Digital Literacy & Online Life

In 1998, Sergey Brin and Lawrence Page published a description of Google that included PageRank. This method used links between pages to estimate their importance. A link from an important page contributed more than one from a less important page, and the contribution also depended on how many outgoing links that page had.

That is a useful starting point, but it is not a full description of search today. Google now describes many signals for finding relevant, useful and reliable information. Those signals can help you find good sources. A high position still does not certify every sentence on a page.

Follow a page from discovery to results

Google's documentation separates crawling, indexing and serving results. Ranking is the ordering work within the last stage. Other search services may organise their systems differently; Google is the example here.

1. Crawling: a program fetches a page. Google can discover its address through a link, an earlier visit or a sitemap supplied by a site owner. A sitemap is a list of page addresses.
2. Indexing: Google analyses what it fetched and may store information about the page in its index, a large database. It also identifies duplicate versions. Discovery does not guarantee indexing.
3. Serving and ranking: a query leads Google to search its index for matches and decide what to show and in what order. Being indexed does not guarantee appearing for a particular query.

Picture an invented museum page about a new fossil. The museum publishes it on Monday and adds it to a sitemap. That supplies a route for discovery. It does not establish when Google will fetch it, index it or display it for your words. If you cannot find it in search, you could try the museum's own navigation or a known page address.

Now suppose the museum corrects a date on Tuesday. The page you open and an older search description may differ. Check the current source rather than assuming the description is a live copy. A missing result does not prove that a page does not exist.

Key idea: For ordinary web results, you are using a search service's index and selection process. That is not a complete, live inspection of every page on the internet.

Ranking uses several kinds of evidence

Google says its systems consider the query's meaning, relevance, quality, usability and context. Quality signals aim to identify expertise and trustworthiness. Links from other prominent sites can be one clue. It would be wrong to say that accuracy and reliability play no role in the system's aims.

The distinction is between a signal and a guarantee. A useful clue can still lead to a mistaken result. Ranking also has to answer which page fits this query. The best page for a museum's opening time may differ from the best source for the age of a fossil.

Imagine searching for the fictional Brook Museum's opening time. A popular travel article from last year says 9 a.m. The museum's current visitor page says 10 a.m. Check whether the current page covers your intended day and mentions a special closure. Its relevance comes from responsibility for the schedule and its date, not merely from where it appears in the list.

You have not proved that every museum page is better than every travel article. You have matched the source to the question. For a claim about how visitors experienced an exhibition, outside reporting might answer something the museum's own publicity does not.

SEO and advertising are different

Search engine optimisation, or SEO, is work intended to help search engines understand content and help people find it. Clear page titles and accessible content can serve readers as well as search systems. SEO does not by itself show that a page is accurate or deceptive. You cannot identify the exact reason for a result's position simply by looking at its rank.

A sponsored result is an advertisement. Google says it labels ads with words such as Sponsored or Ad and does not sell higher placement in its organic results. Organic here means unpaid search listings. Paying for an ad is different from improving a page that might appear in those listings.

In an invented search display, a ticket seller appears first with a Sponsored label. The museum's visitor page appears below it. The label tells you that the first entry is an ad. It does not tell you whether its price is good or whether its hours are current. Read those details and identify the seller before relying on the result.

Context is not the same as personalisation

Google distinguishes personalisation based on account information from context such as location, language and device. Results can also change over time. Turning personalisation off does not remove every source of variation. Two people may receive similar results or different ones.

If you compare results with someone else, record the query and date and describe only what you observed. Suppose both screens show the same first three pages. That is a valid result. If they differ, the comparison alone does not tell you whether location, timing, account activity or another factor caused the difference.

You can practise with invented lists instead of sharing account details or screenshots. Nothing in this lesson requires changing privacy settings or searching for personal information.

Use a search tool for a specific purpose

An operator is a word or symbol that narrows a search. Google documents the following tools. Their availability and interface can change, so use the current help page if a control looks different.

Write site:si.edu with no space after the colon. It restricts the address, not the quality of every sentence found there. If you seek a specific report and get no match, try its title, the site's own search or its publications page. Google explicitly warns that site: does not necessarily return all indexed URLs.

Quotation marks can help locate a passage. They cannot search every printed book, recording, private page or unindexed document. A match may be a later copy; no match may reflect different wording. To attribute a quotation, find a document or recording with a verifiable speaker, date and surrounding context.

Build the query around what you need to know

Compare these practice queries: museums are boring, museums are exciting, and museum visitor survey results. They point toward different words and purposes. Google also uses related terms and interpreted meaning, so searches are more than literal word matching. You cannot predict that each query will return only agreement.

The third query gives you a clearer route toward evidence, but a neutral phrase does not guarantee a balanced set of results. Ask which visitors a survey included, who ran it and what questions they answered. You still have to read the source.

1. Write a question you can investigate: "How did visitors rate this museum's new exhibition?"
2. Search for the museum, exhibition and visitor survey. Check dates and which exhibition each result describes.
3. Open a relevant report and find the actual survey question, sample and results.
4. If the report covers only members, narrow your conclusion to members. Do not turn it into a claim about every visitor.

These are search choices for this example, not a compulsory order for every investigation. If you already have a report, begin by reading its details. If its publisher is unfamiliar, investigate that publisher too.

Try three decisions on paper

Use these invented cards. Card A is a sponsored ticket offer with no opening hours. Card B is the museum's dated visitor page for the day you plan to go. Card C is an old travel diary describing a previous visit. Which card would you inspect for today's hours? Which could describe a visitor's personal experience? Which is marked as paid placement?

Card B fits the hours question because it is the museum's current schedule for the relevant day. Card C can document its author's past experience, within that limit. Card A is the ad. Their positions in a search list would not change those reasons.

Now imagine that B is missing from a site: query. Does that make A's hours authoritative? No. You still need a source for the hours, and A supplies none. Try the museum's navigation or another verified route. The search failure changes your next step, not the evidence on the other cards.

Common misconceptions

• "Ranking ignores reliability." Google describes signals intended to find trustworthy information. A ranking signal still does not certify every claim.
• "First place means someone bought the organic result." Ads and unpaid listings have different roles. Google says payment does not buy a higher organic rank.
• "No result means no source exists." Discovery, indexing and display all have limits.
• "A neutral query finishes the check." It is a search choice. The source's evidence still needs reading.

What to carry forward

Use search to locate evidence, then explain why that evidence fits your question. Distinguish an ad from an unpaid listing, a quality signal from a verified claim, and a missing result from a missing page. Those distinctions give you a reason for choosing a source beyond its position.

Tomorrow, without looking back, explain why a PDF found first in search might still fail to answer a question about this year's opening hours. Then check the dates, purpose and evidence points above. If you missed one, apply it to a new invented museum card.

Sources

1. Brin, S., & Page, L. (1998). The anatomy of a large-scale hypertextual Web search engine. Computer Networks and ISDN Systems, 30, 107-117, section 2.1. Original paper
2. Google. (2025, December 18). In-depth guide to how Google Search works. Search stages. Google. (n.d.). Automatically generating and ranking results. Ranking signals and ad distinction
3. Google. (n.d.). Why your Google Search results differ from others. Context and personalisation
4. Google. (n.d.). Refine Google searches. Operators
5. Google. (2025, December 10). site: search operator. Coverage limits. Google. (n.d.). Search Engine Optimization Starter Guide. SEO guidance. Live Google guidance checked October 2026.

The Pacific Northwest tree octopus website gives its imaginary animal a scientific name, a habitat map and an urgent conservation appeal. Its footer dates the site's creation to 8 March 1998 and names its author, Lyle Zapato. A name, a date and a detailed description are all things a reader might look for when choosing a source. Yet this particular species is a hoax.

Open the page as an example of how a website presents a claim, not as a wildlife reference. Notice the difference between two questions: does this page say that the animal exists, and what evidence establishes that it exists? You can answer the first by reading the page. The second requires checking beyond its own story.

What a reader study can tell you

In spring 2017, researchers used the site with one Dutch class of 27 children aged 11 or 12. Loos, Ivan and Leu reported the study in 2018. Only two children identified the hoax. The children saw an automatically translated version and were told this was an online reading exercise. They were not told beforehand that detecting a hoax was the purpose.

The questions matter. Researchers treated willingness to sign an imagined appeal to save the animal as an indication of trusting the page. That is an indirect measure of belief, not simply a question asking whether the site is reliable. One classroom cannot tell us what percentage of all children would be fooled. Nor did this study establish that a particular checklist caused the mistakes. It gives you a reason to practise checking, while its method limits the conclusions you can draw.

Why appearance is only a starting clue

A website can display headings, an author, a date, pictures and references without supporting its main claim. Those features are useful for finding something to investigate. They do not finish the investigation. A date can help you decide whether information is current, for example, but only after you know what was dated. Was the article revised, or did the site's footer simply change?

The tree octopus page illustrates the problem. Its map gives the story a location. Its scientific-looking name gives you something specific to search for. Its links may take you to real places or real organisations. Following a link about a forest would establish facts about that forest only if the linked source supports them. It would not, by itself, establish the existence of the invented animal.

The page does name an author, and other websites discuss it. Those facts do not rescue its wildlife claims. An outside mention might be explaining the hoax, repeating it as a joke, or copying the original. Read what that mention actually says and where its information came from.

So what?: A clue is a place to start checking. Evidence must support the particular statement you want to use. Moving to another website helps only if you evaluate that source too.

Four questions to guide the check

1. Who is behind this? Identify the author and publisher. Look for relevant expertise and responsibility for the page. A name is useful, but check that you have found the same person or organisation elsewhere.
2. What do other sources say about them? Leave the site and compare accounts with identifiable authors and evidence. A reference work can give you useful leads. Follow its references when the claim matters. Several pages repeating one press release are not several independent investigations.
3. What is the evidence? Choose the exact claim you need and trace its citation to a document, dataset or study. Read the relevant passage, including its conditions. A real source may concern a different age group, year or question.
4. Why does this exist? Look for a stated purpose, funding information and requests to buy, donate, vote or share. Record what you can document. A financial interest deserves attention, but it does not prove that every statement is false.

These questions can overlap. A funding statement may appear on the About page, while a citation may lead directly to a useful study. You do not have to ignore either until you complete a rigid sequence. Begin with a quick scan to identify the page's claim and publisher, check outside accounts early, and return to the evidence before relying on the claim.

Domains: registration is a different question

A top-level domain is the last label in a host name, such as .org in the address of a website. Its registration rules can tell you something about who is eligible to hold it. They do not tell you whether a particular article is accurate. The following rules were checked against the responsible organisations' guidance in October 2026.

For .edu, the main institutional category is U.S.-based postsecondary institutions with institutional accreditation from an accreditor recognised by the U.S. Department of Education. Postsecondary means education after high school. Accreditation of just one programme is insufficient. Qualifying system or district governing offices and certain nonprofit institutional associations or consortia can also register. The association rules include a requirement that at least 75 percent of institutional members qualify for .edu. Names already in existence on 29 October 2001 can be retained under grandfathering rules even when their holders do not meet today's eligibility requirements.

EDUCAUSE, which administers .edu, says its eligibility rules are independent of content. Registration is therefore not peer review of a page. Read the author, purpose and publication details of the actual material you want to cite.

History also needs care. RFC 1591, an Internet administration document from 1994, described .org as a miscellaneous category for organisations that did not fit elsewhere. Today's registry, Public Interest Registry, says .org is open to anyone. These statements explain a historical intention and a current rule. Neither supports saying that .org has never had any rules or that registration details are never checked.

For practice, suppose a page on a .edu domain says a named experiment has proved a claim. Do you already have a peer-reviewed study? No. You have a place to look for one. Find the experiment's authors and publication, check the original results, and distinguish a student assignment or commentary from the research itself. The domain narrows one question about the publisher; it does not answer the question about the experiment.

Read an About page for what it can show

An About page is evidence of how a publisher describes itself. It may also disclose its staff, funding and ownership. Those details are useful leads, and some may be supported by linked records. The page is not an independent check of its own claims.

Consider this invented practice case. The Institute for Family Nutrition Research says it is independent and lists a snack manufacturer as a sponsor. A separate article says the sponsor controls its conclusions but gives no document or named source. You now have a disclosed funding relationship and an unsupported allegation about control. Treating them as equally established would be a mistake.

Write two notes. First: the institute lists this sponsor; check a current annual report or other relevant record to confirm the relationship and period. Second: control of the conclusions is not yet established; look for evidence about who designed the study, analysed the data or decided what to publish. If you cannot find that evidence, say so. Funding can create a possible conflict of interest without settling whether a reported result is correct.

Work one citation all the way through

Continue the invented example. The institute's headline says, "Our snack improves concentration in all middle school students." It cites a real-looking report. In this exercise, the report says that 24 adult volunteers rated how alert they felt after eating the snack. It describes no comparison group. It does not measure schoolwork or test children. These details are supplied for practice, not findings from a real snack study.

Your result is not "the snack never helps anyone." The supplied report cannot establish the headline. A justified note would say: "This citation describes adult self-ratings and does not test the claimed effect in middle school students. I need research with relevant participants, an appropriate comparison and a measure of concentration." You have identified the missing evidence without pretending to have answered a different question.

Now change one fact. Suppose an independent article repeats the headline and links to the same report. Does that fix the problem? No. It adds another publisher, but no new evidence for the claimed effect. If a later study does test children, read its design and results before revising your note. A source check should be open to new evidence.

Leave early, then read closely

Wineburg and McGrew's study, published in 2019, compared 10 professional fact-checkers, 10 historians and 25 Stanford undergraduates as they evaluated online material while thinking aloud. Fact-checkers used lateral reading: they briefly inspected an unfamiliar site and then opened other tabs to investigate it. This is a finding about those participants and tasks, not proof that almost nobody else checks sources or that every check takes the same time.

Use that approach with a stopping rule you can explain. Search the publisher's name first. Add terms such as ownership or funding when they match your question. Read relevant results rather than treating a search snippet as a verdict. A search for criticism can reveal disputes, but allegations still need evidence, and only searching for criticism can leave you with a one-sided picture.

After the initial scan, choose among three next steps: use a well-supported source for the particular claim, keep investigating a specific uncertainty, or choose another source and leave this one unverified. A quiet search result is not proof that an unfamiliar organisation is fraudulent. It may simply leave you without enough information. There is no thirty-second or two-minute deadline after which uncertainty becomes certainty.

Remember: Before citing or sharing a claim, you should be able to name the evidence, show where it supports that claim and state any limit that affects your use of it.

Common misconceptions

• "A restricted domain means checked facts." Eligibility rules concern registration. They do not establish the accuracy of every page.
• "Leaving the site guarantees independent evidence." Another page can copy the original or make unsupported accusations. Trace its evidence and relationships too.
• "An About page is useless." It can identify people and disclose funding. Use those details as evidence of self-description and as leads for further checking.
• "One accurate citation makes the whole site reliable." A citation check supports only what you actually checked. Another claim may use a different source or go beyond the same source.

What to carry forward

The tree octopus page has enough detail to invite investigation, but its presentation does not establish the animal's existence. Ask who produced a page, what other sources say, what evidence supports the claim and why the page exists. Domain rules and funding records answer parts of that investigation. The decisive step for a claim is reading evidence that actually addresses it. Record an unanswered question as unanswered, then identify the source or fact that could help resolve it.

Sources

1. Zapato, L. (1998, subsequently updated). Save the Pacific Northwest tree octopus. ZPi. Primary example of the hoax, not zoological evidence. Original website
2. Loos, E., Ivan, L., & Leu, D. (2018). "Save the Pacific Northwest tree octopus": A hoax revisited. Or: How vulnerable are school children to fake news? Information and Learning Sciences, 119(9/10), 514-528. Methods and results, pp. 522-524. Published article in Utrecht University repository
3. EDUCAUSE. (n.d.). Eligibility; .edu frequently asked questions, eligibility and content policy sections. Guidance checked October 2026. Eligibility rules; Official FAQ
4. Cybersecurity and Infrastructure Security Agency. (n.d.). Eligibility for .gov domains. Guidance checked October 2026. Official .gov eligibility
5. Public Interest Registry. (n.d.). FAQs, registration without 501(c) status. Guidance checked October 2026. Registry FAQ
6. Postel, J. (1994). Domain name system structure and delegation (RFC 1591), section 2. Historical description, not current registration guidance. RFC Editor
7. Wineburg, S., & McGrew, S. (2019). Lateral reading and the nature of expertise: Reading less and learning more when evaluating digital information. Teachers College Record, 121(11), 1-40. Study overview in the authors' abstract. Publisher record and abstract

Sam Wineburg and Sarah McGrew compared 10 professional fact-checkers, 10 historians with Ph.D.s and 25 Stanford undergraduates as they evaluated online information. Participants spoke their thoughts aloud while using live websites. The researchers examined how people reached judgments, not just whether they could repeat a checklist.

The study's 2017 working paper describes six tasks taking about 45 minutes altogether and analyses three in detail. The 2019 journal article reports the same 45-person sample. In the reported tasks, fact-checkers often left an unfamiliar site to investigate it elsewhere. The authors called that approach lateral reading.

Read the study's finding with its limits

This was a comparison of existing groups, not a trial that randomly assigned people to learn a method. It cannot show that opening tabs alone caused better judgments. The sample was small, the websites were selected by the researchers, and participants worked with time limits while being observed.

The fact-checkers' conclusions were better supported overall, but they were not always faster. In the working paper's teacher-tenure funding task, their mean time was 2 minutes 8 seconds, compared with 1 minute 42 seconds for students. The fact-checkers did more checking. A short time is not the goal when the evidence remains uncertain.

Do not turn these findings into a promise that every check takes ninety seconds or that every historian stays on the original site. The study describes differences within groups too. It offers useful examples of skilled checking, not a stopwatch rule for every reader and topic.

What leaving the page helps you learn

Vertical reading means staying within a site and examining its content. Lateral reading means leaving it to investigate the author, publisher or claim through other sources. You may move between the two as questions arise.

A publisher's About page can supply names, ownership details and funding disclosures. Its article may link directly to useful evidence. Read those details. The limitation is that the publisher's self-description does not independently confirm its own reputation. A logo saying "trusted research" is a claim to investigate.

Outside sources need checking too. A hostile blog can make unsupported allegations about a publisher. A friendly article may copy its press release. Neither becomes good evidence merely because it has a different web address.

What matters here: Find out who is making the claim and trace the evidence behind it. Lateral reading adds outside context; close reading helps you test what the documents actually say.

A fictional claim about museum tickets

For practice, imagine a group called the Museum Access Forum. This name and all records in the example are invented. Its page says, "Free admission doubled museum attendance." You want to use the claim in a school project. The page has a tidy chart, an author and a link labelled annual report.

First make the question specific. Which museum, which years and what does attendance count? The headline leaves those details out. Scan the page and note that it compares one museum's 2023 and 2024 figures. You now have something precise to investigate.

Next, use another tab or window to look for information about the Forum. Start with its name. Add ownership or funding if that is the question you need answered. A search for criticism can find useful leads, but criticism itself is not proof. A search for the museum's attendance report serves a different purpose: checking the actual numbers.

You do not need to finish a fixed number of publisher checks before opening the report. If the source link is already available, inspect it. If an outside article introduces a new allegation, ask what evidence supports that allegation. Let the unanswered question guide the next step.

Pause before choosing a result

Click restraint means looking over search results before choosing a promising source, instead of treating first position as an instruction to click. Compare titles, publishers and descriptions. You do not have to read every result on an endlessly updating screen.

A search description helps you choose what to open. It may omit a qualification, and it is not a substitute for the full page. Open the source before quoting it or drawing a conclusion from it.

Suppose the fictional result list contains the Forum's own About page, a copied announcement, a local newspaper investigation and the museum's annual report. The investigation could help with ownership. The report could help with attendance. Choosing a source means matching it to the question, then checking its contents.

Four records, different jobs

Open the agreement before stating what the sponsor controlled. Funding alone does not prove that the sponsor dictated the claim. If the agreement covers advertising space but says nothing about editorial decisions, keep that distinction in your notes.

Read the report's definition of a visit. Suppose it counts entries, including repeat visitors. Then 40,000 visits does not mean 40,000 different people. Divide 40,000 by 20,000 to get 2: the recorded visits doubled. That calculation confirms the change described, within the stated measure.

The word "free" creates another question. The report says admission became free and a new wing opened in the same year. These records alone do not separate the effects of the two changes. You can report the doubling and both events. You cannot establish from this comparison alone that free admission caused the whole increase.

This is why identifying a publisher is only part of checking. You could correctly identify the Forum and still misread its evidence. You need the units, dates and conditions in the underlying source.

Independence is about where information comes from

An independent source, for the question you are checking, supplies information that is not simply controlled by or copied from the source under review. Ask about ownership, authorship and where its evidence came from. Independence is something to investigate, not something you can infer from a new URL.

The two community websites above add no separate attendance measurement. They repeat one announcement. A newspaper might also repeat the same report, even if its publisher has no connection to the Forum. That can be independent reporting in one sense without being a second measurement of visits.

Draw arrows from each article back to its evidence. If all arrows end at the same annual report, you have one set of attendance records discussed in several places. You may still have useful analysis, but you should not describe it as several independent datasets.

Nor does a vote among websites settle a factual question. One well-documented correction can outweigh many copied mistakes. Read the evidence and explain how it bears on the claim.

Use reference works to find leads

A reference work, such as an encyclopaedia, can introduce names, dates and useful search terms. Wikipedia may help you find a publisher's history and references. Treat these as leads: open the cited work, identify it and read the passage that supports the point you need.

If an encyclopaedia says the Forum was founded in 2018 and cites an interview, inspect the interview. Does it actually give that date? Does it describe the same organisation? A reference can be real yet fail to support the sentence attached to it.

A recent edit does not certify accuracy, and an old edit does not prove inaccuracy. Page history may help you notice changes, but the evidence for the particular claim matters more than a date alone. Be especially careful when a subject is changing: check the date of the underlying report as well as the summary.

Follow your teacher's citation rules. When you have actually read and used an original report, cite that report. Do not list a source you have not opened as if you read it. If you are analysing an encyclopaedia's wording itself, that page is the material being analysed, and the citation question is different.

What if the search finds nothing?

Suppose no useful outside account of the fictional Forum appears. Record what you searched and what remains unknown. A missing result does not establish that the group is dishonest, tiny or newly founded. The name might have changed, your spelling might be wrong or relevant information might not be indexed.

Try a fuller name, a named author or a linked public record. Ask a teacher or librarian for help if the evidence is hard to interpret. For the attendance claim, you may be able to use the museum's report directly and explain its limits, without resolving every question about the Forum.

If you still lack adequate evidence, leave the claim out or state the uncertainty. "I could not verify this with the sources I found" is different from "This is false." A deadline does not turn an unanswered question into a fact.

Write a conclusion that fits the records

A suitable conclusion for the invented case is: "The museum recorded 20,000 visits in 2023 and 40,000 in 2024. Admission became free and a new wing opened. These records do not establish how much of the increase each change caused."

Notice what the conclusion does. It retains the supported figures, gives the relevant years and refuses a causal claim the comparison cannot settle. You could separately note the Forum's disclosed sponsor if its role matters to your discussion. That disclosure is not a substitute for analysing the attendance evidence.

For a short checking note, record the claim, source, supporting passage and remaining uncertainty. Add a next step only if it could resolve that uncertainty. "Open more tabs" is too vague. "Find a study that compares attendance changes while accounting for the new wing" identifies the missing evidence.

Common misconceptions

• "A source cannot provide evidence about itself." It can disclose facts and link to records. Its own praise is not independent confirmation.
• "Three URLs mean three independent sources." They may copy one announcement or use one dataset.
• "Once I know the publisher, I know whether its claim is true." You still need to read the claim's evidence.
• "A useful check always ends quickly with yes or no." Some checks take longer or leave a clearly stated uncertainty.

Putting it together

Begin with the question you need to answer. Investigate unfamiliar publishers through outside sources, examine those sources too, and return to the underlying evidence. The result should be a conclusion you can explain from documents you have read, not a count of tabs or a judgment based on appearance.

Tomorrow, explain without looking back why the two copied announcements do not independently confirm the museum's attendance claim. Then change the example: imagine two researchers collect separate counts using different definitions of a visit. Explain why even genuinely separate evidence needs comparison before you combine it.

Sources

1. Wineburg, S., & McGrew, S. (2019). Lateral reading and the nature of expertise: Reading less and learning more when evaluating digital information. Teachers College Record, 121(11), 1-40. Journal record and abstract
2. Wineburg, S., & McGrew, S. (2017). Lateral reading: Reading less and learning more when evaluating digital information. Stanford History Education Group working paper. Methods, pp. 5-8; teacher-tenure task, pp. 30-34; limitations, pp. 35-36. This longer author version predates the journal article. Working paper hosted by Hendrix College
3. Digital Inquiry Group. (n.d.). About Civic Online Reasoning. Questions about the publisher, evidence and other sources. Curriculum authors' guidance
4. Google. (2025, December 18). In-depth guide to how Google Search works. Discovery and indexing limits. Google Search Central

In late 2017 a user on the discussion site Reddit, posting under the name deepfakes, began sharing videos in which one person's face had been swapped onto another person's body using machine learning. The account was shut down in early 2018. The word survived, and now covers a whole category of synthetic video and audio.

Two things happened at once after that. Making convincing fakes got much easier, which is the part everyone talks about. And a second, quieter thing happened: real recordings became easier to deny, because anyone caught on video could now say it was a deepfake.

You need a strategy for both, and it cannot be looking harder at the picture.

Four ways an image can lie

Look at the first row again, because it is the one people are least prepared for. The most successful misleading images are not edited at all. A genuine press photograph of a crowd, or a flood, or a protest, is simply posted with a caption saying it is somewhere else or some other year. There is nothing in the pixels to find, because nothing was done to the pixels.

Key idea: Most misleading images are real photographs with false captions. Examining the image cannot catch that.

What your eye can and cannot do

People love the list of tells: count the fingers, look at the teeth, check whether the text in the background is gibberish, look for jewellery that merges into skin.

Those tells were real, and they are closing. Each generation of image models fixes the visible faults of the last one, and the faults were never reliable anyway: plenty of genuine photographs have odd hands, blurred text and strange reflections, and plenty of generated images never had a hand in them at all. A test that produces both false alarms and misses is not a test you should build a habit on.

There is also a well-documented psychological problem. Being told to look carefully makes people more confident, not more accurate. Confidence and accuracy come apart, and the confident wrong reader is more dangerous than the uncertain one.

So the honest position is this. Your eye is a weak detector and getting weaker. Use methods that do not depend on it.

Reverse image search: the technique that actually works

A reverse image search takes a picture instead of words and finds other places that picture appears online. It answers the question that matters most: has this image been on the internet before today, and what did it say then?

1. Save the image, or copy its address by right-clicking and choosing copy image address.
2. Go to an image search service. Google Images, Bing Images and TinEye all accept an uploaded file or a pasted image address.
3. Upload or paste, and search.
4. Sort or scan the results for the oldest appearances. Most services let you filter by date.
5. Read what the earliest reliable page says about the picture: when it was taken, where, and by whom.

This finds recycled photographs immediately, which is the biggest category. A picture posted today as a flood in one country, and found on a news site from four years ago as a flood in another, is settled in under a minute with no image analysis at all.

Remember: The first question about a picture is not is it edited. It is where has this picture been before.

Checks that do not need your eye

• Ask who else has it. A dramatic event photographed by one anonymous account and nobody else is a warning. Real events of any size are covered from several angles by several organisations.
• Check the details against the claim. Language on shop signs, the side of the road cars drive on, the season shown by the trees, the weather. A photograph claimed to be from a snowstorm last week that shows trees in full leaf has answered itself.
• Search the claim with a date. If a named event happened, news organisations wrote about it. If nothing exists, that is informative.
• Look for the original. Screenshots of posts are trivially easy to fake by editing a page in a browser. Find the actual post, on the actual account.

Metadata, and why it is not the answer

Digital photographs carry hidden information called Exif data: camera model, settings, date and time, and sometimes GPS coordinates. When it survives, it is useful.

It usually does not survive. Most social platforms strip Exif when you upload, partly for privacy, and it can be edited by anyone with the right software. So Exif data that is present and consistent is mild supporting evidence, and Exif data that is missing tells you almost nothing.

A newer effort called Content Credentials, developed by an industry group called the C2PA, attaches a signed record to an image describing how it was made and edited, so that a viewer can check its history. Some cameras, editing programs and AI tools now add it. It is a genuine step forward and it has an obvious limit: it proves something about images that carry it, and says nothing about the enormous number that do not.

The second danger: everything can be denied

The obvious harm from convincing fakes is that people believe false things. The less obvious harm is the reverse, and researchers have named it the liar's dividend: once everyone knows that convincing fakes exist, any genuine recording can be waved away as one.

That is why the habits in this lesson matter in both directions. Where did it come from, who else has it, what is the earliest version, does anything independent confirm it. Those questions work on real footage someone wants to dismiss just as well as on a fake someone wants you to believe.

Bottom line: Verification is about tracing a picture to a source, not about staring at it. That protects you from fakes and from having real evidence dismissed.

Common misconceptions

• "You can spot AI images by counting the fingers." That worked on some earlier models, fails on newer ones, and produces false alarms on real photographs. It is a party trick, not a method.
• "If a photo is real, the post is true." The most common form of misleading image is a genuine photograph with a false caption. Real picture and false claim are entirely compatible.
• "Missing metadata means the image was faked." Almost every platform strips metadata on upload, so almost every image you see online has none. Its absence is the normal case.

Where this leaves us

The word deepfake dates from a Reddit account in late 2017, and the technology behind it has made both fakery and denial easier. Images mislead in four ways, and the most common by a distance is the completely real photograph with a false caption, which no amount of pixel-staring can catch. Visual tells such as odd hands are unreliable and closing, and being told to look carefully mostly raises confidence rather than accuracy. Reverse image search is the technique that actually works, because it answers where the picture has been before. Supporting checks include asking who else has the image, testing details such as language and season against the claim, and finding the original post rather than a screenshot. Exif data is weak evidence and Content Credentials are a real improvement that only covers images carrying them. And the same habits protect you from the liar's dividend, where genuine evidence is dismissed as fake.

Sources

1. Wikipedia contributors. (n.d.). Deepfake. Wikipedia. en.wikipedia.org
2. Wikipedia contributors. (n.d.). Reverse image search. Wikipedia. en.wikipedia.org
3. Wikipedia contributors. (n.d.). Exif. Wikipedia. en.wikipedia.org
4. Coalition for Content Provenance and Authenticity. (n.d.). C2PA. c2pa.org. c2pa.org
5. Content Authenticity Initiative. (n.d.). Content Credentials. contentcredentials.org. contentcredentials.org
6. Google. (n.d.). Search with an image on Google. Google Search Help. support.google.com

In 2018 three researchers at MIT, Soroush Vosoughi, Deb Roy and Sinan Aral, published a study in the journal Science. They had taken about 126,000 stories, shared by roughly three million people on Twitter between 2006 and 2017, and traced how each one moved.

Their headline finding was uncomfortable. False stories spread further, faster, deeper and more broadly than true ones, in every category they measured, and politics was the worst. They reported that false stories reached fifteen hundred people about six times faster than true stories did.

Then they checked whether automated accounts explained it. They did not. The researchers found that bots accelerated true and false stories at roughly the same rate, which meant the difference was coming from people, choosing to share.

Why the false version wins the race

The researchers' proposed explanation was novelty. False stories were measurably more novel than true ones, in the sense that they contained more information unlike what the sharer had recently seen. Novel information is valuable to pass on; it makes the sharer look informed, and it is interesting.

They also found that replies to false stories expressed more surprise and disgust, while replies to true stories expressed more sadness, anticipation and trust. Surprise and disgust are activating emotions. They make you do something, and the something available on a phone is to press share.

None of this requires anyone to be a liar. Nearly everyone who spreads a false story believes it and thinks they are being helpful.

Why this matters: The advantage of a false story is not that people are dishonest. It is that a story unconstrained by facts can be made more surprising than a true one.

The shape of a spread

A rumour does not travel evenly. It moves in a cascade, and three features of that shape matter.

• A few accounts do most of the work. Most shares reach almost nobody. A small number of accounts with large followings turn a local rumour into a national one in a single post.
• Each hop strips context. By the time a claim has been screenshotted, cropped and reposted four times, the original source, date and qualifications are gone. What remains is a sentence with no parent.
• Speed beats correction by design. Sharing takes one second. Checking takes a minute. The gap between those two numbers is where the whole problem lives.

Four reasons the correction never catches up

1. It is late. Verification takes time, so by the time a correction exists, most of the people who will ever see the claim have already seen it.
2. It is boring. The claim was surprising, which is why it moved. The correction is unsurprising by definition, so it has no fuel.
3. It reaches different people. A correction spreads through the networks of people who care about accuracy, which are not the same networks the rumour travelled through.
4. Repeating it can reinforce it. A correction has to restate the false claim in order to deny it, and restating something makes it feel more familiar.

That last one has a name.

The illusory truth effect

Psychologists have documented, across many experiments, that repeated statements are rated as more likely to be true than statements encountered once, even when people have information that should tell them otherwise. It is called the illusory truth effect, and it works because familiarity is fast and easy to feel, while checking is slow and effortful, so the brain accepts fluency as a rough substitute for evidence.

The practical consequence for you is direct. If you see a claim five times in a week, in five different places, it will start to feel true. That feeling is a report about how often you have seen it, not about whether it is so, and the five places may all be repeating one original post.

In short: Familiarity feels like truth. Seeing something repeatedly is evidence about circulation, not about accuracy.

Emotion is the fuel, and it is also the alarm

Content that makes people angry or disgusted spreads more than content that makes people thoughtful. That is true of true content as well as false content; it just happens that a fabricated story can be tuned for maximum anger, and a real one cannot.

This gives you a usable signal. The physical feeling of being outraged and wanting to share immediately is exactly the moment to stop. It is not that anger is wrong. It is that anger is what a manipulative post is engineered to produce, so the presence of that feeling is weak evidence that engineering has occurred.

Thirty seconds before you share

1. Who is the source? Not who posted it, but who originally reported it. If the post does not say, that is your answer.
2. When did this happen? Look for a date. Old stories recirculate constantly, often after an anniversary or a similar new event.
3. Is anyone else reporting it? Search a few words of the claim. For anything significant, more than one organisation will have it.
4. How does it want me to feel? If the answer is furious, slow down.
5. What happens if I am wrong? If the claim names a person or a group, being wrong causes harm to someone specific.

Thirty seconds. Against a share that takes one, and against a correction that will reach a fraction of the people the claim did.

Prebunking, which works better than arguing afterwards

Since corrections are weak, researchers have worked on the opposite approach: warn people about a manipulation technique before they meet it. This is called prebunking, and it draws on inoculation theory, an idea from the 1960s that a weakened exposure to a persuasive attack builds resistance to the full version.

In practice, prebunking means learning the patterns rather than the individual claims: emotionally charged language, false dilemmas, scapegoating, fake experts, and the recycled photograph you met in the last lesson. Once you know that a technique exists and what it looks like, examples of it stop working as well on you.

That is essentially what this whole course is. Not a list of false claims, which would be out of date within a month, but the shapes those claims come in.

The point: Learning the technique protects you against every future example of it. Learning that one specific story was false protects you against one story.

Common misconceptions

• "Only careless or unintelligent people spread false stories." The MIT study found humans, not bots, drove the difference, and the sharers overwhelmingly believed what they were sharing. Being clever is not much protection against a story engineered to feel urgent.
• "Automated accounts are the main problem." Bots amplified true and false stories at about the same rate in that study, so they cannot explain why false stories travelled further.
• "Correcting someone always backfires and makes them believe it harder." This claim spread widely from early research, and later work found the effect is much rarer and weaker than reported. Corrections often do help; they are just slower and reach fewer people than the original.

Putting it together

The 2018 MIT study of about 126,000 stories found false news travelling further, faster and deeper than true news, and traced the difference to human sharing rather than to bots. The likely reason is novelty: a story free of the obligation to be true can be made more surprising, and surprise and disgust are the emotions that make people act. Rumours move in cascades driven by a few large accounts, and each repost strips away the source and the date. Corrections lose because they are late, boring, aimed at a different audience, and forced to repeat the claim they are denying. The illusory truth effect means repetition feels like evidence, so a claim seen five times feels truer without being truer. A thirty-second check before sharing beats a correction afterwards, and learning the techniques, which is prebunking, beats learning individual debunked claims.

Sources

1. Massachusetts Institute of Technology. (2018, March 8). Study: On Twitter, false news travels faster than true stories. MIT News. news.mit.edu
2. Wikipedia contributors. (n.d.). Illusory truth effect. Wikipedia. en.wikipedia.org
3. Wikipedia contributors. (n.d.). Inoculation theory. Wikipedia. en.wikipedia.org
4. Wikipedia contributors. (n.d.). Misinformation. Wikipedia. en.wikipedia.org
5. Vosoughi, S., Roy, D., & Aral, S. (2018). The spread of true and false news online. Science, 359(6380), 1146-1151.

A stolen game-forum password can become the first guess at an email account. Imagine a fictional student, Alex, uses the same username and password for both. An attacker who obtains that pair does not need to solve a puzzle about Alex's favourite animal. The attacker can simply try the pair at the email service. A long password has not helped with this particular problem: someone already has it.

Now change one detail. Alex's email uses a different password. The leaked forum password no longer matches. Change another detail: the email sign-in also requires a security key. Knowing the email password alone would then be insufficient for that sign-in. Each defence answers a different question: can someone guess the secret, reuse a stolen secret, or complete the extra check?

Three routes an attacker might try

These are useful categories, not a ranking of every threat or a complete list. Software on a compromised device and weaknesses in account recovery can also matter.

In credential stuffing, a matching password is a useful starting point for the attacker, not a guarantee of entry. The service may require another factor or block the attempt. That is why Alex needs both unique passwords and additional protection. Reuse creates a connection between accounts that would otherwise have separate secrets.

Key idea: Length helps against guessing. Uniqueness prevents a password stolen from one account from being the password for another. Neither makes a fake sign-in page safe.

Length helps when the choices are unpredictable

Picture a toy code made by choosing each digit at random. One digit has 10 possibilities. Two digits have 10 times 10, or 100. A third gives 1,000. Each independently chosen digit multiplies the possibilities by 10. This little calculation explains why extra random characters can help. It is not a recommendation to use a three-digit account password.

The calculation stops describing the real risk if the person always chooses 123. There may be 1,000 possible three-digit codes, but an attacker can try common patterns before working through all of them. The same distinction applies to words. A long song lyric is long, yet an attacker can put familiar lyrics near the beginning of a guessing list. Adding an exclamation mark does not erase that predictability.

Symbols can contribute to a randomly generated password. The mistake is treating a familiar substitution, such as replacing a with @, as if it made a common word random. Length, selection method and secrecy work together. There is no universal promise that any long phrase beats every shorter random password.

The Federal Trade Commission's consumer guidance recommends at least 15 characters when you create a password, and describes generated passwords and random-word passphrases as options. Treat a minimum as a starting point, not proof of strength. A repeated character or a published example can meet a length rule while remaining a poor secret. Never use a password printed in a lesson, video or public example for an account.

What the current NIST rules actually say

The US National Institute of Standards and Technology published SP 800-63B-4 in 2025, replacing the earlier authentication guidance. Section 3.1.1.2 addresses organisations that check passwords. Under this standard, they require at least 15 characters for a password used alone; a password used only within multifactor authentication may have an eight-character minimum. They check proposed passwords against common, expected or compromised values, permit password managers, and do not impose character-mix rules or routine calendar-based changes. They do require a change when there is evidence of compromise.

Those are requirements for services following that standard, not a claim that every school or game site uses those settings. Your practical task is to use a long, unique secret and follow the account's supported process. If school rules differ, ask the school's technology staff for help. Do not try to bypass the rules. A suspected leak is a reason to seek help promptly, even if the password was changed recently.

A passphrase needs a selection method

A passphrase is a password made from several words. Choosing words by thinking of a surprising sentence still leaves your own habits in the selection. Opening a book and taking nouns is also not the same as giving every word in a defined list an equal chance: books repeat some words far more often than others.

EFF publishes a concrete dice method. With its long wordlist, five dice rolls identify one word. Repeat the process until you have six words, keeping the order selected. The random choices come first; a memory story comes afterward. Do not replace a result because another word would make a nicer sentence. Six words from that method are a specific recommendation, not a guarantee about any six words someone invents.

You can explain the method without creating or sharing a real secret. For this lesson, all practice stays fictional. Outside class, a trusted adult or school technology staff member can help choose an approved password manager or generation method that fits the account. If a site requires certain characters, a manager can generate a password that meets those rules. Making the same small change to one base password for every site preserves a predictable pattern.

What a password manager changes

A password manager stores account credentials and can generate and fill passwords. Its useful job is to make a different random password for each account practical. You do not need to memorise a separate string for every service. Many managers protect their stored collection, often called a vault, with encryption. The way you unlock it depends on the product and device.

A manager also becomes something worth protecting. Use its supported account protection, keep the device and software updated, and plan how access will be recovered. A strong master passphrase and MFA may be part of that setup. For a school-managed device or account, use the school's approved tools. Do not install an extension just because an advertisement calls it a password manager.

Autofill is convenient, but it is not a verdict that a page is safe. Products and matching settings differ, and you can still copy a password into the wrong page yourself. If a sign-in behaves unexpectedly, stop and reach the service through a known app or address. Ask a trusted adult or technology staff member to help. A manager reduces the burden of unique passwords; it does not remove the need to protect the device or notice suspicious requests.

Two factors, and why the method matters

Authentication is the process a service uses to check that someone controls the credentials for an account. A factor is a kind of evidence: something you know, something you have, or something you are. A password plus another password is still one kind. A password plus a code generated by your registered authenticator adds evidence that you have that authenticator.

Two-factor authentication, or 2FA, uses two different kinds of evidence. Multifactor authentication, or MFA, is the broader name for using more than one factor. These checks make a stolen password less useful, but methods do not all resist the same attacks. In particular, a fake page can ask for both the password and a fresh code and immediately relay them to the real service.

An app may also offer approval notifications rather than codes. Do not approve an unexpected sign-in request to make the notifications stop. A request is not proof that you initiated it. Likewise, an urgent message asking for a code should not become an instruction to hand it over. Get help through a contact route you already trust.

A passkey is not your fingerprint

A passkey uses a pair of cryptographic keys, mathematical credentials that let the service verify a sign-in without receiving the private key. It can be unlocked locally with a PIN, fingerprint, face check or another supported device method. The fingerprint is not sent to the website as the passkey. Some passkeys stay on one device; others sync through a provider so they can be used on more than one.

A compatible sign-in ties that credential to the intended service, so a lookalike domain cannot simply collect a reusable password from it. When the process requires both possession of the credential and local verification with a PIN or biometric check, it can supply multiple factors in one action. Do not assume that the number of screens tells you how many factors were checked.

Phishing resistance is a specific protection, not protection against every scam. A scammer could still ask someone who is already signed in to send money or disclose personal information. A service may also retain a password or recovery route alongside passkeys. Choosing a passkey does not prove those other routes disappeared.

Plan for a lost device before it happens

Account recovery is how someone regains access when the usual sign-in method is unavailable. Losing a phone should lead to an established recovery process, not a frantic search for a stranger who promises to unlock the account. Depending on the service, recovery may use saved codes, a recovery address, another registered device or help from the organisation.

Saved recovery codes are secrets too. Keep them in a secure place according to the service's instructions, accessible even if the usual device is lost. They do not belong in schoolwork, a chat or a shared document. A recovery address must still be under the account owner's control. For family or school accounts, plan this with the responsible adult or technology staff before changing settings.

Security questions can be weak when the answers are public facts. The FTC advises avoiding guessable or publicly discoverable answers and, when such questions cannot be avoided, using unique, long, random answers as secrets. That does not mean falsifying identity documents or school records. It applies to an account's secret recovery answers, whose storage and use should be planned with the account's responsible adult or administrator.

To decide where protection matters first, map the connections. In Alex's fictional case, the email account receives reset links for two other services. Protecting it helps protect those routes too. Not every account resets through email, and a school may control its own recovery. Look at the actual arrangement instead of assuming that one account unlocks everything.

Common misconceptions

• "A long password can safely be reused." Once stolen, its length does not prevent an attacker trying it elsewhere.
• "A new code cannot be phished." A fake page can relay a valid code while it still works. Freshness and phishing resistance are different protections.
• "A passkey means I can forget about recovery." A lost device, a synced credential or another sign-in route can still affect access.
• "I need to show my password to prove I did the activity." You can demonstrate every idea here using fictional accounts and written explanations.

What to remember

Return to Alex's forum and email. A unique email password breaks the reuse connection; a long, randomly selected secret helps against guessing; a suitable additional factor protects sign-in if a password leaks. A passkey or FIDO security key addresses the fake-site problem more directly than a code someone can type into the wrong page. Recovery completes the plan. Explain which attack each choice addresses, and you can assess a new situation without relying on a slogan about the single strongest tool.

Remember: Use fictional information for practice. Keep real passwords, PINs, codes and recovery answers out of classwork, and involve a trusted adult or school technology staff member in real account decisions.

Sources

1. National Institute of Standards and Technology. (2025). Digital identity guidelines: Authentication and authenticator management (SP 800-63B-4), sections 3.1.1.2, 3.2.5, 4.2 and 8. NIST standard
2. Federal Trade Commission. (2024, November). Protect your personal information from hackers and scammers, account protection and security questions. FTC consumer guidance
3. Federal Trade Commission. (2022, September). Use two-factor authentication to protect your accounts, attack types and authentication methods. FTC two-factor guidance
4. Electronic Frontier Foundation. (n.d.). EFF dice-generated passphrases, directions for the long wordlist. EFF generation method
5. FIDO Alliance. (n.d.). Passkeys, frequently asked questions on storage, sign-in, biometrics and multiple factors. FIDO passkey documentation

A message headed "Game Support" tells Alex to verify an account within 24 hours or lose every purchased item. Alex has a game account, so the warning sounds possible. But the message has not yet established who sent it or whether the account needs attention.

This is a fictional exercise. All addresses ending in .example below are reserved documentation examples, not services to visit. Read them on paper. Never send a test message, follow a suspicious link, or enter a password to investigate it.

Separate the request from the story

Phishing uses impersonation to draw you into giving up information or taking a harmful action. It can seek a password, payment, or an opened attachment. A convincing story is part of the attempt; it does not authenticate the sender.

Our sample says: "Unusual activity detected. Verify now to prevent deletion." Underline two things separately: the claim of unusual activity and the requested action of following a link. Alex can investigate the claim through the game's usual app without accepting that link.

These are reasons to pause, not a formula that classifies every message. Genuine notices can have deadlines. A fraudulent message can be patient and well written. A familiar logo, your correct name, or a plausible sender address does not settle the question.

Five ways the sample could pressure Alex

Change the fictional message one sentence at a time. "Do this before midnight" adds urgency. "The school administrator requires this" claims authority. "Your account will be deleted" threatens a loss. "Claim free game items" offers a reward. "See what someone posted about you" invites curiosity. These are examples of persuasion, not measured rankings of what works best.

Remember: Identify the action a message asks for, then choose an independent way to check whether that action is needed. You do not have to prove that a message is fraudulent before choosing a different route.

First find the host

A web address, or URL, has several parts. In https://play.arcade.example/account?view=items#help, the host is play.arcade.example. It names the destination host. The path is /account, the query begins with ?, and the fragment begins with #. Words in these later parts do not change the host.

For the ordinary HTTPS examples here, start after https:// and find where the authority part ends: at the next /, ?, #, or the end of the address. Within that part, separate the host from any user information before @ and any port after a colon. A port is a service number, not another domain label. This reading aid is for these examples; unusual URLs need a proper parser, not guesswork.

Work through row four slowly. The authority is arcade.example@notice.example. Split it at @. The host is on the right: notice.example. The familiar name on the left has not made this a destination within arcade.example. Browsers may hide user information when showing an address, which is one reason a copied string and an address bar can look different.

Why counting the last two pieces fails

Dots separate domain labels. A public suffix is a suffix under which names can, or historically could, be registered. Examples include com and co.uk. A suffix need not be one label. The maintained Public Suffix List records these boundaries; you cannot discover all of them just by counting dots.

The registrable domain is the public suffix plus the label immediately before it, where that label exists. This identifies a naming boundary, not the legal owner or the trustworthiness of a page. "Registered" would additionally imply an actual registration, which this calculation alone does not establish.

Here is a paper-only structure example: login.shop.co.uk. Given the public suffix co.uk, keep those two labels together. Add the preceding label, shop, to get shop.co.uk. Taking only the final two labels would return co.uk, a suffix shared by many unrelated registrations. This example says nothing about whether shop.co.uk exists or who operates it. Do not visit it.

A subdomain adds labels on the left. In our reserved example, play.arcade.example sits beneath arcade.example. In arcade.example.notice.example, the right-hand domain is notice.example; putting arcade.example at the beginning does not place it beneath arcade.example. A hyphen is different: arcade-login.example has a single label, arcade-login, before example.

What matters here: Find the host first, then its suffix boundary. There is no universal "last two labels" rule. If the boundary is unfamiliar, stop and use a known route instead of guessing.

What a correct address reading cannot prove

Return to Alex. Suppose the usual game host really were play.arcade.example. A correctly parsed message link to that host would match the expected spelling. That observation alone would still not prove that the requested payment, download, or disclosure was appropriate.

Subdomains may host different services or user content. A real account may be compromised. A link can also lead through a redirect. Do not label every page under a familiar domain "safe," and do not infer a person's identity from a naming boundary. The WHATWG standard explicitly cautions against treating the public suffix boundary as a hard security boundary.

HTTPS protects the connection to the site you reached; it does not establish that the site's operator is honest. A phishing site can use HTTPS. Browser symbols vary, and a lock symbol where shown is not an endorsement of the page. Compare this with a sealed envelope: protecting a message in transit does not establish that its sender's request is truthful. The analogy explains only that distinction, not the details of encryption.

Some browsers or mail apps show a destination when you hover over a link or use a preview control. Treat that as a clue, not certification of the final page. Do not open an unfamiliar destination to inspect it. If a link is shortened, obscured, or difficult to read, use the service's established app or a previously verified bookmark. For a school service, ask staff which route to use.

When the message knows your name

Spear phishing targets particular people using researched details. A message mentioning your team or teacher can still be fraudulent. Smishing means phishing by text message, and vishing uses voice calls. The channel changes; the need to verify an unexpected request remains.

In a second fictional example, Alex receives "Send me your login code" from a friend's familiar account. Alex calls the friend using an already saved number. Asking in the same possibly compromised conversation would not provide that independent check. The friend may need help securing the account if they did not send the message.

Respond to what actually happened

If this happens to you, stop interacting and tell a trusted adult or school support person promptly. Describe what you clicked, entered, downloaded, or approved. Do not include actual passwords or codes in that report. The next steps depend on the exposure:

• Suspicious message only: use the app or school's reporting procedure and delete it as directed. Do not forward it around to test friends.
• Possible harmful download: seek help with updated security software and a scan. On a managed school device, let staff follow their procedure before using it for sensitive sign-ins.
• Password disclosed or account taken over: reach the provider independently and follow its recovery instructions. Change exposed and reused passwords, end other sessions, check recovery details and email forwarding rules, and enable available MFA with support.
• Financial or identity information disclosed: involve an adult promptly. In the United States, IdentityTheft.gov gives steps tailored to the information exposed; FTC reporting is also available.

A forwarding rule can keep sending mail outward after a password change. An unfamiliar recovery address may offer another route into an account. That is why account recovery includes settings and sessions as well as a new password. These are possible changes to check, not proof that every attacker made them or that students usually overlook them.

Common misconceptions

• "Correct spelling proves a message is real." Good spelling supplies no independent confirmation of the request.
• "A familiar name anywhere in a URL identifies the destination." Locate the host; the name might be in user information, a path, a query, or labels beneath a different domain.
• "The last two labels always identify the registrable domain." A suffix such as co.uk already has two labels. Its preceding label is needed too.
• "Changing the password completes every recovery." The provider may require session, recovery-setting, or device checks as well.

Putting it together

Alex has three separate questions: what is being requested, where would the link go, and how can the account issue be checked independently? Answering only the second leaves the other two open. Practise identifying a host and a supplied suffix boundary, then state what remains unknown. If something has already happened, report the actual exposure so an adult or support person can help choose the right response.

Sources

1. Federal Trade Commission. (2022, September). How to recognize and avoid phishing scams. FTC
2. Public Suffix List. (n.d.). Public Suffix List and Learn more. Definition; Purpose and limitations
3. WHATWG. (2026). URL Standard, sections 3.2 and 4.8; living standard inspected October 12. WHATWG
4. Berners-Lee, T., Fielding, R., and Masinter, L. (2005). Uniform Resource Identifier (URI): Generic Syntax, RFC 3986, sections 3.2 and 7.6. RFC Editor
5. Mockapetris, P. (1987). Domain names: Concepts and facilities, RFC 1034, section 3.1. RFC Editor
6. Eastlake, D., and Panitz, A. (1999). Reserved Top Level DNS Names, RFC 2606, section 2. RFC Editor. Internet Assigned Numbers Authority. (2026). Special-Use Domain Names. Current registry
7. Adrian, D., et al. (2023, May 2). An update on the lock icon. Chromium Blog. Chrome Security team
8. Microsoft Security. (n.d.). What is phishing?, types and recognition. Microsoft
9. Federal Trade Commission. (2023, August). How to recover your hacked email or social media account. FTC
10. MDN contributors. (2026, January 8). What is a URL?, anatomy of a URL. MDN Web Docs

A fictional drawing app keeps three entries: a picture you uploaded, a record that you opened the brush menu at 4:10, and a prediction that you like landscape drawing. Only the picture was something you deliberately gave it. The menu record describes an action. The prediction interprets that action, and it could be wrong.

Now imagine its policy says it does not sell personal information. Does that tell you whether another company stores the picture? Whether the menu record is kept for a month? Whether the prediction shapes your recommendations? None of those questions is answered by that sentence alone. You need to follow the information through the service: where it comes from, what it is used for, who receives it, and when it is removed.

Three ways information enters a record

For this lesson, use three categories. They help explain how a service builds a record; they are not a universal legal classification, and they do not rank information by its size or price.

Follow the last row carefully. Opening a landscape tutorial is an observation. Deciding that you enjoy landscapes is an inference. Perhaps you opened it for homework, or someone else used the tablet. A system may act on a prediction without that prediction being a fact about you.

A real example appears in Google's privacy policy, effective October 1, 2026. It distinguishes information people provide, such as uploaded content, from activity and device information. It also describes using information to recommend content and personalize services. What it collects and uses depends on the service, settings and circumstances. That is evidence about Google's stated practices, not proof that every app collects the same fields.

Do not assume that the second category is always the largest or that the third is always the most valuable. A long uploaded video can be larger than a list of taps. A wrong prediction may have little use. To compare volume, you would need a defined measure, such as bytes over a stated period. To compare value, you would need to say value to whom and for what purpose. Category names supply neither measurement.

Key idea: Information can describe what you submitted, what was observed, or what was inferred. Knowing which is which helps you question a claim about you.

A cookie remembers something about a browser

A cookie is a small piece of data that a browser can store and send with later requests. It can help a site remember a sign-in session or a language choice. It can also support tracking. The cookie is a mechanism; its purpose depends on how it is used.

First-party and third-party describe the cookie's relationship to the site in the browser. A first-party cookie belongs to the same site; a third-party cookie is used in a cross-site context, such as content embedded from another site. This is a site relationship, not a test of whether two sites have different owners. Cross-site cookies can support shared sign-in features as well as advertising and analytics. Browser restrictions can block or separate them.

The FTC explains that tracking also uses methods such as pixels, device fingerprinting and mobile advertising identifiers. A cookie banner therefore cannot describe every possible source of information. Some notices offer a necessary-only choice and optional advertising or analytics choices. Read the purposes shown. The available choices and applicable rules vary; neither the button's colour nor the word cookie tells you that a practice is harmless.

In a paper example, a shop lists two purposes: keeping a basket between pages and measuring visits for advertising. If the exercise asks you to minimize optional advertising collection, choose the option that declines that purpose while retaining the basket feature. You have answered a question about this notice. You have not shown that the shop keeps no server records or that every website uses the same choices.

Search to locate a clause, then read around it

A privacy policy can be long because it covers several products, locations and types of information. Length alone does not reveal the writer's motive. Searching helps you find a relevant passage, but a matching sentence may depend on a definition, exception or regional section elsewhere.

1. Identify the document. Note the service, effective date and users it covers. A policy for adults may not describe a school's managed account or a younger child's service.
2. Find collection and purpose. Look for words such as collect, activity, location and advertising. List the information and the stated reason for using it.
3. Find recipients. Search share, disclose, service provider and third party. Read who receives which information for which purpose. Follow definitions and linked lists when supplied.
4. Find limits and choices. Look for retain, delete, sale, consent and opt out. Note conditions, exceptions and the region to which the statement applies.
5. Write a bounded conclusion. Separate what the passage says from what remains unknown. A missing search result means the wording was not found, not that the practice cannot occur.

For example, our fictional app says, "We send uploaded pictures to a storage provider so you can reopen them." You can identify the data, recipient category and purpose. You cannot name the provider, count its subcontractors or determine retention from that sentence. Those are useful questions to carry into the rest of the policy. Guessing answers would undo the value of reading it.

Why no sale does not answer every sharing question

Words can have a legal meaning narrower or broader than everyday speech. Under California's CCPA, sale includes certain transfers for money or other valuable consideration. Sharing has a specific definition involving cross-context behavioral advertising, which uses information from activity across different businesses or services, and can occur without payment. Both definitions have exceptions. The law applies to California consumers and covered businesses, not automatically to every service everywhere. See Civil Code section 1798.140.

Consequently, "we do not sell" alone does not establish that information never leaves a company. Nor does calling a transfer sharing make it legally exempt from sale rules. Read the definitions, recipients and purposes together. A transfer to a qualifying service provider has its own conditions; the label partner does not establish those conditions.

Consider two invented notices. Notice A says a company sends a delivery address to its delivery contractor. Notice B says it discloses browsing activity to another business for advertising across services. Both describe information moving, but the purposes differ. Before classifying either transfer under a law, you would need the law's scope, the parties' roles and the relevant facts. For this lesson, identifying those missing details is a better answer than declaring either transfer lawful or unlawful.

The point: A short privacy promise is one claim to interpret in context. It is not a complete map of collection, disclosure, retention or your rights.

Read phrases as questions, not secret translations

Try the distinction between a group total and an individual record. "Twenty people chose blue" summarizes a group. "User 17 chose blue at 4:10" keeps an individual entry. If another table maps User 17 to a name, removing the name from the first table has not broken that link. This invented example shows why you must examine the remaining information; it does not establish a universal re-identification rate.

Retention wording also needs context. Under the CCPA, covered businesses must disclose a retention period or criteria for determining it, and retention is limited by the disclosed purpose. Deletion rights have exceptions. Thus a vague sentence is a reason to investigate, not evidence of indefinite retention or a guarantee of immediate deletion. A policy cannot make every practice lawful simply by mentioning it.

Age rules have a scope

The United States COPPA Rule generally requires notice and verifiable parental consent for covered commercial online services directed to children under 13, and operators with actual knowledge that they collect personal information from such children. There are limited exceptions. The current rule also requires separate consent for third-party disclosures unless they are integral to the service. These are duties on covered operators, not a universal ban on children using the internet.

An age box does not, by itself, decide whether a service is covered. Nor does turning 13 make every service suitable or erase other privacy protections. Service terms and other laws can set different conditions. In a classroom case, identify the age, location and service before discussing a rule. Ask an adult or school staff member about a real account question; do not enter a false age to test a service.

What a permission does and does not control

A device permission controls access to a feature such as the camera, contacts or device location. Google's Android documentation describes choices such as access only while using an app, where available; choices and steps depend on the device and software version. A permission controls that access route. It does not erase earlier records or prevent someone from typing a location into a form.

Suppose our drawing app requests contacts. Its described task is drawing and saving pictures. No contact-related feature has been explained, so the request needs an explanation. That is enough to question granting it. It does not prove the app is malicious. If a separate feature lets you invite a friend, ask whether you can use that feature without sharing the whole address book.

Now suppose a fictional weather card offers a typed city instead of device location. For a city forecast, that alternative meets the stated task. A map giving turn-by-turn directions may need finer location. Start with the feature you actually need, then consider what access it requires. Do not assume every weather service or every navigation feature has identical requirements.

Restricting location access to use of an app can limit when it obtains device location through that permission. It cannot promise that no movement pattern is learned: repeated visits while using the app can still form a pattern, and other information may suggest location. Google's policy, for example, describes location sources including IP addresses and user activity. Device permission, account history and information already shared are related but distinct questions.

Common misconceptions

• "They only know what I type." A service may also record activity and make predictions. Check what this service actually describes.
• "No sale means no disclosure." The statement leaves other questions unanswered. Legal categories depend on the jurisdiction and facts.
• "A name-free record is always anonymous." A remaining identifier or combination of details may still link it to a person.
• "Denying one permission makes me invisible." It limits one access route, not every observation or earlier copy.

Where this leaves us

You can now separate an uploaded picture, a recorded tap and a predicted interest. None of those categories tells you automatically how much information exists or what it is worth. To read a policy, establish its scope, find the relevant passage and follow its definitions and exceptions. Record what you know and what you still need to know. In the offline activity, use that method to decide which claims the fictional notice supports.

Sources

1. Federal Trade Commission. (2025, as amended). Children's Online Privacy Protection Rule, 16 CFR sections 312.2, 312.3 and 312.5. Current eCFR text inspected October 13, 2026. eCFR
2. California Legislature. (2026). California Consumer Privacy Act of 2018, effective January 1, 2026, sections 1798.100, 1798.105 and 1798.140. Agency-hosted statutory text. CalPrivacy
3. Federal Trade Commission. (2023, September). How websites and apps collect and use your information. Sections on tracking and cookie notices. FTC Consumer Advice
4. Google. (2026, October 1). Privacy policy. Sections Information Google collects and Why Google collects data. A company's account of its practices, not an independent audit. Google
5. Google. (n.d.). Change app permissions on your Android phone. Current help page inspected October 13, 2026; version qualifications apply. Android Help
6. MDN contributors. (2026). Using HTTP cookies; Third-party cookies. Technical explanations of cookies, cross-site uses and browser limits. Using HTTP cookies; Third-party cookies

A fictional learner, Sam, opens a video app and sees three clips about skateboards. Sam's friend sees cooking clips. Neither screen is a survey of what everyone likes. Each is a set of items selected for that person at that moment. To explain the difference, separate the available posts, the rule used to order them, and the evidence that rule uses.

Choosing posts and ordering posts are different jobs

A feed has a pool of possible items. A following-only feed draws from accounts you follow. A wider recommendation feed can include unfamiliar accounts. The system must also decide an order. A chronological feed orders posts by time, often newest first. A ranked feed orders them using scores or other rules. Following-only describes the pool; chronological describes the order. One does not automatically mean the other.

Imagine six posts from accounts you follow. A chronological rule could put the newest first. A ranking rule could move an older post upward because it predicts that you will find it useful. Both versions use the same six posts. Ranking does not, by definition, require an endless feed or a larger pool. Check the feature you are discussing before claiming either.

A recommender system is software that selects or orders suggested items. It needs some way to estimate which items might suit a user. It can be mistaken. Showing Sam a skateboard clip is evidence of a selection, not proof that Sam loves skateboarding.

From a recorded action to a prediction

YouTube's help page, checked in October 2026, says its system compares viewing habits with similar viewing habits. It lists watch and search history, subscriptions, likes, dislikes, feedback and satisfaction surveys as signals. It also says different features rely on different signals: the current video matters most for Up Next, while Home relies mainly on watch history. These are the company's descriptions of its system, not an independent test of every recommendation.

One approach, collaborative filtering, uses patterns across people's interactions. In an invented example, viewers who watched clips A and B also watched C. A system could suggest C to another viewer of A and B. It is using a pattern of actions. It does not need to know that these people are friends, or that every one of them enjoyed C.

Another approach uses features of the item, such as its topic. A cooking tutorial could be matched with an interest in cooking. These approaches can supply information for a prediction; they are not competing explanations that exclude each other. A complete service can combine several kinds of evidence and rules.

Now consider Sam watching the same clip twice. The replay is an observed action. An inferred interest in skateboarding is an interpretation of that action. Sam might instead be checking an editing effect for homework. That possibility matters because the action alone does not tell us the reason for it.

Time spent on an item is often called dwell time. Treat any such measurement with the same care. Time on a screen is not direct access to someone's thoughts. A long pause might reflect interest, confusion or an interruption. To claim that a specific app records a particular pause, or gives it the greatest weight, you need evidence about that app and feature.

A score is only as useful as its job

Engagement means measurable interaction, such as watching, clicking or sharing. An engagement prediction estimates an action. An objective function is the mathematical measure a system tries to improve. Choosing that measure is a design decision. The measure may combine several goals, and separate rules can restrict which items are eligible.

Here is a deliberately simple, invented ranking system. Both clips are eligible. The only score is the predicted chance of a comment. No other rule changes their order.

First identify the target: comments. Then compare the two predictions: 30% exceeds 10%. Clip A therefore goes first. The reasoning needs no claim that A is true, useful or enjoyable. None of those qualities appears in this score. It also does not show that arguments always get more comments. Those predictions were supplied as assumptions in the example.

Change the target to a usefulness rating, and suppose B has the higher predicted rating. Under that new rule, B goes first. This shows why a score matters, but it does not reveal how a real app combines its goals. YouTube, for example, says it uses satisfaction surveys as well as behavioural signals. Calling every modern feed an engagement-only system would miss that distinction.

The point: Ask what a score measures, then ask whether evidence connects that measure to the outcome you care about. A predicted comment is not a fact-check or a measure of learning.

What evidence about conflict actually shows

A 2021 study by Steve Rathje and colleagues analysed 2,730,215 Facebook posts and tweets from news media accounts and US members of Congress. The data were collected in 2020 and mostly covered the preceding few years. References to political opponents were associated with more sharing. This was an analysis of existing posts, not an experiment assigning people to different ranking systems.

The authors explicitly identify that limit: their results are correlational, and the contribution of algorithmic choices is unclear. The study supports concern about incentives for divisive political content in those settings. It does not establish that every emotional post is amplified, that anger always wins, or that a feed inevitably becomes more extreme with each item. To test the effect of a ranking rule, researchers need a suitable comparison between rules, not just a count of successful posts.

A filter bubble is a question to investigate

The term filter bubble describes the concern that personalisation limits exposure to different ideas. There are several separate questions here. What content is available? What does the feed display? What does someone choose to read? Do their beliefs change? Evidence about one step does not settle all the others.

Brendan Nyhan and colleagues studied consenting US adult Facebook users during the 2020 election. Their experiment included 23,377 users and reduced exposure to sources with similar political leanings by about one-third. The intervention ran from 24 September to 23 December. It changed what people saw, but produced no measurable effect on eight specified attitude measures, including political hostility toward the other party. This was a particular reduction in exposure over three months. It did not test all platforms, young users, or the cumulative effects of years online.

A different experiment, published by Germain Gauthier and colleagues in 2026, tested X feeds in 2023. Active US users were randomly assigned to an algorithmic or chronological feed for about seven weeks; 4,965 completed the final survey. Among users initially on the chronological feed, assignment to the algorithmic feed shifted some policy and current-event views in a more conservative direction. The reverse switch showed no comparable effect. Neither switch significantly changed measured party attachment or hostility toward the other party.

These findings answer different questions. The X study relied largely on reported compliance and concerned a particular platform, period and active-user sample. Neither study tells you that your own feed is harmless or that it controls every belief. You also cannot rank user choice above algorithmic influence in every setting: a recommendation can affect which accounts someone chooses to follow.

Two screens do not measure the whole audience

Return to Sam's three skateboard clips. The observation is narrow: Sam saw those clips in that sample. One possible explanation is personalisation. Other facts, such as the available posts and which accounts Sam follows, may also matter. A friend's different screen does not isolate the cause.

Likewise, repeated appearances of a claim do not tell you how many people believe it. To investigate a claim about the public, look for evidence with a defined population, date and method, such as a well-described survey. To check a claim about an event, find the original evidence and reliable independent reporting. Searching can help you locate evidence, but search results and a friend's feed are also selected material. Neither is automatically a representative sample or a truth test.

Read a control's promise before relying on it

YouTube documents ways to influence recommendations, including Not interested and Don't recommend channel feedback, and watch or search history controls. Some features require signing in and vary by device or page. Its help explains that turning off and deleting watch history can remove Home video recommendations. These are specific product instructions, not a promise to remove all data or all suggestions everywhere.

For any control, write down three things: which feature it affects, what information or display it changes, and what it does not promise. A following-only option changes the source pool if that is what its documentation says. A time-order option changes the ordering rule. Neither guarantees accurate posts. Feedback is an input; without a stated rule or a test, do not call it stronger than every passive signal.

You do not need an account or a settings change for this lesson. If you later want to adjust a service you already use, read its current help with a trusted adult where needed. Treat a few changed posts as an observation, not a guaranteed result of your action. New uploads, other activity and changes by the platform can also alter a feed.

Common misconceptions

• "A long watch means I liked it." Watching is an action. Enjoyment is one possible explanation, not something the action proves.
• "Engagement ranking guarantees more conflict." That conclusion needs evidence about the content, predictions, rules and setting. The invented comment-only example works because its assumptions are stated.
• "I mentioned a product and then saw it, so the app used my microphone." That sequence alone does not identify how the item was selected. It proves neither microphone use nor its absence. Investigating a specific app requires evidence about its permissions and actual behaviour.
• "A chronological feed is an unbiased view of the world." Time order still operates on a selected pool. Posts can be inaccurate, and the accounts in the pool may omit important perspectives.

Putting it together

Start with what you can observe: a post appeared, a replay occurred, or a setting describes a particular control. Separate that observation from a guess about motives or effects. Then identify the selection pool, the ranking rule and the evidence used to make predictions. When a study tests effects, keep its population, period and outcome attached to its conclusion.

On paper, try explaining why a clip with many comments might still be a poor answer to a homework question. Your explanation should name the mismatch: commenting and answering accurately are different outcomes. Tomorrow, return without looking back and apply that reasoning to a popular but unsupported health claim. Check the claim's evidence before treating attention as authority.

Sources

1. YouTube. (n.d.). How YouTube recommendations work. YouTube Help. Checked October 2026. YouTube
2. YouTube. (n.d.). Manage your recommendations & search results. YouTube Help. Checked October 2026. YouTube
3. Rathje, S., Van Bavel, J. J., & van der Linden, S. (2021). Out-group animosity drives engagement on social media. Proceedings of the National Academy of Sciences, 118(26), e2024292118. Full article
4. Nyhan, B., et al. (2023). Like-minded sources on Facebook are prevalent but not polarizing. Nature, 620, 137-144. Updated article, with November 2023 correction. Nature
5. Gauthier, G., Hodler, R., Widmer, P., & Zhuravskaya, E. (2026). The political effects of X's feed algorithm. Nature, 652, 416-423. Nature

A pair of blue trainers appears beside a weather forecast the day after you viewed it in a shop's app. Did the shop recognise you? Did the advertising platform predict your interest? Could the same promotion be appearing for many people? The advertisement alone does not settle those questions. Start by separating what appeared on your screen from the information that might have selected it.

Who pays, and who does the selecting?

In an advertising-funded service, advertisers pay to reach an audience. The service earns money by supplying advertising opportunities and evidence about results. That creates a reason to attract attention and help campaigns perform. But a zero price does not identify a business model: a service might also receive donations, public funding, paid upgrades or income from purchases. Ask how this particular service is supported.

Three roles help you follow an ad. The advertiser wants to promote something, such as the trainer shop. The publisher supplies the space, such as the weather site. An advertising platform helps select and deliver ads. One company can perform more than one role. Information held by the platform is not automatically information handed to the advertiser.

Key idea: Ask two separate questions: what information helped select the ad, and what information the advertiser can actually access.

Several routes can lead to the same trainers

Targeting means selecting an audience or advertising opportunity using chosen signals. A signal might be the page topic, a recorded action or an estimated interest. An estimate can be wrong: researching trainers for a school project does not establish that you want to buy them. Different products, settings, ages and regions permit different signals.

These routes are examples, not a list of signals every service uses. Google documents both contextual selection and personalised ads. Its Customer Match product uses information a business has collected, while its lookalike documentation describes seeds drawn from customer lists, website or app activity, and YouTube engagement.

A lookalike is a model's judgement

Imagine a fictional outdoor shop building a campaign for adults where personalised advertising is permitted. First, it chooses a seed audience of previous customers. Next, the platform compares characteristics associated with that audience with information it has about other users. Then the campaign can seek additional potential buyers. The model does not need the shop owner to recognise each person, but that does not make the information used by the platform non-personal.

Do not read a product name as a permanent technical promise. Google's help, checked in October 2026, describes a phased change to Demand Gen lookalikes: the seed can guide delivery as a suggestion, allowing reach beyond the earlier similarity limits. Advertisers can retain constraint behaviour through an opt-out. Other platforms and campaign types can work differently. The useful concept is audience modelling; the exact delivery rules need current product documentation.

Now change one fact in the example. Suppose you previously bought a jacket from this shop and supplied your name, email and delivery address. Those records can already be in the shop's own system. Receiving a later ad cannot prove that the platform disclosed them. Nor does the word lookalike erase that earlier relationship. If you had never dealt with the shop, it might have no named customer record for you. Neither situation can be inferred just by looking at the ad.

Google's Customer Match documentation describes matching contact information using hashed codes. Hashing transforms data for comparison; it does not mean the business forgot the original information. The same documentation says Google may compare its users' profiles when generating similar audiences. That is a distinction between a business's input and a platform's modelling, not evidence that every advertiser receives those profiles.

What a report tells the shop

Google says it does not share information that personally identifies you with advertisers, such as a name or email, unless you ask it to. It describes aggregate advertising reports: results combined across people. Its audience reporting includes impressions, clicks and conversions, with group breakdowns such as age or interests. These are Google's stated practices, not a promise about every advertising company.

An impression is an ad display counted under the system's measurement rules. It is not proof that your eyes examined it. A click records an interaction; a conversion records a campaign goal, such as a purchase, under its tracking rules. Neither automatically establishes why the person acted. A shop may also learn directly from a visitor who follows an ad and submits an order, signs in or fills out a form.

Consider an invented report: 1,000 impressions and 20 clicks. You can calculate 20 divided by 1,000, or a 2% click-through rate. You cannot conclude that 1,000 different people read the ad, because impressions are not a count of attentive unique readers. You also cannot turn the group report into a list of names. At the same time, the shop may separately hold named orders. Keep the report and the customer records distinct.

How an automated auction can fill a space

Real-time bidding is one way to sell advertising opportunities as they arise. Google's Authorized Buyers documentation describes a request-and-response process. Here is a simplified version, with the shop represented by software rather than someone clicking a bid button:

1. A site or app has an opportunity to show an ad. A request describes the opportunity using the fields available in that system.
2. A bidding system evaluates the request against a campaign's rules and decides whether and how much to bid.
3. It sends a response containing a bid and the proposed advertisement before the deadline.
4. The auction selects a qualifying response under its rules, and the winning ad can be delivered.

This runs quickly, but not on one universal stopwatch. Google specifies bidder response deadlines of 80 to 1,000 milliseconds, depending on format and auction type. That is a response window, not a measurement of the entire page load. There are 1,000 milliseconds in a second, so these deadlines range from 0.08 seconds to 1 second.

Do not assume every auction awards the space to the largest cash bid. Google's Search ad auction also considers factors such as ad quality and search context. A higher bid alone does not guarantee the best position. An advertiser may value a previous visitor, but retargeting does not guarantee a higher bid, a winning ad or a sale. A creator's agreed sponsorship is also a different arrangement from an auction that selects a banner as a page loads.

A recommendation can also be a promotion

A creator can demonstrate a game, review shoes or recommend a drink while having a commercial relationship with the brand. A paid article can resemble the articles around it. Look for labels and explanations of who supplied money, gifts or other benefits. A friendly tone does not tell you whether a relationship exists; an absent label does not prove either payment or independence.

In the United States, the FTC's Endorsement Guides explain how its law against deceptive advertising applies. A connection that could affect an endorsement's credibility must be disclosed clearly when the audience would not reasonably expect it, including when a significant minority does not understand or expect it. Relevant connections can include payment, free products, employment or family relationships. The Guides interpret Section 5 of the FTC Act; they are not a separate statute.

For an invented example, a shop gives a creator trainers to feature in a review. Viewers could mistake the review for an ordinary independent purchase. A clear statement near the recommendation explaining that the shop supplied the shoes helps them judge it. A vague thank-you hidden behind a button does not explain the relationship to someone who never opens it. FTC guidance says disclosures should be easy to notice and understand; video disclosures need to fit how the endorsement is communicated, including both sound and visuals when both carry it.

Labels can help, but do not guarantee immunity to persuasion. In an experiment published in 2020, Eva van Reijmersdal and Sophia van Dam studied 406 Dutch students aged 12 to 16 using one sponsored YouTube video. Participants were randomly assigned to disclosure conditions. Across the sample, the disclosure groups scored higher on recognising the sponsored content as advertising than the group without a disclosure. The study measured immediate questionnaire responses to that video, not lasting resistance to every ad or actual purchasing. Recognition and buying behaviour are different outcomes.

A free download can lead to spending

Some games earn income from advertising or optional purchases. A paid loot box offers a random virtual reward rather than a known item. Loot boxes can also be earned through play. The FTC's 2020 workshop report records concerns about confusing costs and pressure to spend, along with differing views on regulation. It does not establish that every free game uses these features or that every loot box has the same legal status.

Try a fictional shop inside a game: 500 coins cost $5, and a cosmetic item costs 300 coins. If you start with no coins and only that pack is offered, obtaining the item requires spending $5, leaving 200 coins. The item uses $3 worth of that pack, but you cannot buy it by paying only $3 under these conditions. A countdown does not change that calculation. Before deciding, check the actual cash payment, what you receive, whether the result is random, and whether you want it without the timer.

Controls have a scope

Cookie and tracker controls can reduce some tracking. They do not erase a shop's existing customer records, and cookies are not the only way to recognise activity. The FTC describes pixels, device fingerprints and advertising identifiers as well as cookies. Account-linked activity also matters. Clearing one browser's cookies therefore cannot promise that all personalised advertising or retargeting stops.

Read the explanation beside an ad personalisation setting. Google's My Ad Center controls Google ads within its stated scope; it does not control other companies' ad systems. With personalisation off, contextual factors can still make an ad relevant. This is not an ad blocker or a promise that a short sample will contain exactly the same number of ads.

Age rules matter here. Google says ads are not personalised while you are signed in if your account information shows you are under 18. The switch may already be off or unavailable. Do not change your age or create an account to run this lesson's activity. Use the paper examples, or inspect available controls with a trusted adult when appropriate.

Common misconceptions

• "If nobody types my name, no personal information is involved." Records and estimates can concern you even when a screen shows only an identifier. Ask which organisation holds which information.
• "This ad proves that one particular search caused it." Several routes can produce the same ad. A possible explanation remains a hypothesis unless there is evidence connecting it to delivery.
• "A group report means the advertiser knows nothing about me." The report and the advertiser's own customer information are different sources. Check both before drawing that conclusion.
• "A disclosure makes a recommendation true." It reveals a relationship. You still need evidence for claims about the product.

What to carry forward

When the trainers appear again, describe what you actually know: an ad was shown in a particular place. Then consider the possible selection route, the information held by each organisation and the limits of the report. Remember: a relevant ad is not proof of mind reading, complete anonymity or a disclosed identity. Use the controls that apply to your account, look for commercial relationships, and pause before treating a promotion as evidence that you need the product.

Sources

1. Google. (2026). Real-time bidding, Basics; updated September 17. Google for Developers
2. Google. (n.d.). How the Google Ads auction works. Google Ads Help
3. Google. (n.d.). About Customer Match; How Google uses Customer Match data. Product overview; Data handling
4. Google. (n.d.). Use Lookalike segments to grow your audience; Use Lookalike segments in Demand Gen campaigns as a Targeting Constraint. 2026 transition; Constraint behaviour and insights
5. Google. (2026). Privacy policy, effective October 16, advertising and measurement sections. Google
6. Google. (n.d.). About Audience reporting; Impressions: Definition. Audience reporting; Impressions
7. Federal Trade Commission. (2023). Guides concerning the use of endorsements and testimonials in advertising, 16 CFR 255.0 and 255.5, current text checked October 16, 2026. Purpose and definitions; Material connections
8. van Reijmersdal, E. A., and van Dam, S. (2020). How age and disclosures of sponsored influencer videos affect adolescents' knowledge of persuasion and persuasion. Journal of Youth and Adolescence, 49, 1531-1544. DOI: 10.1007/s10964-019-01191-z. Original study
9. Federal Trade Commission. (2020). FTC video game loot box workshop: Staff perspective and accompanying release. Workshop report; Definition including earned rewards
10. Federal Trade Commission. (n.d.). How websites and apps collect and use your information. Consumer Advice
11. Google. (n.d.). How personalized ads work; Control what data Google uses to show you ads. Controls and contextual ads; Account age and data

In 1998, two newspaper pages in Spain carried notices about a property auction connected with Mario Costeja Gonzalez's social security debts. Years later, searches for his name still led to those pages. He said the proceedings had been resolved and asked for the information to stop appearing.

A search result is not the original page

In 2014, the Court of Justice of the European Union ruled in the Google Spain case that qualifying links could have to be removed from results for a person's name even when the original publication remained lawful. The decision weighed privacy against the public's interest in access. It did not give everyone a worldwide right to delete any unwanted article.

This distinction matters before you make a request. A newspaper controls its page. A search engine controls its results. A person who saved an image controls another copy. Each is a different place where you might need help.

The EU's later General Data Protection Regulation, or GDPR, includes a right to erasure in Article 17. It has conditions and exceptions, including freedom of expression and legal obligations. These are EU rules with a defined scope, not a promise available in every country. For a real case, ask a trusted adult to help check the current rules and service instructions.

Three ways a record can form

A digital footprint is the trail of information associated with your online life. It includes public material and records that are not visible in a name search. Use these three questions to sort an example:

These labels describe how information was created. They do not tell you whether it is public, harmful or accurate. A private message was deliberately sent. A public club photo was posted by somebody else. Neither example tells us which category makes up most of a person's footprint.

The US Federal Trade Commission explains that sites and apps can record activity using tools such as cookies and device identifiers. Records may support preferences, usage statistics or advertising. What a particular service collects depends on its design, permissions and policies. Do not assume every app records every action or location.

Key idea: Ask both where the information came from and who can access it. Those are different questions.

Possible readers are not a measured audience

A public page may be found by friends, family, a future employer or someone trying to misuse information. Australia's eSafety Commissioner describes checking what friends or employers could find. That advice does not tell us who searches most often. Possible access does not tell you how often each group looks, or why.

There is a specific reason to protect recovery details. Some accounts ask questions to help regain access. The FTC advises avoiding answers that can be found online and using long, random answers if such questions cannot be avoided. Plan their secure storage with the adult or administrator responsible for the account. Never put real recovery answers in schoolwork.

Consider this invented example: a profile names a pet, and an account uses that same name as its recovery answer. The public fact could help someone attempt recovery. It does not prove anyone has tried, or that the service would grant access. Hiding the post may reduce exposure, but an exposed recovery answer also needs attention through the account's official settings.

Follow the copies

The FTC warns that a recipient can save or share content, even when an app offers disappearing messages. Deleting your post therefore cannot guarantee that every copy disappears. Deletion can still be useful. Read the service's instructions to learn what is removed, what may be retained and whether there is a delay.

A web archive stores snapshots of web pages. The Internet Archive's Wayback Machine is one example. Its help explains that some sites and page features are missing from its records. An archive is neither a complete copy of the internet nor proof that a particular post has been saved.

Try tracing a fictional photo through three places. Jo uploads it to a club page. Pat saves a copy. A search engine lists the club page. If the club removes its photo, Pat's saved file is a separate question. If the search engine removes its link first, the club page may still exist. Draw a box for each location and cross out only the box affected by the stated action.

Google's current removal guidance makes this limit explicit: removing a result does not remove the content from the website hosting it. Some removals affect particular name searches; others are broader. Eligibility and public interest matter. Do not promise that a request will be accepted, or that one request will clear every search engine.

A small audit you can do on paper

You can complete this lesson without an account, a personal search or any real photographs. Use the fictional records below. Do not search classmates or submit private information. If you later choose to review your own accounts, involve a trusted adult where needed and follow school, service and local age rules.

For each row, write the audience, the concern and one next step. The first row gives a reason to review public access. The second calls for a request to the club. The third needs its own search-service check. The fourth is uncertain: a shared username can suggest a connection, but does not prove two accounts belong to the same person.

A real search is also incomplete. A name can match somebody else, and a service's private records will not all appear in public results. Finding nothing is not proof that no records exist. You are checking a particular route to information, not producing a complete inventory.

What a private window can and cannot show

Chrome's Incognito mode starts a separate session and does not automatically sign you into websites. It limits what Chrome keeps on the device when the session ends. It does not make you invisible to sites or the organisation running your network.

That can help you inspect a signed-out view, but it does not reproduce what every stranger sees. Google says results can vary with location, language, device and time, even without personalised recommendations. If you sign in during the private session, do not treat it as a signed-out check.

In a fictional comparison, Jo searches the same name on Monday and Friday and sees a new club result on Friday. What changed? Perhaps a page was added or the ranking changed. The two observations alone cannot identify the cause. Record what appeared and when; do not convert one result list into a claim about everyone's view.

Choose the control that matches the problem

eSafety recommends reviewing privacy settings, asking for unwanted posts to be removed and setting boundaries on tags. Check the help for the particular service. A tag-review feature may govern whether a tagged post appears on your profile; that is a different function from deleting the original photo. Do not assume that removing a tag removes the image.

Suppose a fictional help card says, "Approve tagged posts before they appear on your profile." Jo enables it. The card promises a review step for Jo's profile. It does not say the club photo disappears or becomes private. To address that photo, Jo still needs to consider the club's page and its audience.

For an ordinary unwanted photo, a specific request gives the person a clear action: "Please remove the team photo posted on Tuesday." This is an option, not a measured guarantee that friends will comply. If there are threats or it feels unsafe to contact the person, ask a trusted adult to help with the service's reporting route instead.

Privacy choices also involve purposes. A public drawing may help Jo share artwork. A route home is not needed to explain that drawing. Jo could keep the artwork public while removing the route. The useful question is which information serves the intended purpose and audience.

Priority depends on what is happening

In a routine review with no reported threats, an exposed recovery answer or a detailed current location deserves prompt attention. But "an embarrassing photo is low priority" is too broad. The same image may be part of bullying, unwanted identification or a threat. Ask what the content reveals, who has access and whether someone is using it to cause harm.

If someone threatens or pressures you, get help from a trusted adult promptly. You do not have to finish an audit first. eSafety advises people facing threats over intimate images to stop contact and not pay or send more intimate material. Reporting services differ by country. Use current local help with an adult rather than assuming Australia's reporting process applies everywhere.

Do not download, copy or pass around sexual images of anyone under 18 for this exercise or as a class report. Google's reporting guidance specifically warns against screenshots containing such images. An adult can help you follow the correct reporting instructions without spreading the material.

Common misconceptions

• "A matching username proves who owns an account." It is a clue. Another person might use the same name.
• "A removed search result means the source was deleted." Search visibility and source removal are separate outcomes.
• "Private browsing shows everyone's results." A separate session does not remove every source of variation.
• "If I cannot remove every copy, there is no useful step." You can still reduce access, ask for help and address exposed account details.

Pulling it together

Return to Jo's club photo. Name the source page, the search result and any separate copy. Then choose one action for the specific place you want to change. State its limit: requesting removal is not proof of removal, and a missing result does not prove a missing source.

Tomorrow, try the same reasoning with an invented public event listing. Explain what you would change if it revealed someone's current routine. Check your answer against the source, audience and concern questions above. You do not need to disclose your own footprint to show that you understand how to review one.

Sources

1. Court of Justice of the European Union. (2014, May 13). Google Spain, C-131/12, paragraphs 14-17, 81-85 and 93-99. Judgment. European Parliament and Council. (2016). Regulation (EU) 2016/679, Article 17. GDPR
2. Federal Trade Commission. (2023, August). Heads Up: Stop. Think. Connect. FTC youth guidance. Federal Trade Commission. (2023, September). How websites and apps collect and use your information. FTC tracking guidance
3. eSafety Commissioner. (2026, September 24). Digital footprint. eSafety. eSafety Commissioner. (2026, September 18). Someone is threatening to share my nudes. Youth support guidance
4. Google. (n.d.). Browse in Incognito mode; Why your Google Search results differ from others; Remove my private info from Google Search. Live documentation checked October 2026. Chrome Help; Search context; Removal scope
5. Internet Archive. (n.d.). Using the Wayback Machine. Internet Archive Help

In December 2022 the Pew Research Center published a survey of American teenagers aged thirteen to seventeen. Nearly half, forty-six percent, said they had experienced at least one of six online behaviours: being called offensive names, having false rumours spread about them, being sent explicit images they did not ask for, being asked repeatedly where they were and who they were with by someone other than a parent, being physically threatened, or having explicit images of them shared without their consent.

Name-calling was the most common by a distance. Physical threats were the least common. That spread matters, because it means most of what happens is at the lower end and a small amount is serious, and the two need different responses.

Three things that make online conflict different

• There is an audience. A corridor argument has two people and maybe three onlookers. An online argument has everyone who scrolls past, which changes the incentives: now both people are performing, and backing down costs more.
• There is a record. Something said in a moment of temper stays there, screenshottable, quotable, and re-readable at three in the morning.
• You cannot see a face. Psychologists call this part of the online disinhibition effect: without the immediate feedback of someone's expression, people say things they would not say in person, because none of the signals that normally stop us are arriving.

None of these makes anyone a bad person. They are properties of the medium, and knowing them is what lets you notice when they are acting on you.

The point: The audience, the record and the missing face are what make online conflict escalate faster than the same conversation in a room.

Three different things, three different responses

The distinction that matters most is the second and third rows, and the key word in the third is repeated. One rude comment from a stranger is unpleasant. The same person doing it every day for a fortnight is a different situation with different rules.

If it is aimed at you

1. Do not reply straight away. This is the hardest instruction here and the most useful. Anything you write in the first ten minutes will be the thing you regret, and it becomes part of the record.
2. Record it before anything else. Screenshot the message with the username, the date and the time visible. If you block or report first, you may lose access to the evidence. Save the screenshots somewhere that is not the app.
3. Use the platform's tools. Block stops contact. Mute hides someone without telling them. Restrict, where it exists, lets their comments be visible only to them. Choose according to whether you want them to know.
4. Report it. Reporting is often slow and imperfect and it still matters: repeated reports build a record, and some categories, especially threats and images of a minor, are acted on quickly.
5. Tell someone. Not because they will fix it, though they might, but because harassment works partly by isolation and telling one person ends that.
6. Stop reading it. Checking to see whether it has got worse feels like vigilance and is not. Hand the account to someone you trust for a few days if you need to.

Remember: Screenshot before you block. Once you block, you often cannot get back to the evidence.

Why just ignore it is incomplete advice

Ignoring is genuinely the right response to a single rude comment from a stranger, because a reply is the reward.

It is bad advice for sustained harassment, for three reasons. It leaves no record, so if it escalates you have nothing to show. It leaves the target alone with it. And it does nothing about an audience who are watching to see whether this is acceptable here, which is often what determines whether it continues.

If it is aimed at someone else

Research on bystanders is fairly consistent: what stops harassment is not usually the target defending themselves, but other people making it clear the behaviour is not accepted. Three things work, in roughly this order of effectiveness for someone your age:

• Message the target privately. Say you saw it and it was not okay. This costs you nothing publicly and is repeatedly described by targets as the thing that helped most.
• Do not amplify. Do not screenshot it onward, do not quote it to argue with it, do not add a reaction. Attention is the fuel, and a pile-on is made of individually reasonable contributions.
• Say something short and public if you can. Not an argument. Something brief such as this is not okay changes what the audience thinks is normal, which is the thing actually being contested.

And report it. You can report content aimed at someone else, and a target being reported for by several people carries more weight than one report from the person involved.

If you were the one who was cruel

This happens, usually in a moment of temper or as a joke that landed differently in text than it did in your head. An apology that works has three parts and none of them is an explanation:

1. Name what you did, specifically. Not if anyone was offended, but I said this and it was cruel.
2. Say what you will do, which usually means delete it and not do it again.
3. Stop. Do not ask them to say it is fine, and do not explain what you meant. An apology that requires a response is a request, not an apology.

When to involve an adult

Clear thresholds are more useful than judgement calls in the middle of something upsetting. Tell an adult if any of these is true:

• Anyone threatens to hurt you or anyone else.
• Anything sexual is involved, including images, requests for images, or an adult contacting you.
• Someone has an image of you they are threatening to share. This one is urgent, and it is not something to handle alone. Never pay and never send more.
• It has continued after you blocked and reported.
• It is making you dread school, avoid your phone, or lose sleep.

Adults respond better to a specific report than a vague one. Bring the screenshots, the dates and the usernames, and say what you have already tried.

Worth holding on to: The four thresholds are threats, anything sexual, images of you, and anything that will not stop. Those are not judgement calls.

Common misconceptions

• "Blocking someone makes it worse." It sometimes prompts a reaction from another account, and it still removes the easiest route to you and demonstrates the behaviour was unwelcome, which matters if you later report.
• "Reporting never does anything." Reporting is inconsistent and slow, and it does work for some categories, especially threats and images involving minors. Repeated reports also build the record that later action rests on.
• "If I tell an adult they will take my phone away." This is a real fear and worth saying out loud when you tell them. Ask directly for help with the specific problem and say what you do not want to happen. Most adults would rather help than confiscate, and the ones who need convincing respond better to a clear, evidenced account.

What you now know

Pew found in 2022 that nearly half of American teenagers had experienced at least one of six online behaviours, with name-calling most common and threats least, which means most incidents are at the lower end and a few are serious. Online conflict escalates because it has an audience, leaves a record, and removes the facial feedback that normally stops us. Disagreement, cruelty and harassment are three different things and only the third needs the full procedure. If it is aimed at you: do not reply immediately, screenshot before you block, use the platform tools, report, tell someone, and stop reading. If it is aimed at someone else: message them privately, refuse to amplify, and say something short in public. If you caused it, apologise in three parts and stop. And four thresholds send you to an adult without deliberation: threats, anything sexual, images of you, and anything that continues after you blocked and reported.

Sources

1. Pew Research Center. (2022, December 15). Teens and cyberbullying 2022. Pew Research Center. pewresearch.org
2. StopBullying.gov. (n.d.). What is cyberbullying. U.S. Department of Health and Human Services. stopbullying.gov
3. StopBullying.gov. (n.d.). How to report cyberbullying. U.S. Department of Health and Human Services. stopbullying.gov
4. Wikipedia contributors. (n.d.). Online disinhibition effect. Wikipedia. en.wikipedia.org
5. Common Sense Media. (n.d.). What is cyberbullying. Common Sense Media. commonsensemedia.org

In 1989, 2 Live Crew recorded Pretty Woman, a parody of the song written by Roy Orbison and William Dees. The group borrowed the opening bass riff and first line, then changed the lyrics and music. The publisher sued. In Campbell v. Acuff-Rose Music, Inc. (1994), the United States Supreme Court rejected the lower court's approach and sent the case back for further proceedings.

The Court explained that selling a parody does not automatically defeat fair use. It also explained why a parody may need recognisable parts of the song it criticises. But the Court did not finally decide that every part of this borrowing was fair. Questions about the repeated bass riff and relevant markets still needed attention. Even this famous decision asks you to examine the use, the amount and the evidence.

Four questions before you borrow

Suppose you are making a video about your class garden. You find a photograph, a song and a paragraph about bees. Before copying them, separate four questions: is the material protected by copyright; who controls the rights you need; do you have permission; and, if not, does an exception allow this use? A credit line cannot answer all four.

This lesson explains United States law. Rules in other countries can differ. The examples are practice in reasoning, not decisions about your own legal dispute. For an actual school publication, a teacher or librarian can help you check the materials and the school's permissions.

Protection, ownership and registration

Copyright protects original works of authorship that are fixed in a tangible medium. In ordinary language, a human author must independently create expression with at least a little creativity, and record it in a sufficiently lasting form. Writing a story in a notebook or saving your original photograph can meet these requirements. An idea you have not written, drawn or recorded is different.

Copyright protects expression rather than the underlying ideas, facts or methods. You may report a city's population without owning that fact. Someone's original paragraph explaining it, or creative arrangement of a chart, may contain protected expression. Titles, names and short phrases alone generally do not qualify for copyright. So "everything is copyrighted" is the wrong starting rule.

For an eligible original work you create today, protection begins on fixation. You do not need to publish it, add a copyright symbol or register it first. A photograph without a notice is not therefore free to copy. Equally, a symbol cannot turn a bare fact into protected expression.

Ownership asks a different question. Copyright generally starts with the author or authors, but a work made for hire has a special rule, and rights can be transferred. Owning a paper print or buying a song does not by itself transfer its copyright. The owner has exclusive rights such as copying, adaptation and distribution, with public performance or display rights depending on the kind of work. These rights are subject to legal limits, including fair use.

Registration records a copyright claim with the Copyright Office; it does not create protection in an otherwise ineligible work. Registration or refusal is generally needed before bringing a federal infringement lawsuit over a United States work, subject to statutory exceptions. Timing also affects access to certain remedies. That procedural question is separate from whether copyright exists and whether a particular reuse infringes it.

Key idea: Protection, ownership, registration and permission to reuse are different questions. Check the one your project actually raises.

When a work is in the public domain

For a work created on or after January 1, 1978 by one identified individual author, and not made for hire, the usual United States term is the author's life plus seventy years. A joint work by authors who did not work for hire generally runs through the last surviving author's life plus seventy years.

Works made for hire generally have a term of ninety-five years from first publication or one hundred and twenty years from creation, whichever ends first. Anonymous and pseudonymous works generally follow that rule too, with an exception when an author's identity is revealed in the Copyright Office's records. Older works have additional rules. Do not date a work's copyright by the date someone uploaded a copy.

A work in the public domain has no copyright protection in the relevant jurisdiction. Its public-domain expression does not require copyright permission. But check which material you have: an old musical composition and a recent recording of it are distinct works. A recent recording or new creative arrangement can have its own protection. Public-domain status also does not settle every other issue, such as privacy or a misleading claim of endorsement.

Fair use is part of the law

Section 107 says that fair use is not copyright infringement. It permits qualifying uses without the copyright owner's permission. You do not have to wait to be sued before relying on it. If a dispute reaches court, fair use is also an affirmative defence: the person claiming it must support that position.

A licence is permission from someone authorised to grant the relevant rights, often with conditions. Fair use works differently: it is a legal limit on those rights. Neither a licence for one purpose nor a fair use analysis of one use automatically covers every later use. Playing material during a qualifying face-to-face lesson and uploading a video to the public are different acts. The classroom exception in section 110(1) is not a general permission to copy or post anything for school.

The fair use inquiry weighs four factors together. It is not a four-point score or a rule that one factor always wins. Criticism, comment, news reporting, teaching, scholarship and research are examples in the statute, not automatic passes. Noncommercial use can favour a claim; commercial use does not automatically defeat it.

Under factor one, courts consider whether the use has a further purpose or different character, often called transformative use. Changing colours, adding a caption or including a song in a new video does not settle that question. Explain what the borrowed material does in this particular use.

In Andy Warhol Foundation for the Visual Arts, Inc. v. Goldsmith (2023), the Supreme Court considered the first factor for a specific commercial licence of a Prince image to a magazine. Although Warhol's image added expression to Lynn Goldsmith's photograph, the two uses shared substantially the same purpose of illustrating magazine stories about Prince. The first factor favoured Goldsmith. New meaning can matter, but it is not enough by itself. The Court's inquiry was about that challenged licence, not every possible use of Warhol's images.

Factor four also needs more than a guess. A free upload might substitute for buying or licensing the work, but "the owner could ask for money" cannot automatically defeat every fair use. Campbell distinguished market substitution from harm caused by criticism: a negative review may discourage purchases without replacing the original. Relevant markets and evidence matter. No known lost sale is not the same as no potential market effect.

Work through the school video

Start with these fictional facts: a student copies an entire released pop recording into a garden video for a nonprofit school project, posts it publicly and credits the performer. The music runs underneath the footage without discussion of the song. No permission has been identified. This supplies more to analyse than the label "school video" alone.

1. Purpose. The educational setting is relevant. The song's role as background entertainment, with no analysis of it, gives less support for a distinct purpose than a review explaining its musical choices. We cannot declare all school videos transformative or all of them untransformed from the label alone.
2. Nature. The song and recording involve creative expression. This consideration generally weighs against fair use compared with borrowing factual material. The recording has been released, so the example is not an unpublished-work case.
3. Amount. The entire recording is used. Ask why the full track is reasonably needed for the stated purpose. These facts give no explanation for needing all of it as background, which weakens the claim. Whole-work copying is not automatically disqualifying in every case.
4. Market. Investigate whether the video substitutes for listening to the recording or for a relevant licensed music-in-video use. Public availability, the way the music is presented and the relevant market all matter. The short description does not establish actual lost sales or settle this factor.

The reasoned conclusion is that this example raises substantial fair use concerns, especially about the role and amount of music. It is not a verdict reached by counting four failures. To proceed with the project, the student could use their own music or music whose permission covers the planned video and public posting. A song's composition and its recording may have different rights holders, so permission needs to cover the material and rights actually used.

Now change the video: it closely analyses the song's rhythm, playing selected passages while explaining them. That supplies a stronger reason for some borrowing. It does not automatically justify playing the whole recording. Reconsider all four factors, including why each excerpt is needed and whether the presentation supplies a substitute for the original.

Three shorter cases, with missing facts named

A novel quotation. In a fictional essay, a student uses three sentences from a published 300-page novel to analyse those sentences, cites the source and gives the essay only to the teacher. The critical educational purpose and limited amount support fair use, and the essay is unlikely to replace the novel on those facts. The creative nature of the novel still matters, as does the significance of the chosen passage. This is a stronger argument, not a guarantee that any three sentences in any setting are fair.

A film-still meme. "One frame plus new text" leaves the purpose unclear. Text that examines or parodies the depicted scene supplies different facts from text that uses a striking image only to attract attention to an advertisement. Inspect the image's role, the amount and significance taken, and relevant markets. Neither the word meme nor the small fraction of the film decides the outcome.

A textbook chapter. Suppose students scan a whole current chapter into a group chat specifically so classmates can avoid buying that assigned chapter, with no permission identified. Studying is an educational purpose, and the chapter may contain factual writing. Those points do not erase the substantial copying and the stated replacement of purchases. The argument is weak on these facts, but saying it fails all four factors would hide the reasoning.

A platform claim is a separate event

YouTube's Content ID scans uploads for matches to audio and visual reference files supplied by rights holders. A match can lead to blocking, advertising revenue or viewership tracking, depending on settings and location. This database is not the Copyright Office's registration record. A match identifies content; it does not establish how a court would weigh the use.

The Digital Millennium Copyright Act also provides a notice-and-takedown process tied to online service providers' limits on liability. A rights holder can submit a removal notice, and a person whose material was removed can have a counter-notice option. A takedown is not itself a court judgment or proof that a lawsuit has been filed.

A counter-notice is a legal step that includes contact information, statements under penalty of perjury and consent to court jurisdiction. For a real problem, involve a parent or guardian and the school, and get qualified legal help when needed. This activity does not ask you to upload material or file notices. Whether a system flags an upload cannot be predicted from the short classroom examples, and the absence of a claim does not establish permission.

Common misconceptions

• "Credit makes copying lawful." Credit identifies a source. It is not itself a licence or a substitute for the fair use analysis. Some licences and legal rules do require attribution, so credit is not legally irrelevant either.
• "Thirty seconds or ten percent is always allowed." United States fair use has no universal numerical safe allowance. Ask how much was used, how significant it is and why that amount serves the purpose.
• "No infringement intended gives permission." That statement supplies no permission and does not establish fair use. Work through the rights and the use instead.
• "Public domain means this download has no other rights to check." Check the exact version and any separately protected recording, arrangement or added material. Copyright status alone does not clear every other legal issue.

Where this leaves us

Before using someone else's work, identify the material and your planned use. Check protection and who can grant the rights you need. Read any permission's terms. If relying on fair use, write down the purpose, nature, amount and possible market effects, including what you still do not know. Weigh those reasons together. A careful answer can say both what supports a use and what needs more evidence.

Remember: Schoolwork, credit, a short excerpt, a new message and a clean upload screen are each incomplete answers. Your explanation should connect the actual use to the actual rule.

Sources

1. United States. (Current hosted text reviewed October 15, 2026). Copyright Act, 17 U.S.C. Sections 101-107 and 110(1), 201-202, 302, 408 and 411-412. Chapter 1; Chapter 2; Chapter 3; Chapter 4.
2. Supreme Court of the United States. (1994). Campbell v. Acuff-Rose Music, Inc., 510 U.S. 569, especially pp. 577-594. United States Reports
3. Supreme Court of the United States. (2023). Andy Warhol Foundation for the Visual Arts, Inc. v. Goldsmith, 598 U.S. 508, especially pp. 525-537 and 541-543, opinion of the Court. Supreme Court page proof
4. United States Copyright Office. (n.d.). What is copyright? Originality, fixation, ownership and registration. Copyright Office
5. United States Copyright Office. (n.d.). Fair Use Index, About Fair Use. Copyright Office
6. YouTube. (n.d.). How Content ID works. What does Content ID do? YouTube Help
7. United States Copyright Office. (n.d.). Section 512 resources, FAQs for material removed and counter-notices. Copyright Office

A bridge photograph comes with the label CC BY-NC-ND 4.0. In this fictional project, you want to put it on a public class page about local architecture. The label offers permission, but you still need to connect its terms to what you plan to do. Will you share the photograph as supplied, turn it into a new creative work, or use it to advertise something?

Creative Commons supplies standard licences that rights holders can use to give permission in advance. The person granting the licence is the licensor. That person must have authority over the rights they offer. A CC label on a stranger's upload cannot give away someone else's copyright.

Read the version as well as the letters

The six main CC licences are BY, BY-SA, BY-ND, BY-NC, BY-NC-SA and BY-NC-ND. All include attribution. The other letters add conditions. This lesson's worked cases use the 4.0 International licences. The number matters: some rules in earlier versions differ, including the permission to make private adaptations under ND.

The short licence page, called the deed, helps you understand the label. The linked legal code supplies the actual terms. CC licences cover specified copyright and similar rights, not every possible restriction. For example, they do not license trademark rights or another person's privacy rights. They also do not let you imply that the creator endorses your project. When passing on the material, do not add legal conditions or technological restrictions that prevent recipients from exercising the licensed rights.

First ask whether you need the licensor's permission for this use. An applicable legal exception, such as fair use in the United States, can allow a use independently of a CC licence. The licence does not take that exception away. The examples below assume permission is needed, the licensor has the relevant rights, and you are relying on the stated licence rather than a separate agreement.

ND: a change is not always an adaptation

In the 4.0 terms, Adapted Material means a change based on the original that requires permission under the licensor's copyright or similar rights. A translation of a protected story is a useful example. The legal threshold depends on applicable law. The mere fact that you clicked an editing button does not settle it.

The licence separately allows technical modifications needed to use the work in another medium or format. Those modifications do not by themselves create Adapted Material. Printing a digital text can require formatting changes. Converting an image file to a format needed by your presentation can be a technical change. Keep the other licence conditions, including NC where present.

Cropping needs more thought than a rule that every crop is forbidden or every crop is harmless. Removing a border and creatively changing a photograph's composition are different actions. Whether a particular crop creates an adaptation depends on what changed and the applicable law. If you cannot resolve that question, use the supplied image, choose material that allows sharing adaptations, or seek permission with help from a teacher.

Now separate making an adaptation from sharing it. Under BY-NC-ND 4.0, you may make and keep a noncommercial adaptation privately. The licence does not authorize sharing that adaptation with the public. Under BY-ND 4.0 the private-adaptation permission is not limited by NC, because that licence has no NC condition. Do not carry either rule over to an older licence without reading it.

For the bridge project, a copy of the supplied photograph on a genuinely noncommercial public class page can fit BY-NC-ND 4.0 if you meet its attribution and other terms. A private, noncommercial creative remix can also fit. Publishing a remix that qualifies as Adapted Material cannot rely on that licence's permission. Calling it a school project does not remove ND.

The point: Ask what kind of change you made and whether you will share it. ND 4.0 is not a blanket ban on editing, cropping, printing or changing file formats.

NC concerns the use; SA concerns a shared adaptation

NC asks about the purpose of the use. Giving a poster away does not automatically make it noncommercial: a free poster could advertise a business. A school or charity can make a commercial use, and an organisation that earns money can make a noncommercial use. If a proposed use is primarily directed at commercial advantage or payment, the NC licence does not authorize it. For a borderline case, get clarification or choose material with permission that covers your plan.

SA answers a different question: on what terms can you share an adaptation? Suppose you translate a story licensed BY-SA 4.0 and plan to publish the translation. Section 3(b) requires your adapter's licence to be a CC licence with the same elements, version 4.0 or later, or a licence CC lists as BY-SA compatible. Using BY-SA 4.0 for your contribution is a straightforward permitted choice. The original work remains licensed, and attribution still matters.

Now suppose you put an unchanged BY-SA photograph beside your separately written text in a collection, without creating an adaptation of the photograph. The photograph keeps its licence. SA does not automatically require every independent item in the collection to use that licence. Nor does SA force you to publish private work. The trigger is sharing Adapted Material, not merely having another person's file in the same folder or project.

Build credit from the information supplied

Title, author, source and licence, often shortened to TASL, are a useful starting point. They help a reader identify what you reused. They are not a complete replacement for the conditions in the relevant version.

1. Title: include the supplied title as good practice. A title is not required by the 4.0 licences, although earlier versions require it when supplied.
2. Author: retain the supplied creator identification and anyone else designated for credit, following reasonable naming requests. Do not substitute the search engine's name for the photographer's name.
3. Source: retain a supplied link to the material where reasonably practicable. A file's source page is more useful than the website's home page.
4. Licence: identify the exact licence and version and provide its text or a link. Keep supplied copyright, licence and warranty-disclaimer notices.
5. Changes: indicate modifications and retain notices of previous modifications. A change note does not itself grant permission for a change the licence does not cover.

The 4.0 terms allow a reasonable method for the medium and context. A link to a page containing the required information can work. If the licensor asks you to remove specified attribution information, remove it where reasonably practicable. Never turn a credit into a claim of sponsorship.

Try a fictional credit card: Bridge at Dusk; A. Rivera; source page printed on the card; CC BY-NC-ND 4.0; copyright A. Rivera; supplied without warranties. For an unchanged, noncommercial copy, a draft caption could read: Bridge at Dusk by A. Rivera. Copyright A. Rivera. CC BY-NC-ND 4.0. Supplied without warranties. In a real digital caption, link the title to the recorded source page and the licence name to the licence. Check for any additional supplied notices before treating the draft as finished.

Find permission on the individual item

Google's usage-rights filter uses information supplied by image hosts or providers. It is a way to find candidates, not a guarantee of ownership or permission. Follow the licence-details link and check the source, the exact licence and any excluded material. If the creator and uploader differ, investigate whether the uploader is authorized to offer the work. Save the source and terms in your project notes.

A government domain is not a blanket reuse licence either. In the United States, section 105 generally excludes federal government works from copyright under that title, and section 101 defines those as work made by federal officers or employees as part of official duties. That does not cover everything a government website hosts. Transferred copyrights and statutory exceptions also exist. Check the item's credit and rights notice; do not extend this US rule to every country's government or every contractor's work.

Public domain means the work is not protected by copyright in the relevant jurisdiction, for example because protection expired or did not apply. Freely available only describes access. A photograph you can download without paying can still have a copyright owner and restrictive reuse terms.

CC0 1.0 is a separate public-domain dedication tool. The person applying it waives their copyright and related rights as far as law permits, with a public-licence fallback where the waiver is ineffective. It does not require attribution, but school citation rules still apply. CC0 does not waive patent or trademark rights or clear other people's rights. A CC0 photo of someone does not automatically give you every permission for every use of their likeness.

Permission and honesty answer different questions

Copyright infringement concerns using protected rights without permission or an applicable legal exception. Plagiarism concerns presenting someone else's words, ideas or work without proper credit. A citation cannot grant copyright permission. Conversely, permission does not make another person's writing your own.

Consider four clearly specified cases. You quote a paragraph with the author's permission, mark it as a quotation and cite it: both questions are answered. You copy an original public-domain text into your essay as though you wrote it: copyright does not block that copying, but you have plagiarised. You copy a protected paragraph without credit, permission or an applicable exception: both problems can arise. You publicly reproduce a protected work with a correct credit but without required permission or an exception: credit does not cure the infringement.

Remember: Check the right to reuse and the duty to acknowledge separately. A short quotation is not automatically fair use merely because it is short, and an educational purpose alone does not settle that legal question.

What a citation has to do

A citation points to the evidence for a statement. Give the reader enough information to find the source and the relevant passage. Record the author or organisation, title, available publication or update date, and location, such as a URL. For a quotation from a long book, a page number helps. For a licence, its version and section matter more than the date you found it.

For example, the claim about private adaptations can cite Creative Commons. (n.d.). Attribution-NonCommercial-NoDerivatives 4.0 International, section 2(a)(1)(B). Add the legal-code link listed below. The section tells the reader exactly where to look; 4.0 tells them which text to check. Here n.d. means no publication date has been supplied in the citation. It does not mean the licence has no version.

Use the style your teacher requests. Cite what you actually read. If a source describes another work you have not opened, acknowledge that indirect route rather than pretending to have checked the original. When you put a source's argument into your own words, cite it too. A paraphrase changes the wording, not the origin of the idea. General common knowledge does not need a citation for every sentence; a borrowed explanation, specific finding or distinctive claim does.

Check the citation by trying to use it. Does it open the specific work? Can you locate the supporting passage? Does the cited edition match the claim? A recent date does not prove a claim true, and an older date does not make a historical document or a specified licence version useless.

Common misconceptions

• "ND means never change a pixel." Technical modifications are permitted. A private adaptation and a shared adaptation also have different treatment under 4.0.
• "Free of charge means NC." A giveaway can serve a commercial purpose. Read the use's purpose, not just its price.
• "SA takes over my whole project." A shared adaptation triggers SA; a collection of separate works does not automatically change every item's licence.
• "A credit line fixes any permission problem." Attribution satisfies one set of duties. It does not authorize sharing an ND adaptation or remove another person's rights.

Putting it together

Return to the bridge photograph. Record the item, creator, licence version and supplied notices. Describe your planned use, including changes, audience and purpose. Then check each condition: does NC fit the purpose; does ND permit what you will share; does a shared adaptation trigger SA; and have you supplied the required attribution? Check other rights and cite the source of any borrowed ideas. If one step remains unclear, that is a question to resolve before publishing, not a gap to hide with a credit line.

Sources

1. Creative Commons. (n.d.). Attribution-NonCommercial-NoDerivatives 4.0 International: Legal code, sections 1(a), 1(h), 2 and 3; Attribution-NoDerivatives 4.0 International, sections 1(a) and 2(a). BY-NC-ND terms; BY-ND terms
2. Creative Commons. (n.d.). Attribution-ShareAlike 4.0 International: Legal code, sections 1, 2 and 3(b). Official ShareAlike terms
3. Creative Commons. (n.d.). Attribution 4.0 International: Legal code, sections 2 and 3. Attribution and other rights
4. Creative Commons. (n.d.). Frequently asked questions, sections on NonCommercial, adaptations, collections and attribution. Official explanations
5. Creative Commons. (n.d.). Recommended practices for attribution, Basic components of attribution. TASL guidance
6. Creative Commons. (n.d.). CC0 1.0 Universal: Legal code, sections 2 to 4. Dedication, fallback and limitations
7. Google. (n.d.). Find images you can use & share, Review the license & terms of reuse. Search Help
8. United States Copyright Office. (n.d.). Copyright law of the United States, title 17, sections 101, 105, 106 and 107. Statutory text
9. Purdue Online Writing Lab. (n.d.). Plagiarism overview; Quoting, paraphrasing, and summarizing. Plagiarism guidance; Acknowledging borrowed material

In 2023 a lawyer in New York filed a legal brief in a case against the airline Avianca. It cited half a dozen previous court decisions, with names, volume numbers and quotations. Opposing counsel could not find any of them, because none of them existed. The lawyer had used a chatbot to do the research and had not checked the results. In June 2023 a federal judge fined the lawyers involved.

The interesting part is not that a tool made things up. It is that the citations looked exactly right. Correct format, plausible court names, realistic volume numbers, quotations in the proper register. The output had every feature of a real citation except being real.

Understanding why that happens tells you almost everything you need about using these tools.

What the tool is actually doing

A large language model is trained on an enormous quantity of text, and what it learns is how text goes: which words and structures tend to follow which others, across billions of examples. When you type a question, it produces a response by repeatedly predicting what should come next.

It is not looking anything up. There is no internal encyclopaedia it consults and no list of facts it checks against, unless it has been specifically connected to a search tool, and even then the checking is imperfect. What it has is a very good model of what an answer to a question like yours usually looks like.

Most of the time that produces something true, because true statements are extremely common in the text it learned from. When it does not, the output looks exactly as confident as when it does, because confidence is a feature of the writing style, not a report on the model's certainty.

Key idea: The tool predicts what an answer looks like. Truth is usually a side effect of that, and never a guarantee.

Why citations specifically

Now the New York case makes sense. A citation has a very regular shape: a case name, a volume number, a reporter abbreviation, a page, a year. That shape is easy to learn and easy to reproduce.

The content behind the shape is much harder, and the model has no separate step where it verifies that a particular combination corresponds to a real document. So it generates a perfect-looking citation to a case that never happened, and it does so in exactly the same tone it uses for a real one.

Anything with a strong regular format is vulnerable in the same way: references, page numbers, statistics, quotations, dates, product specifications, scientific study titles.

Four kinds of error

The last row deserves emphasis because it is counter-intuitive. A system that writes beautifully about mathematics can get simple arithmetic wrong, since writing well and calculating correctly are different capabilities. Fluency is not a signal of accuracy, and it feels like one.

What they are genuinely useful for

Being fair about this matters, because advice that says never use it will simply be ignored.

• Explaining something several ways. If a textbook explanation did not land, asking for a different angle, or a simpler one, or an analogy, is a real use, and you can check the result against the textbook.
• Working on text you supply. Summarising a passage you paste in, restructuring your own paragraph, spotting where your argument is unclear. The material is in front of it, so fabrication is much less likely.
• Getting unstuck. Twenty possible topics, a list of angles you have not considered, questions you should be asking. You then do the actual work.
• Arguing against you. Paste your own argument and ask for the strongest objections. This is one of the best uses and almost nobody does it.
• Practice questions. Ask it to quiz you on material you are learning, then check the answers against your source.

Notice the pattern. The safe uses are ones where you already have the material, or where you will immediately verify the output, or where being wrong costs nothing because you are brainstorming.

The verification rule

Treat every factual claim from these tools exactly as you would treat a claim from a confident stranger on the internet: as unverified.

Specifically, check anything in these categories before repeating it: names of people, numbers and statistics, dates, quotations, titles of books, studies or articles, and any citation at all. Those are the categories where fabrication is both most likely and most damaging.

And when you check a citation, check that the source exists and that it says what was claimed. A real source attached to a claim it does not support is a failure mode you have already met in the lesson on evaluating websites.

The point: Never repeat a name, number, date, quotation or citation from an AI tool without confirming it somewhere else.

Using it honestly in schoolwork

Here is a test that resolves most cases. Would you be comfortable describing exactly what you did to your teacher, in detail, without leaving anything out? If the honest answer is no, that is your answer, and no argument about it being a tool like a calculator changes it.

Applied to real situations:

Rules vary by school, by teacher and by assignment, and they are still changing. The right move is to ask before the deadline rather than to guess and defend it afterwards.

What you actually lose

The practical argument matters more than the moral one here.

Writing is not just the production of a document; it is the process that forces you to work out what you think. Outsourcing it produces a document and no thinking, and the gap turns up later, in the discussion where you cannot explain your own argument, in the exam with no device, and in the next piece of work that assumed you learned this one.

The same goes for practice problems. You are not doing them to produce answers. The answers are worthless; you are doing them to build the thing that produces answers.

A word about detectors

Software claiming to detect AI-written text is unreliable in both directions. It misses real AI output, and it accuses real students, with documented false positives falling disproportionately on people writing in a second language and on anyone with a plain, formal style.

Two consequences. Do not rely on a detector's verdict as proof of anything. And keep your drafts, your notes and your version history, because a record of how a piece of work developed is far better evidence of authorship than any detector's score.

Common misconceptions

• "It has access to the whole internet, so it knows the facts." Unless it is explicitly searching, it is generating text from learned patterns, not looking things up. Even with search connected, it can misread or misattribute what it finds.
• "If it sounds confident and detailed, it is probably right." Confidence is a property of the writing style. Fabricated citations in that court filing were more detailed and better formatted than many real ones.
• "Using AI is cheating, full stop." Using it to explain a concept, quiz yourself, or argue against your own draft is not cheating. Submitting its output as your own is. The line is about whose thinking is being assessed.

Where this leaves us

A lawyer filed a brief in 2023 citing cases that did not exist, and the citations looked flawless, which is the whole lesson in one incident. A language model predicts what text should come next, so it produces the shape of an answer, and truth is a usual side effect rather than a guarantee. The four error types are fabrication, being out of date, inherited bias, and confident reasoning failures, and fluent prose is not evidence against any of them. The genuinely good uses share a feature: you supply the material, or you verify immediately, or being wrong costs nothing. Every name, number, date, quotation and citation needs independent confirmation before you repeat it. The honesty test is whether you could describe exactly what you did to your teacher without leaving anything out. And detectors are unreliable in both directions, so keep your drafts.

Sources

1. Wikipedia contributors. (n.d.). Mata v. Avianca, Inc. Wikipedia. en.wikipedia.org
2. Wikipedia contributors. (n.d.). Hallucination (artificial intelligence). Wikipedia. en.wikipedia.org
3. Wikipedia contributors. (n.d.). Large language model. Wikipedia. en.wikipedia.org
4. Wikipedia contributors. (n.d.). Algorithmic bias. Wikipedia. en.wikipedia.org
5. Common Sense Education. (n.d.). AI literacy resources. Common Sense. commonsense.org