"Don't share your password" isn't a curriculum
Most online safety teaching still leans on messages written for a different internet: don't share passwords, don't talk to strangers, think before you post. All still true — and nowhere near enough. The students in front of you are dealing with AI-generated images, deepfakes, fake accounts, sextortion scams and manipulative influencer content, and those threats change faster than any scheme of work. A scam format can spread across TikTok in a weekend; a lesson written last year can already feel like history to a Year 10.
That pace problem is now baked into the statutory expectations. The DfE's updated RSHE guidance, published in July 2025 and compulsory from 1 September 2026, names today's risks explicitly — which means online safety lessons at KS3 and KS4 need to be current, specific and practical, not an annual assembly and a poster.
What the 2026 RSHE guidance expects secondary schools to cover
The updated statutory guidance on Relationships Education, Relationships and Sex Education (RSE) and Health Education replaces the 2019 version. For the first time it names specific online harms that secondary pupils should be taught about:
What a good online safety lesson looks like
Whether you build your own lessons or buy them in, the same tests apply. Students switch off the moment content feels dated or preachy — and non-specialist staff need materials that don't assume a computing degree.
Current, not historical
Practice, not lecture
Teach the real tells
Deliverable by non-specialists
Safe by design
Leaves evidence behind
Sequencing across KS3 and KS4
With fixed age brackets gone from the guidance, the sequence is yours to design — but a flat pick-and-mix of activities isn't a curriculum. A workable shape: build the foundations and habits at KS3, then move to the higher-stakes, more adult territory at KS4 as students' online lives expand into money, relationships and independence.
Foundations and habits
- Digital footprint and privacy — what apps collect, what settings and permissions actually do
- Recognising scams: pressure, urgency and the ask — and the go-direct habit when a message includes a link (see our scam awareness guide)
- Fake accounts, impersonation and catfishing basics
- First principles of AI content: not everything that looks real is real
- Where to get help, and the habit of telling a trusted adult early
Higher stakes, sharper judgement
- Sextortion and non-consensual image sharing — the law, the playbook scammers use, and what to do if it happens (see our sextortion guide for schools)
- Deepfakes and AI-generated content in depth: how they're made, how they spread, how to verify (see our deepfakes teaching guide)
- Financial scams aimed at older teens — fake jobs, trading "opportunities", money muling
- Manipulative influencer content and online misogyny — reading the incentives behind the content
- Managing a digital footprint that now matters for work, college and beyond
Free activities you can put in front of a class this week
You don't need a subscription to try this approach. Cloak's free browser activities are login-free, work on any device and take 5–15 minutes — built as lesson starters and tasters, each mapped to named curriculum content. Spot the Fake and Would You Click? drop students straight into make-the-call practice on fake profiles and scam messages.
For the "current, not historical" test, the On the Radar page tracks scams aimed at UK teens right now — human-reviewed and updated as new formats emerge. It works as a ready-made discussion starter: what's the pressure, what's the ask, what would you do?
Go deeper
Interactive online safety lessons sequenced across KS3 and KS4, a lesson plan with objectives and teacher notes on every lesson, and a dashboard that records what was taught — offered as a per-school annual subscription.
Explore Cloak for Schools → Register interest →