AIQ
AIQ
Everything a teacher needs to deliver this lesson — pick your grade's script below once you've read the background.
This lesson runs across all four AIQ age modes, and the gap between the Explorer and Architect versions is larger here than in most lessons — a 6-year-old needs to know "ask a grown-up before sharing," while an 18-year-old needs to reason about GDPR and federated learning. Every version, though, is built around the same core idea: AI makes personal data valuable in a way it wasn't before, which changes who wants to collect it and how much of it gets collected. By the end of the lesson, a student should be able to:
You don't need a technical background to teach this lesson well, but it helps to understand why AI is the reason this topic exists in its current form at all. Data collection about people is old — loyalty cards, phone books, credit bureaus all predate AI by decades. What changed is that modern machine learning is very good at finding patterns in huge, messy piles of personal data and turning those patterns into predictions: what you'll buy next, what mood you're in, who you know, where you'll be tomorrow. That predictive power is what makes personal data commercially valuable at a scale it never was before, and it's why "AI and privacy" is treated as its own topic rather than folded into general internet-safety advice.
Start from what's concrete and verifiable. A smartphone can log GPS location continuously; a voice assistant like a smart speaker records audio to process a spoken command, and some companies have historically retained those recordings, sometimes reviewed by human contractors for quality checks; a camera app or social platform can run facial-recognition or photo-tagging AI over images you upload; a browser or app can log every page you visit, every search you type, and every product you linger on. None of this requires anything exotic — it's mostly just logging, at a scale a human could never review manually, which is exactly the scale AI is built to handle.
The economics matter for the older age bands especially. A free app has to make money somehow, and for a huge share of the ad-supported internet, that "somehow" is: collect data about what users do, build a profile, and sell targeted advertising (or sell the data itself to a third party called a data broker) based on that profile. This is sometimes summarized as "if the product is free, you are the product" — a slight oversimplification, but a genuinely useful one for students meeting this idea for the first time. Data brokers are companies whose entire business is buying, aggregating, and reselling personal data profiles; they are legal in most jurisdictions and mostly invisible to the people whose data they hold, which is part of why regulation in this area has become a live political topic.
Two regulatory frameworks are worth knowing by name for the 11+ age bands, because the lesson's quiz tests them directly. The EU's General Data Protection Regulation (GDPR) gives people rights over data companies hold about them: the right to see what's collected, correct it, delete it, and object to being profiled by automated systems. California's equivalent, the CCPA (California Consumer Privacy Act), gives California residents the right to know what's collected, request deletion, and opt out of having their data sold. Neither law directly protects a student in the Philippines, but both matter for two reasons: many services students use are built to comply with GDPR/CCPA globally rather than maintain different products per region, and both laws are frequently cited as models for privacy legislation elsewhere, including ongoing conversations around the Philippines' own Data Privacy Act (RA 10173).
For the oldest students, the lesson also introduces genuine technical privacy protections, and it's worth being precise about what each one actually does so you can correct a confident wrong answer. Differential privacy adds carefully calibrated random noise to a dataset so that analysts can learn accurate aggregate patterns (like "40% of users in this city like this song") without being able to reliably pinpoint any one individual's actual record — it's a mathematical guarantee, not just "hiding" data. Federated learning trains an AI model across many users' devices without their raw data ever leaving those devices — only model updates (not the underlying photos, messages, or voice recordings) get sent back to a central server, which is how a company can improve a keyboard's next-word prediction without uploading everything anyone ever typed. Homomorphic encryption is a more exotic and still mostly research/early-deployment technique that allows computation directly on encrypted data, producing an encrypted result that decrypts to the correct answer — meaningfully different from ordinary encryption, which has to be decrypted before you can do anything useful with it.
Finally, it's fair to be candid with older students that this is a genuinely unresolved tension, not a solved problem with an obvious right answer. Personalization — the recommendation that's actually useful, the map that knows where you parked, the assistant that recognizes your voice — comes from the same data collection that also enables tracking, profiling, and misuse. There's no purely technical fix that makes this tradeoff disappear; there's only better and worse ways to manage it, which is exactly the debate GDPR, CCPA, and RA 10173 are each trying to referee in their own way.
Like most AIQ lessons, this one is light to prep. You need: