hoaxes. They should examine why false information may be deliberately or accidentally shared, how genuine information may be published with an intent to harm, how viral circulation can appear to provide authenticity, and how to measure and check authenticity before sharing.

Scams, fraud and account security

Pupils should learn to assess fake URLs, website security markings and the sources of emails. They should understand phishing, social engineering, compromised passwords, online fraud and fake product sales, and should know what to do, who to tell and what support may be available after being harmed, targeted or groomed.

Password-security teaching should address the risks of compromised passwords and the importance of taking appropriate protective action when an account or password may no longer be secure.

Personal data and privacy

Pupils should analyse how platforms and search engines harvest personal data, how data may be shared or resold for targeted marketing, and how cookies and apparently neutral websites, games or surveys can gather information. They should consider children's data rights, the particular protections for children under the General Data Protection Regulations, privacy settings and their limitations, and ways to limit the data companies can gather.

Persuasive design and online behaviour

Pupils should evaluate how platforms, apps and games may be designed to keep users online, encourage spending or generate advertising revenue. They should examine notifications, incentives, targeted content, targeted advertising, clickbait and privacy controls, and consider how these features can influence behaviour and the information shared.

Online abuse, grooming and routes to help

Pupils should develop their understanding of online abuse, fake identities, grooming indicators, live-streaming risks, harmful online challenges and content that may incite violence. They should practise disengaging safely, identifying a trusted adult, reporting concerns and seeking support through [school reporting route] or other appropriate safeguarding or police support routes.

Pornography and sexual content

Where included in secondary relationships and sex education, pupils should learn that pornography is not an accurate portrayal of adult sexual relationships. They should consider how sexually explicit material can present a distorted picture of sexual behaviour, contribute to skewed beliefs about sex and, in some circumstances, normalise violent sexual behaviour. Teaching should also address that not everyone shown in pornographic material is doing so willingly, including in cases involving revenge pornography or people trafficked into sex work.

Cross-curriculum delivery

Schools may distribute this progression across relationships education, relationships and sex education, health education, computing and citizenship. Computing content on evaluating online information may be introduced from key stage 2 onwards, with citizenship opportunities at key stages 3 and 4 where relevant.

Each teaching sequence should identify the intended year group or key stage, the specific knowledge or skill being developed, the language and examples suitable for the pupils, and the route by which pupils can seek help if a lesson raises a personal concern.

Adaptation and safeguarding

Teachers should adapt content for pupils' developmental stage, additional needs, prior knowledge and lived experience. Discussions should avoid victim blaming and should reinforce that a child is not responsible for being abused. Concerns arising during teaching should be managed in accordance with [school safeguarding procedure].