Digital Literacy & Online Life

In 1998 two graduate students at Stanford, Larry Page and Sergey Brin, described a search engine built around one idea: treat a link from one web page to another as a vote. A page linked to by many pages is probably worth something, and a link from an already important page counts for more than a link from an unknown one. They called the scoring method PageRank, and the search engine Google.

That idea is still in there, buried under many other signals now. But notice what it is measuring. It is measuring what other web pages point at. It is not measuring whether a page is true.

Everything in this lesson follows from that gap.

Three separate jobs

A search engine does three things, and confusing them is the source of a lot of muddled thinking about search.

1. Crawling. Programs called crawlers or spiders follow links from page to page, constantly, fetching copies of what they find. They discover new pages mostly by following links from pages they already know about.
2. Indexing. The fetched pages are analysed and filed: what words are on them, what images, what the page seems to be about, whether it is a duplicate of something else. Google says its index holds hundreds of billions of pages and runs to well over a hundred million gigabytes.
3. Ranking. When you type a query, the engine does not search the web. It searches its index, finds the pages that might match, and puts them in an order. That ordering is the part you actually experience.

The gap between step 2 and step 3 is worth holding on to. The index is enormous and mostly invisible to you. What you see is a list of ten things chosen out of possibly millions, by a program, according to rules the company writes and changes.

Key idea: You never search the web. You search one company's index, and what you see is the top of an ordering they designed.

What the ranking actually weighs

Search companies publish general descriptions of their ranking factors without publishing the recipe. The broad categories are consistent:

Factor	What it means	What it does not measure
Meaning of the query	Working out what you actually want, including spelling and synonyms	Whether your question is a good one
Relevance	Does the page contain the words and topics you asked about	Whether those words are used correctly
Quality signals	Links from other sites, signs the site is reputable in its field	Whether the claims are true
Usability	Does the page load fast, work on a phone, use a secure connection	Anything at all about the content
Context	Your location, language, device and previous searching	What someone else would need to see

Read the right-hand column again. None of the ranking factors is a fact-check. A page can be fast, mobile-friendly, widely linked, keyword-perfect, and completely wrong.

The industry devoted to moving up the list

Because being first is worth money, an entire profession exists to make pages rank higher. It is called search engine optimisation, or SEO, and it is largely legitimate work: making pages load faster, structuring headings clearly, writing what people are actually looking for.

But it means something important for you as a reader. A page at the top may be there because it is good, or because somebody spent six months and a budget making sure it would be there. Those two look identical from the results page.

The point: Position one is a claim about optimisation and popularity, not a claim about accuracy.

Some results paid to be there

Search engines make most of their money from advertising, and advertisements appear among the results. In most countries they must be labelled, usually with a small word such as Sponsored or Ad near the top of the entry.

The label is genuinely there and genuinely easy to miss, because the ad looks almost exactly like an ordinary result: same font, same layout, same blue link. Studies of user behaviour have found for years that plenty of people cannot reliably tell them apart. So make it a habit: before clicking the first result, look for the word Sponsored. It takes half a second and it changes what you know about why that link is in front of you.

Your results are not everyone's results

Two people typing the same words in the same second can get different lists. The engine uses your approximate location, your language setting, your device, and sometimes your previous activity, to decide what to show.

Most of the time this is helpful. Searching for pizza should not return a restaurant in another country. But it has a consequence people underestimate: you cannot assume that what you see is what your friend sees, and you certainly cannot assume it is what someone in another country sees. If you want to know what the internet says about something, one person's screen is a sample of one.

A quick way to test this: ask two people in different places to search the same phrase and screenshot the top five. The differences are usually larger than either expects.

Five operators that get you past the obvious

Operator	Example	What it does
Quotation marks	"deep learning is a subset"	Finds that exact phrase, in that order
site:	climate site:nasa.gov	Searches only within one website or domain
Minus sign	jaguar -car	Excludes results containing a word
filetype:	water quality report filetype:pdf	Returns only files of that type, useful for official reports
Date filter	Tools, then a time range	Restricts to recent results, which matters for anything that changes

The two that change your life are quotation marks and site:. Quotation marks are how you find out whether a supposed quotation was ever actually said, because searching the exact phrase shows you every page carrying it and often the moment it first appeared. And site: lets you search a single trustworthy source directly instead of hoping it surfaces.

The question you type is already a guess

Here is a subtle one. Type are video games bad for teenagers and you will get pages about harm. Type are video games good for teenagers and you will get pages about benefits. Both queries return real pages written by real people. Neither list is a summary of the evidence.

The engine is matching your words. A question containing bad matches pages containing bad. This is not the engine being biased; it is the engine doing exactly what you asked, and you asked a leading question.

So frame queries neutrally. Instead of are video games bad for teenagers, try video games teenagers research findings, or video game effects study. You will get a messier and more honest set of results, which is the point.

Why this matters: A search engine will confirm almost any belief you phrase it with. Neutral wording is the cheapest defence against fooling yourself.

Common misconceptions

• "The first result is the most reliable." First means best-optimised and most-linked for your particular query, on your particular device, in your particular location. Accuracy is not one of the inputs.
• "Search engines search the whole internet in real time." They search a stored index built by crawlers, which can be days or weeks out of date for a rarely visited page, and does not contain pages nobody links to or that ask not to be indexed.
• "If it were false, it would not be so high up." Ranking rewards links, speed and keyword match. A well-made page with a false claim outranks a plain page with a true one routinely.

Recap

A search engine crawls pages, indexes them, and ranks them, and you only ever interact with the third step, on an index that belongs to a company. PageRank started from the idea that links are votes, which measures attention rather than accuracy, and none of the modern ranking factors is a fact-check. A whole profession exists to push pages upward, so a top result may be good or may be well-optimised, and you cannot tell which from the list. Some results are advertisements labelled Sponsored, and the label is easy to miss on purpose. Your results are personalised, so one screen is a sample of one. Quotation marks and site: are the two operators worth learning today. And the wording of your question shapes your answers, so a leading question will get you a confident, one-sided list every time.

Sources

1. Google. (n.d.). How Search works. Google. google.com
2. Google. (n.d.). Ranking results. How Search Works. google.com
3. Wikipedia contributors. (n.d.). PageRank. Wikipedia. en.wikipedia.org
4. Wikipedia contributors. (n.d.). Web crawler. Wikipedia. en.wikipedia.org
5. Wikipedia contributors. (n.d.). Search engine optimization. Wikipedia. en.wikipedia.org

There is a website about the Pacific Northwest tree octopus. It describes an endangered cephalopod that lives in the temperate rainforests of the Olympic Peninsula in Washington State, migrating to water only to breed. It has photographs. It has a scientific name. It lists threats to the species and links to conservation organisations, and it asks you to write to your representatives.

There is no such animal. The site was made in 1998 as a joke.

In 2006 researchers at the University of Connecticut led by Donald Leu reportedly showed the site to a group of seventh-graders who had been identified as strong readers. Nearly all of them judged it a reliable source. Several kept defending it after being told directly that it was a hoax, looking for ways the information might still be right.

Those students were not stupid, and they were not careless. They were applying the checklist they had been taught, and the checklist was the problem.

Why the usual checklist fails

Most of us were taught to judge a website by looking at it. The standard list runs something like: is the design professional, does it end in .org, is there an About page, are there citations, is the spelling correct, is there a date.

Every item on that list is cheap to fake, and a joke site made by one person in 1998 satisfies most of them. Look at what the tree octopus page actually has:

• A clean layout with headings and sections.
• Photographs, which are real photographs of real things, just not of what the captions say.
• A scientific-sounding binomial name.
• A section on habitat and one on threats.
• Links to genuine conservation organisations.
• A call to action, which makes it feel like a campaign rather than a page.

Now list what it does not have, and notice how much harder these are to check by looking: an author with a verifiable identity, any organisation standing behind it, any reference to a scientific record of the species, and any mention of it anywhere outside its own pages.

So what?: Everything on the standard checklist can be produced by one person in an afternoon. The things that cannot be faked are all off the page.

Four questions that actually work

1. Who is behind this? A named person or organisation you can find independently, not a name at the bottom of the page you are already reading.
2. What do other sources say about them? This is the important one, and it requires leaving the site. If a reference work, a news organisation, or a professional body has anything to say about this group, you want to know it before you read another word.
3. What is the evidence? Does the page point to data, documents or studies you could go and look at, or does it only assert? Follow one link and see whether it says what the page claims it says.
4. Why does this exist? To inform, to sell, to recruit, to entertain, to make advertising money from clicks. Every site has a purpose and most will tell you if you look at what they ask you to do.

Question 2 is the one this course will spend a whole lesson on, because it is what professional fact-checkers do first, and almost nobody else does it at all.

Domains: what the ending does and does not tell you

Ending	What it actually means	What people wrongly assume
.gov	Restricted to United States government bodies, verified before registration	Nothing wrong here; this one is a genuine signal, though other countries use different endings
.edu	Restricted to accredited United States educational institutions	That everything on it is peer reviewed; personal student and staff pages live there too
.org	Anyone can register one; it was intended for organisations and was never restricted	That the site is a non-profit or a charity
.com and .net	Anyone can register one	That .com means commercial and therefore less trustworthy

The one that costs people most is .org. It carries an air of public service that its rules never supported. If you take one fact from this table, take that one.

The About page problem

An About page tells you what a site says about itself. That is worth something, and it is not evidence.

Consider a site with a name like the Institute for Family Nutrition Research. The About page describes an independent research organisation dedicated to sound science. It has a board, a mission statement and a professional photograph of a building. Everything on it may be literally true. What the page will not tell you is who funds it, and if the answer is a trade association for one food industry, that changes how you read every number on the site.

You will never learn that from the About page. You learn it in about forty seconds by searching the organisation's name and reading what other people have written about it.

Remember: A site's self-description is a claim, not a check. The check happens somewhere else.

What the research says about how badly this goes

In a 2016 report, the Stanford History Education Group described giving evaluation tasks to thousands of students from middle school to university. The results were bleak across every level: most middle school students could not distinguish a sponsored post from a news article on the same page, and older students routinely accepted photographs and websites on the strength of appearance alone.

The researchers' conclusion was not that young people are gullible. It was that nobody had taught them the skill, because the skill is not obvious and is not what the traditional checklist trains.

A working procedure

1. Before reading the page carefully, open a new tab.
2. Search the name of the site or organisation, plus a word like funding, criticism or who owns.
3. Look at what comes back from sources that are not the site itself, including a reference work such as an encyclopaedia entry if one exists.
4. Go back to the page knowing who wrote it and why.
5. Then, and only then, evaluate the claims themselves and follow one of its own links to check it says what is claimed.

Note the order. Almost everyone reads first and checks later, if at all, by which point they have already absorbed the argument.

Common misconceptions

• "A professional-looking site is more reliable." Design is cheap and templates are free. A good-looking page tells you someone cared about how it looked.
• "A .org address means a non-profit." Anyone can register a .org. It was never restricted and never verified.
• "If it has citations it must be sound." Citations only help if you follow one. A common tactic is to cite real, respectable sources that do not actually support the claim being made, on the safe assumption nobody will check.

What to carry forward

A site made as a joke in 1998 about an animal that does not exist convinced a class of strong readers, because it satisfied every item on the checklist they had been taught. Design, domain endings, About pages and the presence of citations are all surface features, and all of them are cheap to produce. The questions that work are who is behind this, what do independent sources say about them, what evidence is offered, and why does the site exist. Domain endings carry much less information than people think, and .org is the one that misleads most. A site's own About page is a claim about itself and cannot check itself. And the order matters: open a new tab and find out who you are reading before you read them.

Sources

1. Wikipedia contributors. (n.d.). Pacific Northwest tree octopus. Wikipedia. en.wikipedia.org
2. Zapato Productions Intradimensional. (n.d.). Save the Pacific Northwest tree octopus. zapatopi.net. zapatopi.net
3. Stanford History Education Group. (2016). Evaluating information: The cornerstone of civic online reasoning. Stanford Digital Repository. purl.stanford.edu
4. Wikipedia contributors. (n.d.). Domain name. Wikipedia. en.wikipedia.org
5. Common Sense Education. (n.d.). Digital citizenship curriculum. Common Sense. commonsense.org

Researchers at Stanford gave the same task to three groups: professional fact-checkers, academic historians, and undergraduates at a highly selective university. Look at this unfamiliar website and tell us how trustworthy it is.

The historians and the students behaved the way you were probably taught to. They stayed on the page. They read it closely, examined the design, looked at the About section, considered the tone, weighed the logo. Many of them reached confident and wrong conclusions.

The fact-checkers barely read the page at all. Within seconds they had opened new tabs and left, searching for what other people said about the organisation. Then they came back, already knowing what they were looking at.

Sam Wineburg and Sarah McGrew, who ran the study, called the fact-checkers' method lateral reading, and it is the single most useful thing in this course.

Vertical reading, and why it feels so responsible

Vertical reading means staying on a page and working down it: reading the article, checking the About section, looking at the citations, weighing the tone. It feels like diligence. Everything about it resembles good study habits.

It fails for a structural reason. Everything you are examining was placed there by the person you are trying to evaluate. The design, the tone, the mission statement, the citations and the professional photograph are all under their control. A page is not evidence about itself, no matter how carefully you read it.

Worse, the longer you stay, the more of the argument you absorb. You arrive to evaluate and leave having been persuaded, which is exactly what a well-built page is designed to do.

What matters here: You cannot check a source using only the material that source controls.

What lateral reading looks like in practice

Lateral reading means leaving almost immediately and reading across the web instead of down the page. Concretely:

1. Read only enough to get the name of the site or organisation and roughly what it claims. Thirty seconds, not five minutes.
2. Open a new tab.
3. Search the name. Add a word that invites independent comment: funded by, criticism, who owns, controversy.
4. Do not click the first result yet. Read the whole results page first, headlines and snippets, and notice which kinds of sites are talking about this organisation.
5. Open two or three of the more independent-looking results, ideally including a reference work and a news organisation.
6. Return to the original page and read it knowing who wrote it and why.

The whole procedure takes about ninety seconds once you are used to it. That is faster than reading the About page carefully, and it produces an answer the About page cannot give you.

Click restraint

Step 4 has a name, click restraint, and it is worth practising on its own.

Most people click the first result reflexively. The fact-checkers in the research read the whole results page first, using the snippets to build a picture before committing to any single source. This costs a few seconds and prevents a common failure: landing on a page that is highly optimised, absorbing its framing, and never seeing that results four, six and nine were from a university, a newspaper and a government agency saying something quite different.

Think of the results page as a summary of the conversation, not as a queue.

Using Wikipedia correctly

Fact-checkers use Wikipedia constantly, and school rules often forbid it. Both positions can be right, because they are talking about different uses.

As a citation, Wikipedia is weak: anyone can edit it, articles vary enormously in quality, and it is a summary rather than an original source. That is why teachers say do not cite it.

As a map, it is excellent. It will tell you in one paragraph what an organisation is, who founded it, when, and often who funds it and what criticism it has attracted. Then scroll to the references at the bottom, which are links to the actual sources. Follow those, read them, and cite those instead.

Two safeguards. Check the date of the last edit, shown in the page history, and be more careful on articles about live controversies, which change hour by hour and attract editing fights.

The upshot: Do not cite the encyclopaedia. Use it to find the sources you will cite.

A worked example, timed

Suppose you find a page from something called the Global Energy Policy Center, arguing that a particular fuel is safer than commonly reported.

Time	Action	What you learn
0 to 20 seconds	Skim the page for the name and the headline claim	The name, the claim, and nothing you should yet believe
20 to 40 seconds	New tab, search the organisation's name plus funding	Whether independent coverage of it exists at all
40 to 70 seconds	Read the results page without clicking, then open a reference article and one news piece	Who founded it, who pays for it, what it is known for
70 to 90 seconds	Return to the page	Whether to read on, and what to discount

Three outcomes are possible, and all three are useful. Independent sources describe it as a respected research body, so read on with normal care. Independent sources describe it as funded by an industry with a direct stake, so read on knowing that. Or there is nothing at all.

When you find nothing

Finding no independent information is not neutral, and beginners often treat it as though it were.

An organisation issuing confident policy claims that no reference work, newspaper or professional body has ever mentioned is telling you something: either it is very new, or it is very small, or it is designed to look larger than it is. None of those makes it a good source for a claim you are going to repeat. Note the absence, and go and find a source that other people have heard of.

Three habits worth building

• Open a second tab before you form an opinion. The habit is physical, and physical habits survive better than intentions.
• Search the name, not the claim. Searching the claim finds pages that agree with it. Searching the source finds pages about the source.
• Notice when you have stopped checking and started reading. The moment you find yourself nodding, you are no longer evaluating.

Common misconceptions

• "Careful, close reading is the responsible way to evaluate a page." It is the responsible way to understand an argument. It is a poor way to check a source, because everything you are examining is controlled by the person you are checking.
• "Lateral reading takes longer." The research found the opposite. Fact-checkers reached better conclusions in less time, because they stopped reading material that could not answer their question.
• "Wikipedia is banned, so serious researchers do not use it." Professional fact-checkers use it heavily as a starting point and then cite the underlying sources listed in its references.

The short version

Given an unfamiliar site, historians and strong students stayed on the page and read carefully, and professional fact-checkers left within seconds to see what the rest of the web said. Vertical reading fails because every feature you can examine on a page was chosen by the person you are evaluating, and the longer you stay the more of their argument you absorb. Lateral reading takes about ninety seconds: get the name, open a tab, search the name with a word like funding or criticism, read the whole results page before clicking, then return informed. Wikipedia is a map rather than a citation, and its reference list is the part you should be following. And finding nothing about an organisation is itself a finding, not a clean bill of health.

Sources

1. Digital Inquiry Group. (n.d.). Civic Online Reasoning. Digital Inquiry Group. inquirygroup.org
2. Stanford History Education Group. (2016). Evaluating information: The cornerstone of civic online reasoning. Stanford Digital Repository. purl.stanford.edu
3. Wikipedia contributors. (n.d.). Fact-checking. Wikipedia. en.wikipedia.org
4. News Literacy Project. (n.d.). Resources for students and teachers. News Literacy Project. newslit.org
5. Wineburg, S., & McGrew, S. (2019). Lateral reading and the nature of expertise: Reading less and learning more when evaluating digital information. Teachers College Record, 121(11).

In late 2017 a user on the discussion site Reddit, posting under the name deepfakes, began sharing videos in which one person's face had been swapped onto another person's body using machine learning. The account was shut down in early 2018. The word survived, and now covers a whole category of synthetic video and audio.

Two things happened at once after that. Making convincing fakes got much easier, which is the part everyone talks about. And a second, quieter thing happened: real recordings became easier to deny, because anyone caught on video could now say it was a deepfake.

You need a strategy for both, and it cannot be looking harder at the picture.

Four ways an image can lie

Type	What has been done	How common
Recontextualised	A completely real, unedited photo presented with a false caption, date or place	By far the most common
Cropped or selectively framed	Real image, but the part that changes its meaning has been cut off	Very common
Edited or composited	Parts added, removed or combined from several photographs	Common
Fully generated	No photograph exists; the image was produced by a model from a text description	Growing fast

Look at the first row again, because it is the one people are least prepared for. The most successful misleading images are not edited at all. A genuine press photograph of a crowd, or a flood, or a protest, is simply posted with a caption saying it is somewhere else or some other year. There is nothing in the pixels to find, because nothing was done to the pixels.

Key idea: Most misleading images are real photographs with false captions. Examining the image cannot catch that.

What your eye can and cannot do

People love the list of tells: count the fingers, look at the teeth, check whether the text in the background is gibberish, look for jewellery that merges into skin.

Those tells were real, and they are closing. Each generation of image models fixes the visible faults of the last one, and the faults were never reliable anyway: plenty of genuine photographs have odd hands, blurred text and strange reflections, and plenty of generated images never had a hand in them at all. A test that produces both false alarms and misses is not a test you should build a habit on.

There is also a well-documented psychological problem. Being told to look carefully makes people more confident, not more accurate. Confidence and accuracy come apart, and the confident wrong reader is more dangerous than the uncertain one.

So the honest position is this. Your eye is a weak detector and getting weaker. Use methods that do not depend on it.

Reverse image search: the technique that actually works

A reverse image search takes a picture instead of words and finds other places that picture appears online. It answers the question that matters most: has this image been on the internet before today, and what did it say then?

1. Save the image, or copy its address by right-clicking and choosing copy image address.
2. Go to an image search service. Google Images, Bing Images and TinEye all accept an uploaded file or a pasted image address.
3. Upload or paste, and search.
4. Sort or scan the results for the oldest appearances. Most services let you filter by date.
5. Read what the earliest reliable page says about the picture: when it was taken, where, and by whom.

This finds recycled photographs immediately, which is the biggest category. A picture posted today as a flood in one country, and found on a news site from four years ago as a flood in another, is settled in under a minute with no image analysis at all.

Remember: The first question about a picture is not is it edited. It is where has this picture been before.

Checks that do not need your eye

• Ask who else has it. A dramatic event photographed by one anonymous account and nobody else is a warning. Real events of any size are covered from several angles by several organisations.
• Check the details against the claim. Language on shop signs, the side of the road cars drive on, the season shown by the trees, the weather. A photograph claimed to be from a snowstorm last week that shows trees in full leaf has answered itself.
• Search the claim with a date. If a named event happened, news organisations wrote about it. If nothing exists, that is informative.
• Look for the original. Screenshots of posts are trivially easy to fake by editing a page in a browser. Find the actual post, on the actual account.

Metadata, and why it is not the answer

Digital photographs carry hidden information called Exif data: camera model, settings, date and time, and sometimes GPS coordinates. When it survives, it is useful.

It usually does not survive. Most social platforms strip Exif when you upload, partly for privacy, and it can be edited by anyone with the right software. So Exif data that is present and consistent is mild supporting evidence, and Exif data that is missing tells you almost nothing.

A newer effort called Content Credentials, developed by an industry group called the C2PA, attaches a signed record to an image describing how it was made and edited, so that a viewer can check its history. Some cameras, editing programs and AI tools now add it. It is a genuine step forward and it has an obvious limit: it proves something about images that carry it, and says nothing about the enormous number that do not.

The second danger: everything can be denied

The obvious harm from convincing fakes is that people believe false things. The less obvious harm is the reverse, and researchers have named it the liar's dividend: once everyone knows that convincing fakes exist, any genuine recording can be waved away as one.

That is why the habits in this lesson matter in both directions. Where did it come from, who else has it, what is the earliest version, does anything independent confirm it. Those questions work on real footage someone wants to dismiss just as well as on a fake someone wants you to believe.

Bottom line: Verification is about tracing a picture to a source, not about staring at it. That protects you from fakes and from having real evidence dismissed.

Common misconceptions

• "You can spot AI images by counting the fingers." That worked on some earlier models, fails on newer ones, and produces false alarms on real photographs. It is a party trick, not a method.
• "If a photo is real, the post is true." The most common form of misleading image is a genuine photograph with a false caption. Real picture and false claim are entirely compatible.
• "Missing metadata means the image was faked." Almost every platform strips metadata on upload, so almost every image you see online has none. Its absence is the normal case.

Where this leaves us

The word deepfake dates from a Reddit account in late 2017, and the technology behind it has made both fakery and denial easier. Images mislead in four ways, and the most common by a distance is the completely real photograph with a false caption, which no amount of pixel-staring can catch. Visual tells such as odd hands are unreliable and closing, and being told to look carefully mostly raises confidence rather than accuracy. Reverse image search is the technique that actually works, because it answers where the picture has been before. Supporting checks include asking who else has the image, testing details such as language and season against the claim, and finding the original post rather than a screenshot. Exif data is weak evidence and Content Credentials are a real improvement that only covers images carrying them. And the same habits protect you from the liar's dividend, where genuine evidence is dismissed as fake.

Sources

1. Wikipedia contributors. (n.d.). Deepfake. Wikipedia. en.wikipedia.org
2. Wikipedia contributors. (n.d.). Reverse image search. Wikipedia. en.wikipedia.org
3. Wikipedia contributors. (n.d.). Exif. Wikipedia. en.wikipedia.org
4. Coalition for Content Provenance and Authenticity. (n.d.). C2PA. c2pa.org. c2pa.org
5. Content Authenticity Initiative. (n.d.). Content Credentials. contentcredentials.org. contentcredentials.org
6. Google. (n.d.). Search with an image on Google. Google Search Help. support.google.com

In 2018 three researchers at MIT, Soroush Vosoughi, Deb Roy and Sinan Aral, published a study in the journal Science. They had taken about 126,000 stories, shared by roughly three million people on Twitter between 2006 and 2017, and traced how each one moved.

Their headline finding was uncomfortable. False stories spread further, faster, deeper and more broadly than true ones, in every category they measured, and politics was the worst. They reported that false stories reached fifteen hundred people about six times faster than true stories did.

Then they checked whether automated accounts explained it. They did not. The researchers found that bots accelerated true and false stories at roughly the same rate, which meant the difference was coming from people, choosing to share.

Why the false version wins the race

The researchers' proposed explanation was novelty. False stories were measurably more novel than true ones, in the sense that they contained more information unlike what the sharer had recently seen. Novel information is valuable to pass on; it makes the sharer look informed, and it is interesting.

They also found that replies to false stories expressed more surprise and disgust, while replies to true stories expressed more sadness, anticipation and trust. Surprise and disgust are activating emotions. They make you do something, and the something available on a phone is to press share.

None of this requires anyone to be a liar. Nearly everyone who spreads a false story believes it and thinks they are being helpful.

Why this matters: The advantage of a false story is not that people are dishonest. It is that a story unconstrained by facts can be made more surprising than a true one.

The shape of a spread

A rumour does not travel evenly. It moves in a cascade, and three features of that shape matter.

• A few accounts do most of the work. Most shares reach almost nobody. A small number of accounts with large followings turn a local rumour into a national one in a single post.
• Each hop strips context. By the time a claim has been screenshotted, cropped and reposted four times, the original source, date and qualifications are gone. What remains is a sentence with no parent.
• Speed beats correction by design. Sharing takes one second. Checking takes a minute. The gap between those two numbers is where the whole problem lives.

Four reasons the correction never catches up

1. It is late. Verification takes time, so by the time a correction exists, most of the people who will ever see the claim have already seen it.
2. It is boring. The claim was surprising, which is why it moved. The correction is unsurprising by definition, so it has no fuel.
3. It reaches different people. A correction spreads through the networks of people who care about accuracy, which are not the same networks the rumour travelled through.
4. Repeating it can reinforce it. A correction has to restate the false claim in order to deny it, and restating something makes it feel more familiar.

That last one has a name.

The illusory truth effect

Psychologists have documented, across many experiments, that repeated statements are rated as more likely to be true than statements encountered once, even when people have information that should tell them otherwise. It is called the illusory truth effect, and it works because familiarity is fast and easy to feel, while checking is slow and effortful, so the brain accepts fluency as a rough substitute for evidence.

The practical consequence for you is direct. If you see a claim five times in a week, in five different places, it will start to feel true. That feeling is a report about how often you have seen it, not about whether it is so, and the five places may all be repeating one original post.

In short: Familiarity feels like truth. Seeing something repeatedly is evidence about circulation, not about accuracy.

Emotion is the fuel, and it is also the alarm

Content that makes people angry or disgusted spreads more than content that makes people thoughtful. That is true of true content as well as false content; it just happens that a fabricated story can be tuned for maximum anger, and a real one cannot.

This gives you a usable signal. The physical feeling of being outraged and wanting to share immediately is exactly the moment to stop. It is not that anger is wrong. It is that anger is what a manipulative post is engineered to produce, so the presence of that feeling is weak evidence that engineering has occurred.

Thirty seconds before you share

1. Who is the source? Not who posted it, but who originally reported it. If the post does not say, that is your answer.
2. When did this happen? Look for a date. Old stories recirculate constantly, often after an anniversary or a similar new event.
3. Is anyone else reporting it? Search a few words of the claim. For anything significant, more than one organisation will have it.
4. How does it want me to feel? If the answer is furious, slow down.
5. What happens if I am wrong? If the claim names a person or a group, being wrong causes harm to someone specific.

Thirty seconds. Against a share that takes one, and against a correction that will reach a fraction of the people the claim did.

Prebunking, which works better than arguing afterwards

Since corrections are weak, researchers have worked on the opposite approach: warn people about a manipulation technique before they meet it. This is called prebunking, and it draws on inoculation theory, an idea from the 1960s that a weakened exposure to a persuasive attack builds resistance to the full version.

In practice, prebunking means learning the patterns rather than the individual claims: emotionally charged language, false dilemmas, scapegoating, fake experts, and the recycled photograph you met in the last lesson. Once you know that a technique exists and what it looks like, examples of it stop working as well on you.

That is essentially what this whole course is. Not a list of false claims, which would be out of date within a month, but the shapes those claims come in.

The point: Learning the technique protects you against every future example of it. Learning that one specific story was false protects you against one story.

Common misconceptions

• "Only careless or unintelligent people spread false stories." The MIT study found humans, not bots, drove the difference, and the sharers overwhelmingly believed what they were sharing. Being clever is not much protection against a story engineered to feel urgent.
• "Automated accounts are the main problem." Bots amplified true and false stories at about the same rate in that study, so they cannot explain why false stories travelled further.
• "Correcting someone always backfires and makes them believe it harder." This claim spread widely from early research, and later work found the effect is much rarer and weaker than reported. Corrections often do help; they are just slower and reach fewer people than the original.

Putting it together

The 2018 MIT study of about 126,000 stories found false news travelling further, faster and deeper than true news, and traced the difference to human sharing rather than to bots. The likely reason is novelty: a story free of the obligation to be true can be made more surprising, and surprise and disgust are the emotions that make people act. Rumours move in cascades driven by a few large accounts, and each repost strips away the source and the date. Corrections lose because they are late, boring, aimed at a different audience, and forced to repeat the claim they are denying. The illusory truth effect means repetition feels like evidence, so a claim seen five times feels truer without being truer. A thirty-second check before sharing beats a correction afterwards, and learning the techniques, which is prebunking, beats learning individual debunked claims.

Sources

1. Massachusetts Institute of Technology. (2018, March 8). Study: On Twitter, false news travels faster than true stories. MIT News. news.mit.edu
2. Wikipedia contributors. (n.d.). Illusory truth effect. Wikipedia. en.wikipedia.org
3. Wikipedia contributors. (n.d.). Inoculation theory. Wikipedia. en.wikipedia.org
4. Wikipedia contributors. (n.d.). Misinformation. Wikipedia. en.wikipedia.org
5. Vosoughi, S., Roy, D., & Aral, S. (2018). The spread of true and false news online. Science, 359(6380), 1146-1151.

In 2017 the United States National Institute of Standards and Technology published new digital identity guidelines, and quietly reversed a generation of advice. The document, Special Publication 800-63B, told organisations to stop forcing people to change passwords every ninety days, and to stop demanding a capital letter, a number and a symbol.

Those rules had not made passwords stronger. They had made people predictable. Told to add a number, everyone adds 1. Told to add a symbol, everyone adds an exclamation mark at the end. Forced to change every ninety days, everyone increments: summer1, summer2, summer3. Attackers know all of this, because the rules are public.

What NIST recommended instead was length, and checking new passwords against lists of ones already known to be compromised.

What actually breaks into an account

Before choosing a defence, know the attack. There are three that matter, and they are not equally common.

Attack	How it works	What stops it
Credential stuffing	A company gets breached, usernames and passwords leak, and attackers try those same pairs on hundreds of other sites	Never reusing a password
Phishing	You are tricked into typing your password into a convincing fake page	Checking the address, and two-factor authentication
Guessing and cracking	Software tries huge numbers of likely passwords, starting with common ones and dictionary words	Length, and not using a known password

Notice that the first one has nothing to do with how strong your password is. If you used the same password on a game forum and on your email, and the forum leaks, your email is open no matter how clever the password was.

Key idea: Reuse is the biggest single risk, and no amount of complexity fixes it.

Why length beats symbols

Think about how many possibilities an attacker has to work through. Adding one more character multiplies the number of possible passwords by the size of the character set. Adding symbols to a short password multiplies the set once. Adding four more characters multiplies it four times over.

So a sixteen-character password made only of lowercase letters has vastly more possible combinations than an eight-character password using every symbol on the keyboard. Length wins, and it is not close.

There is a second reason, and it is the practical one. A twelve-character password of random symbols is impossible to remember, so people write it on a note or reuse it everywhere. A twenty-character phrase of ordinary words is easy to remember and easy to type, so people actually use different ones.

Building a passphrase

A passphrase is several unrelated words strung together. The strength comes from the number of words and from the words being genuinely unconnected.

1. Pick four or five words that have no relationship to each other and no relationship to you. Not your dog, your school or your favourite band.
2. Get them randomly if you can. Open a book at a random page and take the first noun, five times. Or roll dice against a word list.
3. String them together, with or without spaces or hyphens as the site allows.
4. Do not add 1! to the end because a site demands a number and a symbol. Put a digit in the middle of one of the words instead, or pick a different site-mandated variation each time.

Something like correct-battery-lantern-mustard is long, memorable and not in any leaked list. Something like P@ssw0rd1! is short, looks complicated, and is in every cracking dictionary on earth, because substituting an at sign for an a is the first thing the software tries.

The upshot: Length and unpredictability are the whole game. Complicated-looking is not the same as unpredictable.

Password managers

The honest problem with all of this advice is arithmetic. You have dozens of accounts. Nobody memorises dozens of unrelated twenty-character phrases.

A password manager is an encrypted store that generates and remembers a different long random password for every site, and fills them in for you. You memorise exactly one passphrase, the master password, and it unlocks the rest. Browsers include one, and there are standalone versions, some of them free.

The standard objection is that this puts every egg in one basket. It is a fair objection and the answer is that the alternative is worse: the realistic alternative is not dozens of memorised unique passwords, it is one password reused everywhere, which means every basket already contains the same egg. A manager with a strong master password and two-factor authentication turned on is a substantially better position.

One extra benefit worth knowing: because the manager fills in passwords by matching the web address, it silently refuses to fill your bank password into a lookalike site. It is a phishing defence you get for free.

Two-factor authentication

Two-factor authentication, often shortened to 2FA or MFA, means proving who you are with two different kinds of thing: something you know, such as a password, plus something you have, such as your phone or a small hardware key.

It is the single most effective thing on this list, because it breaks the attacker's usual chain. Stealing your password no longer gets them in.

Method	How it works	Strength
Text message code	A code is sent to your phone number	Much better than nothing, but weakest, because phone numbers can be moved to an attacker's SIM card
Authenticator app	An app on your phone generates a six-digit code that changes every thirty seconds	Strong, and works without a signal
Hardware security key	A small physical device you plug in or tap	Strongest, and resistant to phishing because it checks the site's real address
Passkey	A cryptographic key stored on your device, unlocked by a fingerprint or face	Strong, and removes the password from the process entirely

Turn it on for your email first. Email is the master key to everything else, because every other account will send a reset link there.

The back door: recovery

People build a strong password and leave the recovery route wide open.

Security questions are the worst offender. What is your mother's maiden name, what primary school did you go to, what is your pet's name: these are not secrets. They are facts, often posted publicly by you or your family. If a site forces you to set them, treat the answer as another password: put a random phrase in the box and store it in your manager. The answer does not have to be true.

Also check what recovery email address and phone number are attached to your accounts. An old address you no longer control is a door with your key still in it.

Bottom line: An account is only as strong as its weakest way in, and that is usually recovery.

Common misconceptions

• "Changing my password every few months keeps me safe." NIST advised against forced regular changes in 2017, because they push people toward predictable increments. Change a password when there is a reason: a breach, a shared device, a suspicion.
• "Replacing letters with symbols makes a password strong." Substitutions like a to at-sign and o to zero are the first transformations cracking software tries. They add almost nothing.
• "Two-factor authentication is only for adults with bank accounts." The accounts most often stolen from young people are game accounts and social accounts, both of which have real value and both of which support two-factor authentication.

What to remember

In 2017 NIST dropped forced password changes and character-mix rules, because those rules made people predictable rather than secure, and recommended length instead. The three real attacks are credential stuffing from breaches, phishing, and cracking, and the first of those defeats any password you reuse. Length beats symbols, both mathematically and practically, so a four or five word passphrase of unrelated words beats a short password with an exclamation mark bolted on. A password manager solves the arithmetic problem and refuses to fill your credentials into a lookalike site. Two-factor authentication is the single most effective step, with an app or a hardware key stronger than a text message, and email is the account to protect first. And security questions and old recovery addresses are the back door that undoes all of it.

Sources

1. National Institute of Standards and Technology. (2017). Digital identity guidelines: Authentication and lifecycle management (SP 800-63B). NIST. pages.nist.gov
2. Cybersecurity and Infrastructure Security Agency. (n.d.). Use strong passwords. Secure Our World. cisa.gov
3. Cybersecurity and Infrastructure Security Agency. (n.d.). Turn on multifactor authentication. Secure Our World. cisa.gov
4. Wikipedia contributors. (n.d.). Password strength. Wikipedia. en.wikipedia.org
5. Wikipedia contributors. (n.d.). Multi-factor authentication. Wikipedia. en.wikipedia.org

The word phishing shows up in print in January 1996, in a discussion of people stealing America Online accounts. The method was simple: send a message pretending to be staff, tell the user there is a problem with their billing, and ask them to confirm their password. The spelling with ph came from phreaking, an older word for tricking telephone systems.

Thirty years later the technique has barely changed, because it never needed to. Phishing does not attack software. It attacks the part of the system that gets tired, worries about getting in trouble, and wants to sort things out quickly.

A message, taken apart

Here is a realistic example. Read it once as you normally would, then read the analysis.

From: Game Support (support-team-verify at mail-secure-games dot net)
Subject: Urgent: your account will be deleted in 24 hours
We detected unusual activity on your account. To avoid permanent deletion of your items, verify your account now. Click here to verify. Failure to act within 24 hours will result in loss of all purchased content.

Now the dissection:

Element	What it is doing
Display name says Game Support	Display names are free text that anyone can set. They are decoration, not identification
The actual address is on an unrelated domain	The real company would send from its own domain. This is the single most reliable tell
Twenty-four hour deadline	Urgency, to stop you checking anything
Threat of losing purchased items	Fear of loss, which motivates people more strongly than an offer of gain
Click here to verify	Hides the destination behind text, and normalises the idea that verifying by link is routine
No name, no account number, no specifics	The message must work for thousands of recipients, so it cannot contain anything only you would know

Remember: Anything that wants you to act within hours is asking you not to check. That is the whole design.

Five levers

• Urgency. Deadlines, countdowns, expiring links. The goal is to remove the pause in which you would think.
• Authority. A message that appears to come from a school, a bank, a platform or a teacher. People comply with authority quickly and ask questions afterwards.
• Fear. Your account is compromised, your payment failed, you have been reported. Fear narrows attention onto the fix being offered.
• Reward. Free items, a prize, an early code, a giveaway. Common in messages aimed at younger users because it works.
• Curiosity. Someone posted this about you. Is this you in this video. Extremely effective, and used to spread account compromise from friend to friend.

Notice that all five are emotional. None of them is technical, which is why a technically capable person is not automatically safe.

How to read a web address

This is the practical skill of the lesson, and most people have never been taught it.

The important part of a web address is the registered domain, which is the last two parts before the first single slash. Read from the right, not from the left.

Address	Real domain	Safe?
bank.com/login	bank.com	This is the real bank
login.bank.com/account	bank.com	Still the real bank; login is a subdomain of it
bank.com.secure-verify.net/login	secure-verify.net	Not the bank at all; bank.com is just a subdomain someone created
bank-com-login.info	bank-com-login.info	Not the bank; hyphens are not dots

Row three is the one that catches people. Everything to the left of the real domain can be invented by the attacker, so a familiar name appearing early in an address means nothing at all.

On a computer, hover over a link without clicking and the real destination appears at the bottom of the window. On a phone, press and hold. If the visible text and the real destination disagree, you have your answer.

What matters here: Read addresses from the right. The registered domain is the last two parts before the first slash, and everything before it is decoration.

The variants worth knowing

• Spear phishing. Targeted at you specifically, using real details: your school, your team, your teacher's name. Much more convincing, and increasingly easy to assemble from public posts.
• Smishing and vishing. The same tricks by text message and by phone call. A caller claiming to be from your bank, or a text about an undelivered parcel.
• Malicious QR codes. A sticker placed over a legitimate code. You cannot inspect a QR code by looking at it, so check the address your phone shows before opening it.
• Messages from friends. Once one account is taken over, the attacker messages that person's friends. A link from someone you know carries enormous trust, which is exactly why it is used.

The defence for the last one is a habit, not a technique: if a friend sends an unexpected link or an urgent request for a code, contact them another way and ask.

If you clicked

People get caught. Some of these messages are extremely good, and the response that matters is speed, not embarrassment. Working in this order:

1. If you entered a password, change it immediately on the real site, reached by typing the address yourself, and change it anywhere else you used the same one.
2. Turn on two-factor authentication if it was not on.
3. Check the account's security settings for anything added: a new recovery email, a new phone number, a forwarding rule, an unfamiliar device signed in. Attackers usually install a way back in.
4. Tell an adult, especially if payment details or a school account are involved. Schools and banks would far rather hear about it within the hour.
5. If money or identity details are involved, report it. In the United States, phishing can be reported to the FTC and identity theft handled through the government's own service.

Point 3 is the one people skip, and it is the one that matters most. Changing a password while an attacker still has a forwarding rule installed does not lock them out.

Common misconceptions

• "Phishing emails are full of spelling mistakes." Some are, and plenty are perfect, especially since text-generating tools became widely available. Bad spelling is a clue when present and proves nothing when absent.
• "If it comes from a name I recognise, it is safe." The display name is free text. What matters is the actual address it was sent from and the actual domain the link goes to.
• "A padlock in the address bar means the site is legitimate." The padlock means the connection is encrypted, not that the site is honest. Attackers get certificates too, and most phishing pages now show a padlock.

The takeaway

Phishing appears in print in 1996 and has not needed to change, because it attacks people rather than software, using urgency, authority, fear, reward and curiosity. A phishing message is recognisable by structure: a friendly display name over an unrelated sending domain, a deadline, a threat, a link hiding its destination, and no specific detail that only you would know. Reading a web address from the right, and identifying the registered domain as the last two parts before the first slash, defeats the most common trick, in which a familiar name is placed early in an address someone else controls. The variants matter, especially messages that arrive from a friend's compromised account. And if you do click, the order is: change the password on the real site, turn on two-factor authentication, hunt for the way back in that the attacker installed, and tell someone.

Sources

1. Cybersecurity and Infrastructure Security Agency. (n.d.). Recognize and report phishing. Secure Our World. cisa.gov
2. Federal Trade Commission. (n.d.). How to recognize and avoid phishing scams. FTC Consumer Advice. consumer.ftc.gov
3. Federal Trade Commission. (n.d.). How to avoid a scam. FTC Consumer Advice. consumer.ftc.gov
4. Wikipedia contributors. (n.d.). Phishing. Wikipedia. en.wikipedia.org
5. Federal Trade Commission. (n.d.). IdentityTheft.gov: Report identity theft and get a recovery plan. FTC. identitytheft.gov

Every sign-up form you have ever filled in asked your age or your date of birth, and almost every service sets its minimum at thirteen. That number is not a judgement about maturity. It comes from a law.

The Children's Online Privacy Protection Act was passed by the United States Congress in 1998 and took effect in 2000. It requires operators of online services to obtain verifiable parental consent before collecting personal information from children under thirteen. Getting that consent is expensive and legally risky, so most companies took the cheaper option: declare that the service is not for under-thirteens and put an age box on the form.

Which tells you something about the whole subject. The rules exist because the collection is valuable enough to regulate, and companies design around the rules rather than around the collection.

Three kinds of data

Kind	Examples	Do you know it is happening?
Data you provide	Name, age, email, photos you upload, things you type and post	Yes, obviously
Data you generate	What you tapped, when, for how long, what you scrolled past, what you started typing and deleted, your device model, your approximate location from your network address	Rarely
Data that is inferred	Your likely age range, interests, language, mood, who you probably know, what you might buy	Almost never

The second row is where most of the volume is. You provided a name once. You generate thousands of events an hour: every scroll, every pause, every replay.

The third row is where most of the value is, and it is the row people forget. A company does not need you to tell it anything for it to conclude things about you. Watch time on certain videos, the hour you use the app, the accounts you look at without following: from those, a system can infer an age range, a set of interests and a rough guess at your circumstances, none of which you ever entered anywhere.

Key idea: The most valuable data about you is not what you typed. It is what was measured while you used the thing, and what was worked out from that.

Cookies, and what accept all does

A cookie is a small file a website stores in your browser, so it can recognise you next time. First-party cookies, set by the site you are actually visiting, do useful work: keeping you logged in, remembering your language, holding your shopping basket.

Third-party cookies are different. They are set by a company other than the site you are on, usually an advertising network whose code is embedded in thousands of sites. Because the same network appears on many sites, it can recognise the same browser across all of them and assemble a record of where you have been.

That is what a cookie banner is asking about. Necessary cookies are the ones the site cannot work without. Everything else is optional, and the honest default is to accept only the necessary ones. The reason the accept-all button is large, colourful and prominent while reject sits in small grey text behind another click is not an accident of design.

Reading a privacy policy in four minutes

Nobody reads privacy policies, and the length is deliberate. But you do not have to read one. You have to search it.

1. Open the policy and use find on page, which is control and F on a computer.
2. Search for share and third part. This tells you who else gets your data. It is usually the most revealing section.
3. Search for sell. Note the exact wording carefully; see the table below.
4. Search for retain or delete. How long do they keep it, and can you get it removed?
5. Search for location and advertis. Is your location collected, and is it used for targeting?
6. Search for children or 13. Services often have a separate and stricter section for younger users.

Four minutes, six searches, and you know more about the service than almost anyone using it.

What the standard phrases mean

The phrase	What it usually means
We may share information with our partners and affiliates	Other companies receive your data. Partners and affiliates are undefined and can be many organisations
We do not sell your personal information	Possibly true under a narrow legal definition of sell, while data is still shared with advertisers in exchange for value
Aggregated and anonymised data	Data combined or stripped of names. Research has repeatedly shown that detailed records can often be re-identified by combining them with other data
We retain data as long as necessary for our legitimate business purposes	Indefinitely, in practice, since they define what is necessary
By continuing to use the service you agree to the updated terms	The agreement can change without you doing anything
We use industry standard security measures	A statement of intent with no specific commitment

The point: A privacy policy is a legal document written to permit things, not a promise written to reassure you. Read it for what it allows.

Permissions, which are the control you actually have

A privacy policy is hard to influence. Permissions are a switch you own.

When an app asks for access to your camera, microphone, contacts, photos or precise location, ask one question: does the thing this app does require this? A photo editor needs photos. A torch app does not need your contacts, and when a simple utility asks for something unrelated, the request is usually about data collection rather than function.

Two practical settings on modern phones are worth knowing:

• While using the app rather than always. An app that only has location while open cannot build a map of your week.
• Approximate rather than precise location. A weather app works perfectly well knowing your city and does not need to know your street.

Go through your phone's permission settings by category rather than by app. Ask it which apps have microphone access, and the list is usually surprising.

What you can actually do

1. Reject non-essential cookies. It takes two extra clicks and is the single most repeated privacy decision in your life.
2. Turn off precise location for anything that does not navigate.
3. Remove permissions from apps you no longer use, then delete the apps.
4. Look for the ad personalisation setting in the big platforms and turn it off. It exists, and it is buried.
5. Use a separate email address for sign-ups you do not care about.
6. Before installing anything, read what permissions it asks for and decide whether the function justifies them.

None of this makes you invisible, and pretending otherwise would be dishonest. It reduces how much is collected and by how many companies, which is the realistic goal.

Common misconceptions

• "If I have nothing to hide it does not matter." The question is not whether you are doing something wrong. It is that detailed records get combined, breached, sold and kept for years, and are used to make decisions about you by systems you cannot see or appeal to.
• "Anonymised means it cannot be traced to me." Researchers have repeatedly shown that detailed anonymised records, especially location traces, can often be matched back to individuals using other available data.
• "They only collect what I type in." Most collected data is behavioural: timings, taps, dwell time, what you scrolled past, and what you began typing and then deleted.

Where this leaves us

The number thirteen on sign-up forms comes from a 1998 American law, and companies responded to it by designing around consent rather than around collection. Data comes in three kinds, and the two you do not notice, what you generate and what is inferred, are both larger and more valuable than what you type. Cookies from the site you are on do useful work, and third-party cookies exist to follow you between sites, which is what the banner is really asking about. A privacy policy can be searched in four minutes for share, third part, sell, retain, location and advertis, and the standard phrases have standard meanings that are worth learning. Permissions are the control you genuinely hold, so grant them only where the function requires them, prefer while using and approximate location, and audit by category rather than by app.

Sources

1. Federal Trade Commission. (n.d.). Children's Online Privacy Protection Rule (COPPA). FTC Legal Library. ftc.gov
2. Federal Trade Commission. (n.d.). How websites and apps collect and use your information. FTC Consumer Advice. consumer.ftc.gov
3. Wikipedia contributors. (n.d.). HTTP cookie. Wikipedia. en.wikipedia.org
4. Wikipedia contributors. (n.d.). General Data Protection Regulation. Wikipedia. en.wikipedia.org
5. Terms of Service; Didn't Read. (n.d.). Plain-language summaries of website terms. tosdr.org. tosdr.org

In October 2006 Netflix offered a million dollars to anyone who could improve its film recommendation predictions by ten percent. It released a huge set of anonymised ratings, and thousands of teams worldwide spent nearly three years on it. A combined team called BellKor's Pragmatic Chaos claimed the prize in 2009.

Two things are worth noticing about that. First, a company was willing to pay a million dollars to get slightly better at guessing what you would enjoy, which tells you what recommendation is worth. Second, the contest was scored on predicting star ratings, and modern feeds are not. They predict something else, and the difference is the subject of this lesson.

Feeds used to be a list

Early social feeds were chronological. Posts appeared in the order they were made, from the accounts you had chosen to follow. It was simple, it was predictable, and if you scrolled far enough you reached the end.

Ranked feeds replaced that. Now a system chooses which posts to show you and in what order, drawing from a pool far larger than the accounts you follow. There is no end to reach, because there is always more to rank.

That change is easy to miss because the app looks the same. But it moved the decision about what you see from you to a model.

How a recommender decides

Three ideas are combined in most modern systems.

Approach	The logic	Example
Collaborative filtering	Find users who behaved like you, then show you what they engaged with	People who watched these four videos also watched this fifth one
Content-based	Describe the item by its features, and match to what you liked before	You watch a lot of short cooking videos with narration, so here is another
Engagement prediction	Estimate the probability that you will watch, like, comment, share or stay, and rank by a weighted combination	This post has a 12 percent predicted chance of a comment from you, which is high

The third row is the one that governs modern feeds. The system is not asking what will this person find valuable. It is asking what is this person most likely to do something with, right now.

Why this matters: A ranked feed predicts your behaviour, not your interests, and those are different things.

The signals you did not mean to send

Following and liking are the obvious inputs and the smallest ones. The larger set is passive:

• How long you looked at each item, measured in fractions of a second, including things you did not tap.
• Whether you watched a video to the end, and whether you replayed it.
• Whether you scrolled back up to look at something again.
• What you did immediately afterwards: closed the app, opened a search, messaged someone.
• Time of day, day of week, and how long the session lasted.
• Profiles you visited without following, and captions you expanded.

This is why a feed can seem to know something you never told it. Pausing for two seconds on a post about a subject you are worried about is a signal, and you sent it without deciding to.

The objective problem

Here is the structural issue, and it does not require anyone to be a villain.

A system optimises whatever it is scored on. If it is scored on engagement, it will find whatever produces engagement, and it does not know or care what that content is. It turns out that certain things reliably produce engagement: strong emotion, especially anger; conflict; content that feels slightly more extreme than what you saw last time; and material that arrives just before you would otherwise have closed the app.

None of that was designed as a goal. It is a consequence of the measure. Engagement is easy to count, and value, accuracy and wellbeing are hard to count, so engagement is what gets optimised.

So what?: When something is easy to measure and something else matters more, systems optimise the easy thing. That single sentence explains a lot of the internet.

Filter bubbles, honestly

The popular version says that algorithms trap each person in a bubble of agreeable content, and that this is the main cause of political division. The idea was popularised as the filter bubble around 2011.

The research is more mixed than the popular version. Several large studies have found that people encounter more disagreeing content online than they would offline, since social networks include weak connections with different views. Other work finds real narrowing effects, especially for heavy users of a single platform. Meanwhile people sort themselves: choosing who to follow and which app to use is a bigger filter than any ranking system applies.

So the careful statement is this. Personalised ranking narrows what you see, the effect is real and measurable, it is smaller than the popular story claims, and it interacts with choices you are making yourself.

Why your feed is not your friend's

Two people using the same app on the same day are shown different worlds. This has a consequence that comes up in arguments constantly: everyone is talking about this usually means everyone in my feed, which is a group assembled by a model from your own past behaviour.

A trend you cannot escape may be enormous, or may be a small thing your feed has decided you engage with. You cannot tell from inside. The only way to find out is to look somewhere your feed does not reach: a search, a news site, a different platform, or simply asking someone.

Taking some control

1. Look for a chronological or following-only option. Several platforms have one, usually not as the default, and it changes the experience immediately.
2. Use the not interested or hide controls when they appear. They are real feedback, and stronger than passively scrolling past.
3. Unfollow or mute deliberately, including accounts you enjoy arguing with. Anger is engagement, and the system reads it as interest.
4. Clear or pause watch history where the setting exists. Many platforms allow it and none advertise it.
5. Search rather than scroll when you want something specific, which puts you back in charge of the query.
6. Notice your own pauses. The seconds you linger are the strongest instruction you give the system all day.

Common misconceptions

• "The app listens through my microphone, because I talked about something and then saw an ad for it." Investigations have repeatedly failed to find evidence of routine audio surveillance, and the technical costs would be enormous. The likelier explanation is duller and more impressive: your searches, your location, what your friends do, what people similar to you did, and the fact that you talked about a thing precisely because it was already around you.
• "The algorithm shows me what I like." It shows what you are predicted to engage with, which includes things that annoy or upset you, because those produce reactions too.
• "If a topic is everywhere, it must be a huge deal." Everywhere means everywhere in your feed, which was assembled for you. The size of a trend is not visible from inside the feed carrying it.

Summing up

Netflix paid a million dollars in 2009 for a ten percent improvement in predicting ratings, which shows what recommendation is worth, and modern feeds have moved on to predicting behaviour instead. Ranked feeds replaced chronological ones and moved the decision about what you see from you to a model built on collaborative filtering, content features and engagement prediction. The signals it uses are mostly passive: dwell time, replays, what you did next, how long you stayed. A system optimises what it is scored on, and engagement is easy to count while value and accuracy are not, which is why emotion and conflict rise. Filter bubble effects are real, measurable and smaller than the popular story, and your own choices about who to follow do more filtering than the ranking does. Your feed is not anyone else's, so everyone is talking about this is a claim about your feed, and the controls that genuinely work are chronological modes, explicit not-interested feedback, and noticing where you linger.

Sources

1. Wikipedia contributors. (n.d.). Netflix Prize. Wikipedia. en.wikipedia.org
2. Wikipedia contributors. (n.d.). Recommender system. Wikipedia. en.wikipedia.org
3. Wikipedia contributors. (n.d.). Collaborative filtering. Wikipedia. en.wikipedia.org
4. Wikipedia contributors. (n.d.). Filter bubble. Wikipedia. en.wikipedia.org
5. Wikipedia contributors. (n.d.). Echo chamber (media). Wikipedia. en.wikipedia.org

You open a page. Before it finishes loading, in roughly the time it takes to blink, an auction has been held. Information about you, or at least about your browser, was offered to a set of advertisers, they bid against each other for the right to show you something, one of them won, and their advertisement appeared in the space.

The process is called real-time bidding, and it happens billions of times a day. Nobody involved knows your name, and that turns out not to matter much.

Follow the money first

The most useful sentence about any free online service is this: work out who is paying, because that is the customer.

If you do not pay for a service, someone else does, and what they are paying for is access to your attention and information about which attention they are getting. The service is designed to serve them, because they are the ones with the invoice. That is not a conspiracy; it is how the business works, and it is stated openly in every annual report.

Key idea: If the service is free, the advertiser is the customer and your attention is the product being sold.

What is in a targeting profile

Category	What it contains	Where it comes from
Demographic	Age range, language, approximate location	What you entered, plus inference from behaviour
Interest	Topics you appear to care about	What you engaged with, followed, searched and lingered on
Behavioural	Sites visited, products viewed, videos completed, time of day you are active	Trackers embedded across many sites and apps
Retargeting list	You specifically, because you looked at one product and did not buy	A tracker placed by that shop
Lookalike audience	People who resemble a company's existing customers on many measures	A model comparing you to that customer list

The last row explains most of the uncanny experiences. A lookalike audience does not require anyone to know anything about you personally. It requires only that your pattern of behaviour resembles the pattern of people who already bought a thing. That is enough to show you an advertisement that feels like it read your mind.

Retargeting, which is the one everybody notices

You look at a pair of trainers. For the next fortnight those trainers appear on unrelated websites, in your feed, beside a news article.

What happened is that the shop's tracker recorded your browser as having viewed that product, added you to a retargeting list, and now advertisers bid slightly more for the chance to show you an advertisement, because you are known to be interested. Retargeted advertisements are worth more per view than untargeted ones, so the auction favours them.

Two useful facts. It does not know it is you; it knows it is this browser or this device. And it stops if you clear cookies or use a browser that blocks third-party trackers, which is a simple test you can run yourself.

The auction, step by step

1. You load a page or open an app. The space where an advertisement will go is empty.
2. A request goes out describing the slot and whatever is known about the visitor: rough location, device, the kind of page, and identifiers linking to a profile.
3. Advertisers, or systems bidding on their behalf, evaluate that request against their targeting rules and submit bids.
4. The highest bid wins, subject to the rules of the platform.
5. The advertisement loads, and whether you looked at it, and whether you clicked, is recorded and fed back.

All of that, typically in around a tenth of a second, before you have read the headline.

Advertising that is designed not to look like advertising

The formats that work best on people your age are the ones that do not announce themselves.

• Influencer content. A creator you follow uses a product. It feels like a recommendation from someone you know, which is precisely why brands pay for it.
• Sponsored posts and articles. Written to look like the surrounding editorial content, with a small label. The Stanford research you met earlier found most middle schoolers could not identify these.
• In-game promotion. Limited-time offers, timed events, and purchasable items presented as part of the game rather than as a shop.

In the United States, the Federal Trade Commission requires people endorsing products to disclose a material connection, meaning payment, free products or family ties, clearly and conspicuously. The rules exist; compliance is uneven, and a disclosure buried in a wall of hashtags is not conspicuous. So look for it, and treat its absence as information.

Remember: The most effective advertisement is the one you do not classify as an advertisement while you are watching it.

Free games are not free

A game that costs nothing to install still has to make money, and the design of the game follows from that. Timers that make you wait unless you pay, currencies that convert awkwardly so you cannot easily see the real price, limited-time offers, and randomised rewards are all revenue mechanisms expressed as gameplay.

Randomised paid rewards, sometimes called loot boxes, have attracted regulatory attention in several countries precisely because the structure resembles gambling. You do not have to take a position on that debate to use the practical rule: whenever a game creates urgency, that urgency was designed, and it is worth asking what it is designed to do.

What you can actually change

1. Find the ad settings or ad personalisation controls on the big platforms and turn personalisation off. It is available and buried.
2. Reject non-essential cookies, which limits how many trackers follow you between sites.
3. Use a browser or setting that blocks third-party trackers. Several browsers do this by default now.
4. Notice sponsored labels before reading, not after.
5. When an advertisement feels uncanny, work out which signal caused it. Usually you can, and the exercise makes the system feel less magical and more mechanical.

Common misconceptions

• "Turning off ad personalisation means no more ads." It means the same number of advertisements, chosen less specifically. What changes is the targeting, not the quantity.
• "An advertiser who targets me knows my name." Usually not. Most targeting works on identifiers attached to a device or browser, plus statistical resemblance to other people, which is enough to be unsettling without being personal.
• "If a creator did not say it was an ad, it was not one." Disclosure is required in the United States and often ignored or hidden. Absence of a label is not evidence of absence of payment.

What to carry forward

An auction runs in about a tenth of a second every time an advertisement space loads, bidding on a profile of the device rather than on a person by name. If a service is free, the advertiser is the customer, and the design serves the customer. Targeting profiles combine demographics, interests, behaviour tracked across sites, retargeting lists built from products you looked at, and lookalike audiences that need to know nothing about you except that your behaviour resembles someone else's. The most effective advertising does not look like advertising, which is why disclosure rules exist and why you should look for the label rather than wait for it. Free games are paid for through design: timers, converted currencies, urgency and randomised rewards. And the controls that exist, ad personalisation settings, cookie rejection and tracker blocking, are real, buried, and worth ten minutes of your time.

Sources

1. Wikipedia contributors. (n.d.). Real-time bidding. Wikipedia. en.wikipedia.org
2. Wikipedia contributors. (n.d.). Targeted advertising. Wikipedia. en.wikipedia.org
3. Federal Trade Commission. (n.d.). Disclosures 101 for social media influencers. FTC Business Guidance. ftc.gov
4. Federal Trade Commission. (n.d.). Children's privacy. FTC Business Guidance. ftc.gov
5. Wikipedia contributors. (n.d.). HTTP cookie. Wikipedia. en.wikipedia.org

In 2014 the Court of Justice of the European Union decided a case brought by a Spanish man named Mario Costeja Gonzalez. Years earlier, a newspaper had published a short legal notice about his house being repossessed over unpaid debts. The debt was long settled, but searching his name still brought up the notice near the top.

He argued that this was no longer relevant and caused him ongoing harm. The court agreed that search engines must consider requests to remove links to information that is inadequate, irrelevant or excessive, and the principle became known as the right to be forgotten.

The case is a good place to start because of what it concedes. It took a court ruling, in one region, applying only to search results, to reduce the visibility of one two-line notice. The default is that things stay.

Two footprints

Your active footprint is what you deliberately put out: posts, comments, photos, videos, reviews, profiles, replies, usernames.

Your passive footprint is what is collected while you do other things: which sites you visited, what you searched, where your device was, what you bought, what you paused on. You met most of that in the last two lessons.

There is a third category people forget, and it is often the largest: what other people post about you. Photos you are tagged in, group chats, a parent's posts about you going back to before you could object, a sports team roster, a school newsletter.

What matters here: A large part of your footprint was created by other people, which means managing your own posting is only part of the job.

Who actually looks

It is worth being accurate about this rather than dramatic.

Who	What they look for	How likely
People you know	Ordinary curiosity, and occasionally material to use in an argument	Constantly
Schools and clubs	Usually only when something is reported to them	Occasionally
Colleges and employers, later	A quick search on a name; varies enormously by field and country	Sometimes, years from now
Scammers	Details usable for account recovery, and information that makes a targeted message convincing	Automated and routine

Note the bottom row, because it is the one adults mention least and it is the most active. A scammer does not care about an embarrassing photograph. A scammer cares that your public posts name your first pet, your birthday, your school and your best friend, which are the answers to four security questions and the raw material for a convincing message.

What permanent actually means

The slogan is that the internet is forever. Like most slogans it is half right, and knowing which half matters.

Things that make content persist: screenshots, which anyone can take of anything, including messages that delete themselves; reposts and downloads; web archives, which store copies of public pages and keep them; and company backups, which often outlive your deletion by months.

Things that genuinely disappear: enormous amounts, all the time. Sites close, accounts are deleted, links rot, platforms shut down and take everything with them. If you have ever tried to find something from six years ago, you know this.

So the honest version is: deletion removes the copy you control and nothing else, and you cannot know in advance which things will persist. Plan on the assumption that anything shared with anyone can end up anywhere, while not believing that every foolish comment will follow you for life.

In short: You control your copy. You do not control anyone else's, and you cannot predict which copies survive.

Audit yourself in fifteen minutes

1. Search your full name in quotation marks. Then with your town or your school added. Then in a private browsing window, which strips out personalisation and shows something closer to what a stranger sees.
2. Search your usernames, especially any you have reused across services. A reused username is a thread connecting accounts you may think of as separate.
3. Run an image search on a clear photo of yourself, or search your name in the images tab.
4. Write down everything you find in three columns: fine, would rather it were not there, and needs to go now.
5. For the third column, work out who controls it. If it is your post, delete it. If it is someone else's, ask them. If it is a site, look for a contact or removal request page.
6. Check the privacy settings on every account you found, and note which ones were public that you assumed were not.

Most people find one or two genuine surprises, usually an old account they forgot or a photograph posted by someone else.

Privacy settings: real, but not magic

Settings genuinely control who can see a post at the moment they see it. Use them, and check them after every app update, because updates reset things more often than they should.

What they cannot do is control what happens next. A post visible to two hundred people is a post that two hundred people can screenshot. The correct mental model is not locked or unlocked but rather how many people can start the next copy.

What other people post about you

You have less power here and more than nothing.

• Turn on tag review if the platform offers it, so you approve tags before they appear on your profile.
• Ask directly and specifically. Please take down the third photo in that post is far more likely to work than a general complaint. Most people comply and are slightly embarrassed.
• Ask family members too. Parents post about children constantly and rarely think of it as publishing. A calm conversation about which things you would rather were not public usually goes better than expected.
• If it will not come down and it matters, most platforms have a reporting route for images of you posted without consent, and an adult can help you use it.

What is actually worth worrying about

Being proportionate matters, because advice that treats everything as catastrophic gets ignored entirely.

Low priority: an unflattering photo, an old opinion you have changed, a badly spelled comment from two years ago. Everyone has these. They are the texture of having existed.

High priority: anything revealing where you are regularly and when, since patterns are more useful to a stranger than a single location; the answers to account recovery questions; images or messages that could be used to pressure or embarrass you into doing something; and full personal details such as your address, your exact birthday and your school combined in one findable place.

Bottom line: The risk is not one embarrassing post. It is patterns, personal details and material that gives someone leverage over you.

Common misconceptions

• "Disappearing messages leave no trace." The recipient can screenshot or photograph the screen with another device. The feature reduces casual persistence; it does not prevent copying.
• "Deleting my account erases everything." It removes your copy. Screenshots, reposts, archived pages and backups are unaffected, and content you posted in someone else's group may remain.
• "A private account means what I post is private." It means a specific set of people can see it, and any one of them can copy it onwards. Private limits the audience, not the possibility of spread.

Pulling it together

It took a 2014 European court ruling to reduce the visibility of one two-line legal notice about one man, which tells you the default is persistence. Your footprint has three parts: what you post, what is collected while you browse, and what other people post about you, and the third is often the largest and the least managed. The people most reliably looking are not colleges but scammers, hunting for account recovery answers and details that make a targeted message convincing. Deletion removes your copy only, screenshots and archives are outside your control, and yet plenty of material does vanish as sites close and links rot. A fifteen minute self-audit, using quotation marks, your usernames and a private window, usually turns up one real surprise. And priorities matter: an old bad photo is ordinary, while location patterns, recovery answers and material that gives someone leverage are not.

Sources

1. Wikipedia contributors. (n.d.). Digital footprint. Wikipedia. en.wikipedia.org
2. Wikipedia contributors. (n.d.). Right to be forgotten. Wikipedia. en.wikipedia.org
3. Federal Trade Commission. (n.d.). Online privacy and security. FTC Consumer Advice. consumer.ftc.gov
4. Google. (n.d.). Be Internet Awesome. Google. beinternetawesome.withgoogle.com
5. Common Sense Education. (n.d.). Digital citizenship curriculum. Common Sense. commonsense.org

In December 2022 the Pew Research Center published a survey of American teenagers aged thirteen to seventeen. Nearly half, forty-six percent, said they had experienced at least one of six online behaviours: being called offensive names, having false rumours spread about them, being sent explicit images they did not ask for, being asked repeatedly where they were and who they were with by someone other than a parent, being physically threatened, or having explicit images of them shared without their consent.

Name-calling was the most common by a distance. Physical threats were the least common. That spread matters, because it means most of what happens is at the lower end and a small amount is serious, and the two need different responses.

Three things that make online conflict different

• There is an audience. A corridor argument has two people and maybe three onlookers. An online argument has everyone who scrolls past, which changes the incentives: now both people are performing, and backing down costs more.
• There is a record. Something said in a moment of temper stays there, screenshottable, quotable, and re-readable at three in the morning.
• You cannot see a face. Psychologists call this part of the online disinhibition effect: without the immediate feedback of someone's expression, people say things they would not say in person, because none of the signals that normally stop us are arriving.

None of these makes anyone a bad person. They are properties of the medium, and knowing them is what lets you notice when they are acting on you.

The point: The audience, the record and the missing face are what make online conflict escalate faster than the same conversation in a room.

Three different things, three different responses

What it is	What it looks like	Proportionate response
Disagreement	Someone thinks you are wrong and says so, about the thing rather than about you	Engage if you want to, or leave it. Not a problem to be solved
Cruelty	An insult, a mocking comment, a nasty reply. Unpleasant, usually one-off	Do not reply while angry. Mute, block or ignore. Consider whether it needs anything else
Harassment	Repeated, targeted, and intended to distress; or involving threats, sexual content, or images of you	Stop responding entirely, record it, report it, and tell an adult

The distinction that matters most is the second and third rows, and the key word in the third is repeated. One rude comment from a stranger is unpleasant. The same person doing it every day for a fortnight is a different situation with different rules.

If it is aimed at you

1. Do not reply straight away. This is the hardest instruction here and the most useful. Anything you write in the first ten minutes will be the thing you regret, and it becomes part of the record.
2. Record it before anything else. Screenshot the message with the username, the date and the time visible. If you block or report first, you may lose access to the evidence. Save the screenshots somewhere that is not the app.
3. Use the platform's tools. Block stops contact. Mute hides someone without telling them. Restrict, where it exists, lets their comments be visible only to them. Choose according to whether you want them to know.
4. Report it. Reporting is often slow and imperfect and it still matters: repeated reports build a record, and some categories, especially threats and images of a minor, are acted on quickly.
5. Tell someone. Not because they will fix it, though they might, but because harassment works partly by isolation and telling one person ends that.
6. Stop reading it. Checking to see whether it has got worse feels like vigilance and is not. Hand the account to someone you trust for a few days if you need to.

Remember: Screenshot before you block. Once you block, you often cannot get back to the evidence.

Why just ignore it is incomplete advice

Ignoring is genuinely the right response to a single rude comment from a stranger, because a reply is the reward.

It is bad advice for sustained harassment, for three reasons. It leaves no record, so if it escalates you have nothing to show. It leaves the target alone with it. And it does nothing about an audience who are watching to see whether this is acceptable here, which is often what determines whether it continues.

If it is aimed at someone else

Research on bystanders is fairly consistent: what stops harassment is not usually the target defending themselves, but other people making it clear the behaviour is not accepted. Three things work, in roughly this order of effectiveness for someone your age:

• Message the target privately. Say you saw it and it was not okay. This costs you nothing publicly and is repeatedly described by targets as the thing that helped most.
• Do not amplify. Do not screenshot it onward, do not quote it to argue with it, do not add a reaction. Attention is the fuel, and a pile-on is made of individually reasonable contributions.
• Say something short and public if you can. Not an argument. Something brief such as this is not okay changes what the audience thinks is normal, which is the thing actually being contested.

And report it. You can report content aimed at someone else, and a target being reported for by several people carries more weight than one report from the person involved.

If you were the one who was cruel

This happens, usually in a moment of temper or as a joke that landed differently in text than it did in your head. An apology that works has three parts and none of them is an explanation:

1. Name what you did, specifically. Not if anyone was offended, but I said this and it was cruel.
2. Say what you will do, which usually means delete it and not do it again.
3. Stop. Do not ask them to say it is fine, and do not explain what you meant. An apology that requires a response is a request, not an apology.

When to involve an adult

Clear thresholds are more useful than judgement calls in the middle of something upsetting. Tell an adult if any of these is true:

• Anyone threatens to hurt you or anyone else.
• Anything sexual is involved, including images, requests for images, or an adult contacting you.
• Someone has an image of you they are threatening to share. This one is urgent, and it is not something to handle alone. Never pay and never send more.
• It has continued after you blocked and reported.
• It is making you dread school, avoid your phone, or lose sleep.

Adults respond better to a specific report than a vague one. Bring the screenshots, the dates and the usernames, and say what you have already tried.

Worth holding on to: The four thresholds are threats, anything sexual, images of you, and anything that will not stop. Those are not judgement calls.

Common misconceptions

• "Blocking someone makes it worse." It sometimes prompts a reaction from another account, and it still removes the easiest route to you and demonstrates the behaviour was unwelcome, which matters if you later report.
• "Reporting never does anything." Reporting is inconsistent and slow, and it does work for some categories, especially threats and images involving minors. Repeated reports also build the record that later action rests on.
• "If I tell an adult they will take my phone away." This is a real fear and worth saying out loud when you tell them. Ask directly for help with the specific problem and say what you do not want to happen. Most adults would rather help than confiscate, and the ones who need convincing respond better to a clear, evidenced account.

What you now know

Pew found in 2022 that nearly half of American teenagers had experienced at least one of six online behaviours, with name-calling most common and threats least, which means most incidents are at the lower end and a few are serious. Online conflict escalates because it has an audience, leaves a record, and removes the facial feedback that normally stops us. Disagreement, cruelty and harassment are three different things and only the third needs the full procedure. If it is aimed at you: do not reply immediately, screenshot before you block, use the platform tools, report, tell someone, and stop reading. If it is aimed at someone else: message them privately, refuse to amplify, and say something short in public. If you caused it, apologise in three parts and stop. And four thresholds send you to an adult without deliberation: threats, anything sexual, images of you, and anything that continues after you blocked and reported.

Sources

1. Pew Research Center. (2022, December 15). Teens and cyberbullying 2022. Pew Research Center. pewresearch.org
2. StopBullying.gov. (n.d.). What is cyberbullying. U.S. Department of Health and Human Services. stopbullying.gov
3. StopBullying.gov. (n.d.). How to report cyberbullying. U.S. Department of Health and Human Services. stopbullying.gov
4. Wikipedia contributors. (n.d.). Online disinhibition effect. Wikipedia. en.wikipedia.org
5. Common Sense Media. (n.d.). What is cyberbullying. Common Sense Media. commonsensemedia.org

In 1989 the rap group 2 Live Crew recorded a version of Roy Orbison's Oh, Pretty Woman, keeping the famous bass line and opening lyric and replacing the rest with something considerably ruder. The music publisher sued. The case reached the Supreme Court of the United States, and in 1994 the court decided Campbell v. Acuff-Rose Music in the group's favour.

The reasoning is what matters. The court held that a work being commercial does not by itself defeat fair use, and that the central question is whether the new work is transformative, meaning whether it adds something new with a further purpose or different character rather than merely substituting for the original. A parody, the court said, has to borrow recognisably from its target in order to work.

That case is the reason so much online culture is legally survivable, and also the reason the answer to may I use this is almost never a simple yes or no.

What copyright actually protects

Copyright protects original works of authorship fixed in a tangible medium: writing, music, film, photographs, drawings, software, choreography. It gives the creator control over copying, distributing, adapting and publicly performing the work.

Three things it does not protect, which people get wrong constantly:

• Ideas. The idea of a school for young wizards is not owned by anyone. The particular expression of it is.
• Facts. The population of a city, the date of a battle, the boiling point of water. Nobody owns a fact, though a particular chart or description of it can be protected.
• Titles, names and short phrases, which fall under trademark law if anywhere.

And here is the part that surprises people most: copyright is automatic. The moment a work is fixed, a doodle on a napkin or a photograph on a phone, it is protected. No symbol, no registration and no notice is required. In the United States registration matters for bringing a lawsuit, but protection does not depend on it.

Key idea: Everything is copyrighted by default, including the photograph you just took and the one you just found. There is no need to claim it.

How long it lasts

In the United States, for works by an individual created from 1978 onward, copyright lasts for the author's life plus seventy years. For works made for hire, it is ninety-five years from publication or one hundred and twenty years from creation, whichever is shorter. Older works follow different and more complicated rules, and other countries have their own terms.

When it expires, a work enters the public domain and anyone may use it for anything. This is why you can freely use Shakespeare, Beethoven, and out-of-copyright photographs, and why the exact date a famous work becomes free is news when it happens.

The four factors

Fair use is a provision of United States copyright law allowing limited use of protected material without permission. It is decided by weighing four factors together, and no single one is decisive.

Factor	What it asks	What helps you
1. Purpose and character	Why are you using it, and is your use transformative	Criticism, commentary, news reporting, teaching, research, parody. Adding new meaning helps a lot
2. Nature of the work	What kind of work is it	Using factual material is safer than using highly creative material such as a song or novel
3. Amount and substantiality	How much did you take, and was it the heart of the work	Less is better, and avoiding the most important part matters as much as the quantity
4. Effect on the market	Does your use substitute for buying the original	If nobody would skip buying it because of your use, this factor favours you

Factor four tends to carry the most weight in practice, and factor one has become more prominent since Campbell put transformativeness at the centre.

Outside the United States, most countries have something narrower called fair dealing, which lists specific permitted purposes rather than applying a flexible test. So the answer genuinely depends on where you are.

Working four real situations

1. Quoting three sentences from a novel in a school essay, with the source named. Purpose is education and criticism, the amount is tiny, and nobody skips buying the novel because of your essay. Comfortably fair use, and the citation is an academic requirement rather than a legal one.
2. A meme using a film still with new text. Transformative in purpose, a single frame out of a feature film, and no substitution for watching the film. A strong fair use argument, though studios do sometimes object.
3. A video where you play a whole song and talk over the chorus. The whole work, the most creative kind of work, and a plausible substitute for listening to it. Weak on three factors out of four.
4. Using a popular song as background music in a school project video posted publicly. Not transformative, a highly creative work, usually the recognisable part, and it substitutes for a licensed use that a rights holder would normally charge for. This is the one students most often get wrong, and it is the reason platform systems flag school projects constantly.

Bottom line: Ask what you are adding, how much you took, and whether anyone loses a sale. Those three questions get you most of the way.

Fair use is a defence, not a permission

This distinction matters and it is not pedantic. Fair use is not a category of material you are allowed to take. It is an argument you can make if you are accused of infringement, and it is decided case by case, by a court, weighing all four factors.

That means nobody can tell you with certainty in advance that something is fair use, including this lesson. What you can do is assess how strong your argument would be, and prefer strong positions to weak ones.

What actually happens on platforms

The law is one system. Platform enforcement is another, and they do not match.

Large platforms run automated matching that compares uploads against a database of registered works and acts on matches: muting audio, blocking the video, or diverting its revenue to the rights holder. This is a private system built to reduce a platform's legal exposure, and it is not applying the four factors. It is matching audio fingerprints.

Separately, the Digital Millennium Copyright Act sets up a notice-and-takedown process: a rights holder sends a notice, the platform removes the content, and the uploader may file a counter-notice. It is faster than a court and much blunter, and false or mistaken claims are common.

So a video being flagged does not mean you broke the law, and a video not being flagged does not mean you did not.

Common misconceptions

• "If I credit the creator it is legal." Credit is about honesty and is required in academic work. It is not permission, and it does not change whether a use infringes. Uncredited fair use is still fair use, and credited infringement is still infringement.
• "Using under thirty seconds, or under ten percent, is automatically fine." There is no such rule anywhere in the law. Taking a short but central portion can weigh against you under factor three.
• "Writing no copyright infringement intended protects me." It does nothing at all. Infringement does not require intent, and announcing that you know the material is not yours does not help your position.

Where this leaves us

Campbell v. Acuff-Rose in 1994 put transformativeness at the centre of American fair use analysis and established that being commercial does not by itself defeat the defence. Copyright protects the expression of a work, not the ideas or facts in it, and it applies automatically from the moment a work is fixed, with no registration or symbol needed. In the United States it lasts for the author's life plus seventy years for individual works, after which the work is in the public domain. Fair use weighs four factors together: purpose and character, nature of the work, amount taken, and effect on the market, with the last two doing most of the work in ordinary cases. It is a defence argued case by case rather than a permission granted in advance, most countries use narrower fair dealing rules instead, and platform enforcement is an automated private system that does not apply the legal test at all.

Sources

1. United States Copyright Office. (n.d.). What is copyright? copyright.gov. copyright.gov
2. United States Copyright Office. (n.d.). Fair use. copyright.gov. copyright.gov
3. United States Copyright Office. (n.d.). How long does copyright protection last? Frequently asked questions. copyright.gov
4. Wikipedia contributors. (n.d.). Campbell v. Acuff-Rose Music, Inc. Wikipedia. en.wikipedia.org
5. Wikipedia contributors. (n.d.). Digital Millennium Copyright Act. Wikipedia. en.wikipedia.org

Creative Commons was founded in 2001, and released its first set of licences in December 2002. The idea came from a simple observation about the default: copyright is automatic and reserves all rights, which means a photographer who would happily let anyone use a picture has no easy way to say so. Contacting each creator individually does not scale, so material that was meant to be shared stayed locked.

The licences are a set of ready-made permissions, written once by lawyers, that a creator can attach to a work in a few seconds. Millions of images, songs, articles and datasets now carry one, including most of the photographs on Wikipedia.

Four building blocks

Every Creative Commons licence is built from a small set of conditions.

Code	Name	What it requires
BY	Attribution	You must credit the creator. Present in every current licence
SA	ShareAlike	Anything you make from it must carry the same licence
NC	NonCommercial	You may not use it for commercial purposes
ND	NoDerivatives	You may share it but not alter it or build on it

Combining these gives six licences, from CC BY, which asks only for credit, to CC BY-NC-ND, which allows sharing an unmodified copy for non-commercial purposes with credit. There is also CC0, which is not really a licence but a waiver: the creator gives up their rights as far as the law allows, so the work behaves like the public domain.

So CC BY-SA 4.0 on a photograph means, precisely: you can use it anywhere including commercially, you can crop and edit it, you must credit the photographer, and anything you build from it must carry the same ShareAlike licence.

What matters here: A licence is a set of specific permissions with specific conditions. Read the letters and you know exactly what you may do.

Where to find material you may actually use

• Wikimedia Commons. Millions of freely licensed images, with the licence stated on each file page and a ready-made attribution line usually provided.
• Government works. Works produced by United States federal agencies are generally not subject to copyright, which is why NASA and NOAA images circulate so freely. This varies by country, so check rather than assume.
• Museum open access programmes. Several major museums have released large parts of their collections for free use.
• Explicit search filters. Search engines offer usage rights filters. Treat them as a starting point rather than proof, and confirm the licence on the page itself before using anything.

That last caution is the one that catches people. A filter reports what a site claimed. If the site copied the image from somewhere else, the claim is worthless, which is why you check the source page.

Attributing properly: four things

A good attribution answers four questions, easily remembered as title, author, source, licence.

1. Title. What is the work called?
2. Author. Who made it, as they wish to be named?
3. Source. Where did you get it? A link to the page you took it from, not a general link to the site.
4. Licence. Which licence, including the version, and a link to it.

A worked example, written out as you would put it under an image in a school presentation: Bridge at Dusk by A. Rivera, from Wikimedia Commons, licensed CC BY-SA 4.0. If you cropped it, add cropped from the original. That is the whole requirement, and it takes about twenty seconds.

Two different obligations

People run these together constantly, and they are separate.

Copyright infringement is a legal problem. It happens when you use protected material without permission and without a defence such as fair use, whether or not you said where it came from.

Plagiarism is an honesty problem. It happens when you present someone else's work or ideas as your own, whether or not you had the legal right to use them.

The four combinations all exist. Quoting a novel briefly in an essay with a citation: legal and honest. Copying a paragraph from a website into an essay with no citation: plagiarism, and possibly infringement too. Copying a paragraph of Shakespeare without a citation: no infringement at all, since it is public domain, and still plagiarism. Uploading a whole film you bought: infringement, but nobody thinks you wrote it, so not plagiarism.

Remember: Permission and credit are two separate obligations. Having one does not satisfy the other.

What a citation has to do

Forget formats for a moment. A citation exists so a reader can do three things: find the exact source, check that it says what you claimed, and know when it was published, because the age of a source often decides whether it is still true.

Any format that lets a reader do those three things is doing its job. Schools ask for a particular style so that everyone's citations are readable in the same order, and the underlying elements barely change between styles: who, when, what, where.

Built up for a web page, in the style this course uses: author or organisation, then year or n.d. for no date, then the title of the page, then the site name, then the link. For example: Federal Trade Commission. (n.d.). How to recognize and avoid phishing scams. FTC Consumer Advice. Followed by the address.

Two rules that matter more than the punctuation. Cite the source you actually used, not one you found cited somewhere else and never opened. And cite ideas as well as words: a paraphrase of somebody's argument needs a citation just as much as a quotation does.

Common misconceptions

• "Creative Commons means free to do anything with." Only CC0 is close to that. NC forbids commercial use, ND forbids editing, and SA obliges you to license your own work the same way, which can be a real constraint.
• "If I change it enough it is mine." Editing a photograph produces a derivative work, which still depends on rights in the original. ND licences forbid it outright, and other licences require attribution to the original.
• "Public domain and freely available mean the same thing." Public domain means the copyright has expired or never applied. Freely available means you can see it without paying, which says nothing at all about your right to reuse it.

What to remember

Creative Commons, founded in 2001 with its first licences in 2002, exists because copyright reserves all rights automatically and creators who want to share had no simple way to say so. Four building blocks, BY, SA, NC and ND, combine into six licences, plus CC0 as a waiver, and reading the letters tells you exactly what you may do. Wikimedia Commons, United States federal works and museum open access programmes are reliable places to find usable material, while search engine usage filters report a claim rather than a fact. Attribution needs title, author, source and licence, and takes about twenty seconds. Infringement is a legal question and plagiarism is an honesty question, and all four combinations of the two genuinely occur. And a citation only has to let a reader find the source, check it and see how old it is, which means citing what you actually read and citing ideas as well as words.

Sources

1. Creative Commons. (n.d.). About CC licenses. creativecommons.org. creativecommons.org
2. Creative Commons. (n.d.). Frequently asked questions. creativecommons.org. creativecommons.org
3. Wikimedia Commons. (n.d.). Wikimedia Commons: freely usable media files. commons.wikimedia.org. commons.wikimedia.org
4. Purdue Online Writing Lab. (n.d.). MLA formatting and style guide. Purdue OWL. owl.purdue.edu
5. Wikipedia contributors. (n.d.). Creative Commons license. Wikipedia. en.wikipedia.org

In 2023 a lawyer in New York filed a legal brief in a case against the airline Avianca. It cited half a dozen previous court decisions, with names, volume numbers and quotations. Opposing counsel could not find any of them, because none of them existed. The lawyer had used a chatbot to do the research and had not checked the results. In June 2023 a federal judge fined the lawyers involved.

The interesting part is not that a tool made things up. It is that the citations looked exactly right. Correct format, plausible court names, realistic volume numbers, quotations in the proper register. The output had every feature of a real citation except being real.

Understanding why that happens tells you almost everything you need about using these tools.

What the tool is actually doing

A large language model is trained on an enormous quantity of text, and what it learns is how text goes: which words and structures tend to follow which others, across billions of examples. When you type a question, it produces a response by repeatedly predicting what should come next.

It is not looking anything up. There is no internal encyclopaedia it consults and no list of facts it checks against, unless it has been specifically connected to a search tool, and even then the checking is imperfect. What it has is a very good model of what an answer to a question like yours usually looks like.

Most of the time that produces something true, because true statements are extremely common in the text it learned from. When it does not, the output looks exactly as confident as when it does, because confidence is a feature of the writing style, not a report on the model's certainty.

Key idea: The tool predicts what an answer looks like. Truth is usually a side effect of that, and never a guarantee.

Why citations specifically

Now the New York case makes sense. A citation has a very regular shape: a case name, a volume number, a reporter abbreviation, a page, a year. That shape is easy to learn and easy to reproduce.

The content behind the shape is much harder, and the model has no separate step where it verifies that a particular combination corresponds to a real document. So it generates a perfect-looking citation to a case that never happened, and it does so in exactly the same tone it uses for a real one.

Anything with a strong regular format is vulnerable in the same way: references, page numbers, statistics, quotations, dates, product specifications, scientific study titles.

Four kinds of error

Kind	What it looks like	How to catch it
Fabrication	Invented sources, quotations, events or details, presented confidently	Search for the specific item independently; if it does not exist, nothing else matters
Out of date	Correct as of when the model was trained, wrong now: prices, office holders, records, rules	Check anything that changes against a current source
Bias from training data	Reproducing patterns and imbalances present in the text it learned from	Notice whose perspective is missing, and ask specifically for the alternatives
Confident reasoning failures	Arithmetic slips, mishandled multi-step logic, misread instructions, all in fluent prose	Do the arithmetic yourself; check each step rather than the conclusion

The last row deserves emphasis because it is counter-intuitive. A system that writes beautifully about mathematics can get simple arithmetic wrong, since writing well and calculating correctly are different capabilities. Fluency is not a signal of accuracy, and it feels like one.

What they are genuinely useful for

Being fair about this matters, because advice that says never use it will simply be ignored.

• Explaining something several ways. If a textbook explanation did not land, asking for a different angle, or a simpler one, or an analogy, is a real use, and you can check the result against the textbook.
• Working on text you supply. Summarising a passage you paste in, restructuring your own paragraph, spotting where your argument is unclear. The material is in front of it, so fabrication is much less likely.
• Getting unstuck. Twenty possible topics, a list of angles you have not considered, questions you should be asking. You then do the actual work.
• Arguing against you. Paste your own argument and ask for the strongest objections. This is one of the best uses and almost nobody does it.
• Practice questions. Ask it to quiz you on material you are learning, then check the answers against your source.

Notice the pattern. The safe uses are ones where you already have the material, or where you will immediately verify the output, or where being wrong costs nothing because you are brainstorming.

The verification rule

Treat every factual claim from these tools exactly as you would treat a claim from a confident stranger on the internet: as unverified.

Specifically, check anything in these categories before repeating it: names of people, numbers and statistics, dates, quotations, titles of books, studies or articles, and any citation at all. Those are the categories where fabrication is both most likely and most damaging.

And when you check a citation, check that the source exists and that it says what was claimed. A real source attached to a claim it does not support is a failure mode you have already met in the lesson on evaluating websites.

The point: Never repeat a name, number, date, quotation or citation from an AI tool without confirming it somewhere else.

Using it honestly in schoolwork

Here is a test that resolves most cases. Would you be comfortable describing exactly what you did to your teacher, in detail, without leaving anything out? If the honest answer is no, that is your answer, and no argument about it being a tool like a calculator changes it.

Applied to real situations:

What you did	Verdict
Asked it to explain a concept you did not understand, then wrote your own work	Fine, in the same way asking a friend to explain is fine
Asked it to quiz you on your revision	Fine
Asked it to check your spelling and grammar	Usually fine, though ask, since some assignments are testing exactly that
Asked it for feedback on your draft, then revised the draft yourself	Usually fine, and worth disclosing
Asked it to write a paragraph you then edited and submitted as yours	Not fine unless your teacher has permitted it and you disclose it
Submitted its output as your own work	Plagiarism, by the definition in the last lesson

Rules vary by school, by teacher and by assignment, and they are still changing. The right move is to ask before the deadline rather than to guess and defend it afterwards.

What you actually lose

The practical argument matters more than the moral one here.

Writing is not just the production of a document; it is the process that forces you to work out what you think. Outsourcing it produces a document and no thinking, and the gap turns up later, in the discussion where you cannot explain your own argument, in the exam with no device, and in the next piece of work that assumed you learned this one.

The same goes for practice problems. You are not doing them to produce answers. The answers are worthless; you are doing them to build the thing that produces answers.

A word about detectors

Software claiming to detect AI-written text is unreliable in both directions. It misses real AI output, and it accuses real students, with documented false positives falling disproportionately on people writing in a second language and on anyone with a plain, formal style.

Two consequences. Do not rely on a detector's verdict as proof of anything. And keep your drafts, your notes and your version history, because a record of how a piece of work developed is far better evidence of authorship than any detector's score.

Common misconceptions

• "It has access to the whole internet, so it knows the facts." Unless it is explicitly searching, it is generating text from learned patterns, not looking things up. Even with search connected, it can misread or misattribute what it finds.
• "If it sounds confident and detailed, it is probably right." Confidence is a property of the writing style. Fabricated citations in that court filing were more detailed and better formatted than many real ones.
• "Using AI is cheating, full stop." Using it to explain a concept, quiz yourself, or argue against your own draft is not cheating. Submitting its output as your own is. The line is about whose thinking is being assessed.

Where this leaves us

A lawyer filed a brief in 2023 citing cases that did not exist, and the citations looked flawless, which is the whole lesson in one incident. A language model predicts what text should come next, so it produces the shape of an answer, and truth is a usual side effect rather than a guarantee. The four error types are fabrication, being out of date, inherited bias, and confident reasoning failures, and fluent prose is not evidence against any of them. The genuinely good uses share a feature: you supply the material, or you verify immediately, or being wrong costs nothing. Every name, number, date, quotation and citation needs independent confirmation before you repeat it. The honesty test is whether you could describe exactly what you did to your teacher without leaving anything out. And detectors are unreliable in both directions, so keep your drafts.

Sources

1. Wikipedia contributors. (n.d.). Mata v. Avianca, Inc. Wikipedia. en.wikipedia.org
2. Wikipedia contributors. (n.d.). Hallucination (artificial intelligence). Wikipedia. en.wikipedia.org
3. Wikipedia contributors. (n.d.). Large language model. Wikipedia. en.wikipedia.org
4. Wikipedia contributors. (n.d.). Algorithmic bias. Wikipedia. en.wikipedia.org
5. Common Sense Education. (n.d.). AI literacy resources. Common Sense. commonsense.org