AIQ
AIQ
Part of the Privacy & AI lesson guide. Teaching a different grade? 🌈 Explorer (5–7) · 🔧 Builder (8–10) · ⚡ Architect (15–18)
This age band's hook introduces a real term worth defining precisely up front, since it frames the whole lesson: the "surveillance economy."
"Every click, search, and scroll creates data. AI collects it, analyzes it, and profits from it. Let's examine the surveillance economy and your rights within it."
Before going further, define the term plainly: the surveillance economy refers to business models built specifically around collecting and monetizing user behavioral data — not government surveillance, not security cameras, but companies whose products are engineered to observe what you do and turn that into revenue, usually through advertising or data sales. Make clear this is a real, widely-used term in tech and policy discussion, not classroom shorthand invented for the lesson — it comes up in journalism, academic research, and regulatory debate about companies most students already use daily.
Quick framing question before the activity: "Is it possible to use a smartphone today and generate zero data about yourself? Why or why not?" Push students past "just don't use apps" toward the more honest answer: even basic phone functions (cell tower connections, app installs, OS updates) generate some data, so the realistic question isn't "how do I generate zero data" but "how much data, to whom, for what purpose, and with what rights over it."
Frame the two threads the lesson will pull on explicitly, so students can track which is which as the activity goes on: a legal/rights thread (what protections exist, like GDPR, and who they apply to) and a structural thread (how the actual mechanisms of tracking and profiling work, regardless of what any law says). Both matter, and conflating them is a common mistake — a strong law with weak enforcement changes little in practice, and a well-understood technical mechanism with no legal protection can still be entirely lawful.
The in-app scenes are the same three as other age bands — What AI Knows, How Data Spreads, Protect Yourself — but frame each one toward the legal and structural concepts this age band's own quiz actually tests.
Cover the same four items (location, voice, face, and the paper-diary contrast) but push past "AI collects this" into "and then what?" A single location ping is nearly meaningless on its own; hundreds of pings a day, over months, let a system infer where you live, where you work or study, your routine, and even sensitive information you never explicitly disclosed — like a place of worship you regularly visit, or a medical clinic. This is the core mechanic behind why aggregated, seemingly mundane data can be more revealing than any single fact a person would consciously choose to share.
This is a good moment to name a specific, real risk category: re-identification. Even datasets that have supposedly been "anonymized" — with names and obvious identifiers stripped out — have repeatedly been shown, in real published research, to allow individuals to be re-identified when combined with just a few other pieces of information (a rough location, an approximate age, a handful of purchases). This is precisely the problem differential privacy (covered in Scene 3) was designed to address mathematically, rather than relying on simple name-removal, which research has shown is a weaker protection than it sounds.
Go one level deeper than Builder mode on each item. App permissions: Android and iOS both show a permissions list at install or first use — walk through what "why does a flashlight app want your contacts" actually implies (it likely doesn't need them for its stated function; the request itself is a signal the app's real business model includes data collection). Tracking cookies: explain that cookies let a website recognize a returning visitor, and third-party tracking cookies specifically let an ad network follow the same person across many unrelated websites, building a single profile out of browsing that felt disconnected to the user. Data brokers: emphasize they are largely invisible and mostly unregulated in most of the world — a person can be profiled by a data broker they've never heard of and never interacted with directly, based entirely on data purchased from other companies.
Push slightly further on the mechanism behind third-party cookies for a class that's engaged: when you visit a website that includes, say, an embedded ad or a "share" button from another company, that other company's server can often set or read its own cookie in the same browser session — which is how the same advertising network ends up recognizing you across dozens of otherwise unrelated sites. It's worth noting this specific mechanism has been changing: major browsers have been phasing out or restricting third-party cookies in recent years, which is a genuine, ongoing shift in how cross-site tracking works — not because tracking itself has stopped, but because the specific technique is being replaced by others, an arms-race dynamic worth naming honestly rather than presenting third-party cookies as a permanent, unchanging mechanism.
Cover the same practical habits (strong unique passwords, checking permissions, encryption, declining collection where possible) but add the legal dimension this age band's quiz requires: GDPR (the EU's General Data Protection Regulation) gives people the right to access what data a company holds on them, correct it, delete it, and object to being profiled by an automated system. Be precise that GDPR is EU law — it doesn't directly bind a company operating only in the Philippines, but many global platforms apply GDPR-level protections to all users because building two separate systems is often more expensive than building one to the stricter standard. Note that the Philippines has its own law, the Data Privacy Act (RA 10173), enforced by the National Privacy Commission, granting broadly similar rights locally.
This is a good place to name the actual reason GDPR-style protections matter specifically for AI, not just data collection in general: GDPR's right to object to automated profiling exists because AI-driven decisions (what price you're shown, what content you see, whether you're flagged as a risk) can meaningfully affect someone's life while being effectively invisible and unexplainable to the person affected. A right to know you're being profiled, and to push back on it, is a direct response to that specific problem — it wouldn't make as much sense as a legal right in a world without automated, data-driven decision-making at scale.
Introduce behavioral surplus carefully and correctly, since the quiz tests a precise definition: it refers to user data collected beyond what's actually needed to provide or improve the service, which gets used instead for prediction and monetization — the term comes from research on surveillance capitalism (Shoshana Zuboff), describing the gap between "data needed to make the product work" and "data collected because it's profitable."
Make the distinction concrete with an example students can check against their own experience: a navigation app needs your current location to give you directions — that's the minimum data required for the product to function. If that same app also logs and retains everywhere you've ever been, sells aggregated movement patterns to third parties, or uses your history to infer things like your income bracket or shopping habits, that additional collection is behavioral surplus — it goes beyond what the stated service required. The app still "works" without any of that extra collection; the extra collection exists because it's separately valuable, not because the navigation feature needs it.
This age band has its own quiz override, testing precise definitions rather than general awareness — each question has one clearly correct, technically specific answer.
Close with: "Every click, search, and scroll creates data. Understanding the surveillance economy — how it works and what rights exist within it — is what turns you from someone data collection just happens to, into someone who can actually push back on it." Add that laws like GDPR exist because enough people and regulators decided this needed rules, not because the technology made it inevitable — the legal landscape is still actively being written, including in the Philippines.
Extension activity: Have students pick one app they personally use and locate its actual privacy policy (usually linked from the app store listing or account settings). Have them find and quote the specific section describing what data is collected and who it may be shared with, then write a short paragraph in their own words summarizing it — and flag anything that surprised them. This turns an abstract topic into a concrete research task grounded in something they actually use.
For a class with more time, run a structured mini-debate: "Should Philippine law require the same rights as GDPR (access, deletion, objecting to profiling)?" Assign sides regardless of personal opinion, and require each side to cite at least one specific right or mechanism from the lesson (GDPR provisions, data broker practices, behavioral surplus) rather than general opinions about privacy. This forces engagement with the actual legal and technical vocabulary rather than a purely values-based argument.
A smaller optional add-on: have students look up whether their favorite app has ever appeared in a news story about a GDPR fine or CCPA enforcement action (a quick web search for "[app name] GDPR fine" is usually enough to find something, since enforcement actions against large platforms are widely reported). Have them summarize, in two or three sentences, what the company was found to have done and how much it cost them — a real number tends to make the abstract idea of "regulation with teeth" click in a way that reading about the law in the abstract does not.