All activities Student learning
Teams read an AI study app's privacy policy like investigators, map where their data could travel, and choose settings and habits that shrink their trail.
Every app and AI tool students use collects something: what they type, where they are, how long they look, who they talk to. Privacy policies explain much of it, but they are long and written for lawyers. In this audit, teams decode a realistic mock privacy policy for a fictional AI study app, trace how a single data point can travel from the app to partners and data brokers, and then audit a tool they actually use. They leave with a short, evidence-based plan for what to share, what to change in settings, and what to stop typing into chatbots.
Hook
Ask students to list silently, on scrap paper they will keep, everything they've typed, searched, clicked, or asked an AI tool since waking up. Give 90 seconds. Then ask: "Which of those would you be uncomfortable seeing on a billboard? Which of those did an app keep?" Say: "Most of us don't know the answer to the second question. Today we find out how to check."
Facilitator noteKeep the lists private. The point is noticing volume and sensitivity, not sharing.
Model
Project Handout A. Model the four investigator questions on the first section: What do they collect? Why? Who else gets it? What can I control? Highlight in green what seems fine and expected, yellow what you'd want to know more about, and red what worries you. Think aloud about vague words: "may share," "trusted partners," "improve our services." Ask: "What does 'improve our services' mean for a chat you had with an AI study tool?"
Facilitator notePoint out that "improve our services" in an AI tool can include using conversations to train or evaluate models. Some policies allow users to opt out, some don't, and some don't say. Not saying is itself a finding.
Explore
Teams finish highlighting Handout A and complete the StudyNest row of Handout C, quoting the exact words that answer each investigator question. Then each team gives StudyNest a trust rating (green, yellow, red) and one sentence of reasoning. Circulate and push for quotes: "Show me the words that tell you that."
Facilitator noteSection 5 ("de-identified data") and Section 7 ("business transfers") are the most commonly missed. Point teams to them if they finish early.
Explore
Teams lay out the Data Trail Cards in order to tell the story of one piece of data, from a student typing a question into StudyNest to an ad that follows them on another site. They read each card, arrange the hops, and then flip them to check the explanation on the back. Explain data brokers plainly: companies that collect information about people from many sources, combine it into profiles, and sell or license those profiles, often without the people ever knowing the broker exists.
Facilitator noteAvoid claims about how many brokers exist or how much data they hold. The mechanism, not a number, is what students need.
Apply
Each team opens the privacy policy for a tool the class uses (from your bookmarked list) and completes the second row of Handout C with quoted language. Teams also look for any settings page for data use, chat history, or model training, and note what options exist. Unplugged option: print the first two pages of a real policy for a school-approved tool, or have teams audit the policy sections on Handout A they didn't finish.
Facilitator noteIf a team finds a school-approved tool has a clause they rate red, treat it as useful feedback. Collect those findings to share with your technology department.
Reflect
Each student writes a three-part plan on the back of Handout C: one setting I will check or change (on my own device, privately), one thing I will never type into an AI tool (for example, full name plus school, health details, passwords, a friend's personal information, or photos of other people), and one question I'd ask a company about its policy. Invite volunteers to share their "never type" rule, and build a class list on the board.
Facilitator noteLook for specific rules ("I won't paste my college essay with my name and address into a chatbot") rather than general ones ("be careful online").
Run the StudyNest audit and the Data Trail Cards entirely on paper. For the "real tool" round, print the first pages of a school-approved tool's privacy policy in advance. Students write their data plans on paper and check their own settings at home.
Teams open real privacy policies in a browser and use search-in-page for words like "share," "partners," "train," "retain," and "delete" to jump to key clauses, then paste quotes into a shared version of Handout C. Students may check settings on their own devices privately; never ask them to show or screenshot personal settings. If an approved AI tool is available to students 13+, teams can ask it to summarize a policy and then check the summary against the actual text, which often reveals what summaries leave out.
Does it need a screen? Searching a real policy for key words and finding the actual settings page turns an abstract warning into a skill students can repeat on any app. The evidence is a quote they found and a setting they located, not a slogan about being careful.
What you should be able to see or collect if it worked.
Students decode a mock privacy policy, quote the exact wording on collection and sharing, and trace data to brokers, core privacy-and-security work in digital citizenship.
Before using any new app or AI tool this semester, students run the four investigator questions and jot the answers in their notes. At home, students can use the same questions with family on one app everyone uses.
