The Big Idea

If someone asks you your first name, that's fine — everyone knows first names. If they ask your first name and what school you go to and what street you live on — now they know a lot more than you intended to share.

The lesson at ages 7–9 isn't "never share anything." It's this: information combines. One piece is usually fine. Multiple pieces together can give someone you've never met offline a lot of information about your real life.

This activity will help you understand which combinations are safe — and which ones to pause before sharing.

Same Information, Different Combinations

Here's how the same information can feel very different depending on what else is shared at the same time.

📋 Same facts — different combinations — different risk
"My name is Jordan."
First name only.
Usually fine
"I'm Jordan and I go to Riverside School."
Name + school.
Pause and think
"I'm Jordan, I go to Riverside School, and I walk home on Oak Street after 3:30."
Name + school + location + routine.
Protect this

Notice that Jordan never meant to share their whole daily schedule. But when pieces stack up, a picture forms that Jordan didn't intend to create.

What to Share, What to Protect

This isn't about secrets — it's about knowing which things belong to everyone and which things belong to your real life.

🔒 Protect these
  • Your full name (first + last together)
  • Your school name or teacher's name
  • Your home address or street
  • Your phone number
  • Your daily routine (where you go, when you're alone)
  • Passwords to any account

Biggest thing to remember: It's not one piece — it's combinations. First name alone is fine. First name + school + street is a lot.

If You Already Have Accounts

Many children in Grades 2–4 already play Roblox, Minecraft online, or use other apps where other people can see a profile or username. That's the reality — and this activity is for you too.

Don't have any accounts yet? That's fine too — this activity still applies. When you do set up an account someday, you'll already know what to keep private.

The Sorting Game

Read each scenario with your caregiver. For each one, talk about whether it's "Usually fine," "Pause and think," or "Protect this." There's no timer — take your time.

Mia uses "RocketMia22" as her username.
Can someone figure out her real name, age, or location from this?
Usually fine — display name, no real info
Sam's game profile says "Sam L., Grade 3, St. Thomas."
What does a stranger now know about Sam?
Protect this — name + grade + city is too much combined
Alex says their favourite show is about dinosaurs in an online fan group.
Does this help a stranger find Alex in real life?
Usually fine — a preference, no locating info
Jordan's bio says "I walk to Riverside School every morning at 8:15."
What could a stranger do with this information?
Protect this — school name + daily routine + time = too much
Chris says they're 8 years old in a kids' game chat.
Does this help a stranger find Chris in real life?
Pause and think — age alone is low risk, but avoid combining with other info
Maya's profile has her first name, province ("Ontario"), and a photo.
What does a stranger have now if they piece these together?
Pause and think — first name + province is often OK, but adding a photo raises the combination risk

Online-Only Friendships

Sometimes you meet people online — in a game, in a fan group, or in a comment section — who seem really friendly. Most of the time, that's just people being nice online. And it's OK to be friendly back.

💡 Good to know

Every now and then, someone online will try to become a trusted friend before asking for personal information. This doesn't mean everyone online is a stranger to be afraid of — the vast majority of online spaces are fine. But it's one reason the combination rule matters: share what's normal online, protect what belongs to your real life.

The simple test: "Would a stranger knowing this help them find me in real life?" If yes — that's something to protect. If no — you're probably fine.

Talk About It Together

There are no wrong answers — just interesting ones.

Signs It's Working

🧑‍🤝‍🧑 Caregiver Notes & Sources

What this activity builds

The "combination rule" is a developmentally appropriate upgrade from the 4-6 age band's binary "share / don't share" framework. Children aged 7–9 are capable of understanding that context modulates risk — this is the foundational skill for all digital privacy reasoning they'll need as they get older.

Acknowledging account reality

Vera (Privacy & Compliance) — At age 7-9, many children already have active accounts on Roblox, gaming platforms, and YouTube despite platform age limits. This module must acknowledge that reality honestly. "If you have any apps or games where people can see your profile..." is more honest and more actionable than "when you someday have an account." Children who already have accounts will engage more deeply with an activity that speaks to their current situation. Also: any awareness of the stranger-posing-as-peer dynamic must be framed carefully to create vigilance without creating blanket fear of online interaction — most online spaces are safe, most online people are benign.

The combination lesson

Dr. Lena (Child Development) — Context-dependency is the key cognitive shift at ages 7-9 that wasn't present at 4-6. Piaget's concrete operational stage means children can now hold multiple variables simultaneously and understand that the same piece of information has different implications depending on what accompanies it. Use a specific worked example: full name alone is different from full name + school + photo together. Without a concrete example, the rule remains abstract and won't transfer to new situations.

Variant prompts for group settings

Frank (Library & Frontline Practitioner) — Library programmes will encounter a mix of children who have accounts and those who don't. Both groups should feel included and relevant. The variant prompts ("If you have an account..." / "When you do have one...") ensure no child feels excluded from the exercise. Facilitators should avoid asking children to name specific platforms they use — keep it generic.

Avoiding overcorrection

Privacy activities at this age can produce one of two failure modes: children who share everything, or children who are afraid of all online interaction. Neither is the goal. The "combination rule" thread throughout this activity is designed to produce nuanced judgment — most things are fine to share; certain combinations create risk.

Sources