# data[].attributes.attachment_link.description
This page is for parents - if you are a teacher, click here

# data[].attributes.attachment_link.readable_text
Skip to main content

Cookies on GOV.UK

We use some essential cookies to make this website work.

We'd like to set additional cookies to understand how you use GOV.UK, remember your settings and improve government services.

We also use cookies set by other sites to help us deliver content from their services.

You have accepted additional cookies. You can change your cookie settings at any time.

You have rejected additional cookies. You can change your cookie settings at any time.

Accept additional cookies Reject additional cookies View cookies

Statutory guidance for schools and colleges on safeguarding children and safer recruitment.

Details

This guidance applies to all schools and colleges and is for:

headteachers, teachers and staff

governing bodies, proprietors and management committees

It sets out the legal duties you must follow to safeguard and promote the welfare of children and young people under the age of 18 in schools and colleges.

All school and college staff should read part 1 of this guidance. Part 1 of the guidance is also available as a standalone document.

Statutory guidance sets out what schools must do to comply with the law.

Where the guidance states schools and colleges should do something, you should follow this unless you have a good reason not to.

'Regulated activity in relation to children: scope' describes work that a barred person must not do. We have also published guidance on disqualification under the Childcare Act 2006.

# data[].attributes.attachment_link.description
Statutory guidance for schools and colleges on safeguarding children and safer recruitment.

# data[].attributes.attachment_link.readable_text
This non-statutory guidance outlines how schools can ensure their pupils understand how to stay safe and behave online as part of existing curriculum requirements.

It complements existing subjects including:

There are no additional teaching requirements.

This guidance is for school leaders, school staff and governing bodies. It applies to all local-authority-maintained schools, academies and free schools.

Independent schools and non-maintained special schools may also find this guidance helpful as they are required to teach relationships education, relationships and sex education, and health education.

Introduction

Today's pupils are growing up in an increasingly complex world, living their lives seamlessly on and offline. This presents many positive and exciting opportunities, but also challenges and risks.

We want schools to equip their pupils with the knowledge needed to make the best use of the internet and technology in a safe, considered and respectful way, so they are able to reap the benefits of the online world.

This advice brings together information that will help schools deliver online safety content within their curriculum and embed this within their wider whole school approach.

Refer to the education for a connected world framework for age-specific advice about the online knowledge and skills that pupils should have the opportunity to develop at different stages of their lives.

Curriculum context

As part of the statutory relationships and health education in primary schools and relationships, sex and health education in secondary schools, pupils are taught about online safety and harms. This includes being taught:

Throughout these subjects, teachers will address online safety and appropriate behaviour in an age-appropriate way that is relevant to their pupils' lives.

This complements the computing curriculum, which covers the principles of online safety at all key stages, with progression in the content to reflect the different and escalating risks that pupils face. This includes:

how to use technology safely, responsibly, respectfully and securely

where to go for help and support when they have concerns about content or contact on the internet or other online technologies

There are also other curriculum subjects which include content relevant to teaching pupils how to use the internet safely. For example, citizenship education explores:

Educate Against Hate has a full teaching pack dedicated to fundamental British values that includes class tasks, a class presentation, films and teaching guidance.

You should consider what you are already delivering through the curriculum, and build in additional teaching as required to make sure pupils know how to stay safe and how to behave online.

Underpinning knowledge and behaviours

The online world develops and changes at a great speed. New opportunities, challenges and risks are appearing all the time. This can make it difficult for schools to stay up to date with the latest devices, platforms, apps, trends and related threats.

It is important to focus on the underpinning knowledge and behaviours that can help pupils to navigate the online world safely and confidently regardless of the device, platform or app. This teaching could be:

Teaching must always be age and developmentally appropriate.

How to evaluate what they see online

Covering this content will enable pupils to make judgements about what they see online and not automatically assume that what they see is true, valid or acceptable.

You can help pupils to consider:

whether a website, URL or email is fake

what cookies do and what information they are sharing

if a person or organisation is who they say they are

why a person wants them to see, send or believe something

why a person wants their personal information

the reason why something has been posted

whether something they see online is fact or opinion

How to recognise techniques used for persuasion

Covering this content will enable pupils to recognise the techniques that are often used to persuade or manipulate others.

You can help pupils to recognise:

Online behaviour

Covering this content will enable pupils to understand what acceptable and unacceptable online behaviour look like. You should teach pupils:

that the same standard of behaviour and honesty apply on and offline, including the importance of respect for others

to recognise unacceptable behaviour in others

You can help pupils to recognise acceptable and unacceptable behaviour by:

looking at why people behave differently online, for example how anonymity (you do not know me) and invisibility (you cannot see me) affect what people do

looking at how online emotions can be intensified resulting in mob mentality

looking at the key principles behind a constructive discussion, including a willingness to listen to other opinions and a readiness to be educated on a topic

considering how to demonstrate empathy towards others (on and offline)

teaching techniques (relevant on and offline) to defuse or calm arguments, for example, a disagreement with friends, and disengage from unwanted contact or content online

considering unacceptable online behaviours often passed off as so-called social norms or just banter, for example, negative language being used as part of online gaming but would never be tolerated offline

How to identify online risks

Covering this content will enable pupils to identify possible online risks and make informed decisions about how to act. This should not be about providing a list of what not to do online. The focus should be to help pupils assess a situation, think through the consequences of acting in different ways and decide on the best course of action.

You can help pupils to identify and manage risk by discussing:

How and when to seek support

Covering this content will enable pupils to understand safe ways in which to seek support if they are concerned or upset by something they have seen online.

You can help pupils by explaining how to:

You should link this to wider school policies and processes around reporting of safeguarding and child protection incidents and concerns to school staff. Refer to keeping children safe in education for more information.

The online media literacy strategy sets out that the government will give internet users the knowledge and skills they need to make informed and safe choices online.

It sets out 5 principles to underpin delivery of media literacy education. These include understanding:

A list of media literacy resources for teachers and parents is available.

Teaching about harms and risks

Understanding and applying knowledge and behaviours will provide pupils with a solid foundation to navigate the online world in an effective and safe way. By understanding the risks that exist online, you can tailor your teaching and support to the specific needs of your pupils.

This section will help you understand some of the issues your pupils may be facing and where these could be covered within the curriculum. You should consider when it might be appropriate to cover these individual harms and risks.

Any activity that does look at individual harms and risks should be considered in the broader context of providing the underpinning knowledge and behaviours.

This section covers various technical aspects of the internet that could leave pupils vulnerable if not understood.

Age-specific advice on these potential harms and risks can be found in the following sections of the education for a connected world framework:

Age restrictions

Some online activities have age restrictions because they include content which is not appropriate for children under a specific age.

Teaching could include:

You could cover this content in the following curriculum areas:

How content can be used and shared

Knowing what happens to information, comments or images that are put online.

Teaching could include:

what a digital footprint is, how it develops and how it can affect future prospects such as university and job applications

how cookies work

how content can be shared, tagged and traced

how difficult it is to remove something a user wishes they had not shared

the risk of identity theft or targeted approach from fraudsters using information shared online

ensuring pupils understand what is illegal online, for example:

youth-produced sexual imagery (sexting)

sharing illegal content such as extreme pornography or terrorist content

the illegality of possession, creating or sharing any explicit images of a child even if created by a child

You could cover this content in the following curriculum areas:

Disinformation, misinformation, malinformation and hoaxes

Some information shared online is accidentally or intentionally wrong, misleading, or exaggerated.

Teaching could include:

disinformation and why individuals or groups choose to share false information in order to deliberately deceive

misinformation and being aware that false and misleading information can be shared inadvertently

malinformation and understanding that some genuine information can be published with the deliberate intent to harm, for example releasing private information or photographs (including revenge porn)

online hoaxes, which can be deliberately and inadvertently spread for a variety of reasons

explaining that the viral nature of this sort of content can often appear to be a stamp of authenticity and therefore why it is important to evaluate what is seen online

how to measure and check authenticity online

the potential consequences of sharing information that may not be true

You could cover this content in the following curriculum areas:

Fake websites and scam emails

Fake websites and scam emails are used to extort data, money, images and other things that can either be used by the scammer to harm the person targeted or sold on for financial, or another gain.

Teaching could include:

You could cover this content in the following curriculum areas:

Fraud (online)

Fraud can take place online and can have serious consequences for individuals and organisations.

Teaching could include:

what identity fraud, scams and phishing are

explaining that online fraud can be highly sophisticated and that anyone can be a victim

how to protect yourself and others against different types of online fraud

how to identify 'money mule' schemes and recruiters

the risk of online social engineering to facilitate authorised push payment fraud, where a victim is tricked into sending a payment to the criminal

the risk of sharing personal information that could be used by fraudsters

explaining that children are sometimes targeted to access adults' data, for example, passing on their parent or carer's bank details, date of birth or national insurance number

what good companies will and won't do when it comes to personal details, for example, a bank will never ask you to share a password or move money into a new account

how to report fraud, phishing attempts, suspicious websites and adverts

You could cover this content in the following curriculum areas:

Password phishing

Password phishing is the process by which people try to find out your passwords so they can access protected content.

Teaching could include:

You could cover this content in the following curriculum areas:

relationships education core content (all stages) - online relationships topic

computing (all key stages)

Personal data

Online platforms and search engines gather personal data. This is often referred to as 'harvesting' or 'farming'.

Teaching could include:

You could cover this content in the following curriculum areas:

Persuasive design

Many devices, apps and games are designed to keep users online for longer than they might have planned or desired.

Teaching could include:

explaining that the majority of games and platforms are businesses designed to make money - their primary driver is to encourage users to be online for as long as possible to encourage them to spend money (sometimes by offering incentives and offers) or generate advertising revenue

how designers use notifications to pull users back online

You could cover this content in the following curriculum areas:

health education core content (all stages) - internet safety and harms topic

computing (all key stages)

Privacy settings

Almost all devices, websites, apps and other online services come with privacy setting that can be used to control what is shared.

Teaching could include:

how to find information about privacy setting on various sites, apps, devices and platforms

explaining that privacy settings have limitations, for example, they will not prevent someone posting something inappropriate

You could cover this content in the following curriculum areas:

relationships education core content - online relationships topic

computing (all key stages)

Targeting of online content (including on social media and search engines)

Much of the information seen online is a result of some form of targeting.

Teaching could include:

You could cover this content in the following curriculum areas:

How to stay safe online

This section covers elements of online activity that could adversely affect a pupil's personal safety or the personal safety of others online.

Age-specific advice on these potential harms and risks can be found in the following sections of the education for a connected world framework:

Abuse (online)

Some online behaviours are abusive. They are negative in nature, potentially harmful and in some cases can be illegal.

Teaching could include:

You could cover this content in the following curriculum areas:

Online radicalisation

Children, young people and adult learners are at risk of accessing inappropriate and harmful extremist content online. This could include downloading or sharing terrorist material, which could be a criminal act.

The internet and social media make spreading divisive and hateful narratives easier. Extremist and terrorist groups and organisations use social media (for example, apps, forums, blogs, chat rooms) to identify and target vulnerable individuals.

Teaching could include:

All education settings have a responsibility under the Prevent duty. This includes building your students' resilience to extremism and ensuring staff are adequately trained to spot the signs of radicalisation.

Guidance, teaching resources and tools to help you teach young people about extremism, radicalisation and staying safe online are available on Educate Against Hate.

Challenges

Online challenges acquire mass followings and encourage others to take part in what they suggest.

Teaching could include:

You could cover this content in the following curriculum areas:

Content which incites

Knowing that violence can be incited online and escalate very quickly into offline violence.

Teaching could include:

You could cover this content in the following curriculum areas:

Fake profiles

Not everyone online is who they say they are.

Teaching could include:

explaining that in some cases profiles may be people posing as someone they are not (such as an adult posing as a child) or may be bots (which are automated software programs designed to create and control fake social media accounts)

how to look out for fake profiles, for example:

profile pictures that don't like right, for example, of a celebrity or object

accounts with no followers or thousands of followers

a public figure who doesn't have a verified account

You could cover this content in the following curriculum areas:

relationships education core content (all stages) - online relationships topic

computing (all key stages)

Grooming

Knowing about the different types of grooming and motivations for it, for example:

Teaching could include:

See the National Crime Agency's think u know website for further information on keeping children safe from sexual abuse and exploitation.

At all stages it will be important to balance teaching children about making sensible decisions to stay safe whilst being clear it is never the fault of a child who is abused and why victim blaming is always wrong.

You could cover this content in the following curriculum areas:

Live streaming

Live streaming (showing a video of yourself in real-time online either privately or to a public audience) can be popular with children but it carries risk when carrying it out and watching it.

Teaching could include:

You could cover this content in the following curriculum areas:

relationships education core content (all stages) - online relationships topic

health education core content (secondary) - internet safety and harms topic

Pornography

Knowing that sexually explicit material presents a distorted picture of sexual behaviours.

Teaching could include:

You could cover this content as part of the relationships and sex education core content (secondary), online and media topic.

Unsafe communication

Knowing different strategies for staying safe when communicating with others, especially people they do not know or have never met.

Teaching could include:

You could cover this content in the following curriculum areas:

Wellbeing

This section covers the elements of online activity that can adversely affect a pupil's wellbeing.

Age-specific advice on these potential harms and risks can be found in the following sections of the education for a connected world framework:

Impact on confidence (including body confidence)

Knowing about the impact of comparisons to 'unrealistic' online images.

Teaching could include:

You could cover this content as part of the health education core content (secondary), internet safety and harms topic.

Impact on quality of life, physical and mental health and relationships

Knowing how to identify when online behaviours stop being fun and begin to create anxiety, including that there needs to be a balance between time spent on and offline.

Teaching could include:

helping pupils to evaluate critically what they are doing online, why they are doing it, and for how long (screen time)

helping pupils to consider quality versus quantity of online activity

explaining that pupils need to consider if they are actually enjoying being online or just doing it out of habit, due to peer pressure or the fear of missing out

helping pupils to understand that time spent online gives users less time to do other activities - this can lead to some users becoming physically inactive

exploring the impact that excessive social media usage can have on levels of anxiety, depression and other mental health issues

explaining that isolation and loneliness can affect pupils and that it is very important for pupils to discuss their feeling with an adult and seek support

where to get help

You could cover this content as part of the health education core content (secondary), internet safety and harms topic.

Online versus offline behaviours

People can often behave differently online to how they would act face to face.

Teaching could include:

how and why people can often portray an exaggerated picture of their lives (especially online) and how that can lead to pressure

discussing how and why people are unkind or hurtful online, when they would not necessarily be unkind to someone face to face

You could cover this content as part of the relationships education core content (all stages), online relationships topic.

Reputational damage

What users post can affect future career opportunities and relationships - both positively and negatively.

Teaching could include:

looking at strategies for positive use

how to build a professional online profile

You could cover this content as part of the relationships and sex education core content (secondary), online and media topic.

Suicide, self-harm and eating disorders

Pupils may raise topics including eating disorders, self-harm and suicide. Teachers must be aware of the risks of encouraging or making these seem a more viable option for pupils and should take care to avoid giving instructions or methods and avoid using emotive language, videos or images.

Guidance on teaching about mental health and emotional wellbeing provides useful support for teachers in handling this material.

Vulnerable pupils

Any pupil can be vulnerable online, and their vulnerability can fluctuate depending on their age, developmental stage and personal circumstance.

However, there are some pupils, for example, looked after children and those with special educational needs, who may be more susceptible to online harm or have less support from family or friends in staying safe online. You should consider how you tailor your offer to make sure these pupils receive the information and support they need.

The following resources can help schools consider how best to support their most vulnerable pupils stay safe online:

Use of external resources

Schools are best placed to make their own decisions about which resources are educationally appropriate for their pupils. This includes reviewing resources, even when from a trusted source, as some will be more appropriate to their cohort of pupils than others.

Before using any resource, you should check:

Use of external visitors

Online safety can be a difficult and complex topic which changes very quickly. Therefore, schools may want to seek external support who have expertise, up to date knowledge and information.

The right external visitors can provide a useful and engaging approach to deliver online safety messages, but this should enhance a school's offer rather than be delivered in isolation.

Guidance for schools on using external visitors to support online safety education is available.

Safeguarding

As with any safeguarding lessons or activities, it is important that schools consider the topic they are covering and the potential that a child (or more than one child) in the class may be suffering from online abuse or harm in this way.

It is important to create a safe environment in which pupils feel comfortable to say what they feel. If a pupil thinks they will get into trouble or be judged for talking about something which happened to them online they may be put off reporting it and getting help.

Where schools are already aware of a child who is being abused or harmed online they should carefully plan any lesson to consider this, including not drawing attention to that child in a way that would highlight or publicise the abuse. It is good practice to include the designated safeguarding lead (or a deputy) when planning any safeguarding related lessons or activities (including online). They will be best placed to reflect and advise on any known safeguarding cases, and how to support any pupils who may be especially impacted by a lesson.

In some cases, a pupil will want to make a disclosure following a lesson or activity. The lesson may have provided the knowledge that enabled the pupils to realise they are being abused or harmed or give them the confidence to say something. This is why it is essential all pupils are clear what the school's reporting mechanisms are.

As per keeping children safe in education your reporting mechanisms should be child friendly and operate with the best interests of the pupil at their heart.

Whole school approach

Whole school approaches are likely to make teaching more effective than lessons alone. A whole school approach is one that goes beyond teaching to include all aspects of school life, including:

We recommend that schools embed teaching about online safety and harms within a whole school approach.

Incorporating the principles of online safety across all elements of school life

You should reflect the principles of online safety in the school's policies and practice where appropriate, and communicate this with staff, pupils and parents. This could include, for example:

having clear processes for reporting incidents or concerns in the child protection policy

reflecting online behaviours in the school's behaviour and bullying policies

Keeping children safe in education provides advice for schools on embedding online safety into their broader safeguarding and child protection approach.

Pupils should be just as clear about what is expected of them online as offline.

Engaging staff, pupils, parents and carers

Proactively engage staff, pupils, parents and carers in school activities that promote the agreed principles of online safety. This could include, for example:

co-designing programmes to reflect any emerging issues parents and pupils are hearing about or facing online

peer-to-peer support - consider implementing a scheme which supports pupils to help their peers stay safe online

Reviewing and maintaining the online safety principles

This includes making sure that school staff have access to up to date appropriate training and resources so that they are confident in covering the required content in a way that is relevant to their pupils' lives.

It could also include using information available to the school to review practices and ensure the issues facing their pupils are covered in a timely manner.

Embedding the online safety principles

Reinforce what is taught in lessons by taking appropriate and consistent action when a pupil:

makes a report of unacceptable online behaviours from another pupil, including cyberbullying

shares a concern about something they have seen online

Modelling the online safety principles consistently

This includes expecting the same standards of behaviour whenever a pupil is online at school - be it in class, logged on at the library or using their own device in the playground.

Schools should also ensure they extend support to parents, so they are able to incorporate the same principles of online safety at home.

Further sources of information

This list provides links to relevant government guidance and a range of national organisations who can offer support to schools.

Related guidance is available on:

Support and resources are also available from:

Schools can also get advice from national organisations such as:

You can refer parents to the following national organisations for support:

You can refer pupils to the following national organisations for support:

# data[].attributes.attachment_link.description
This non-statutory guidance outlines how schools can ensure their pupils understand how to stay safe and behave online as part of existing curriculum requirements. It complements existing subjects including: There are no additional teaching requirements. This guidance is for school leaders, school staff and governing bodies.

# data[].attributes.attachment_link.title
LGfL Safeguarding - Keeping Children Safe | LGFL

# data[].attributes.attachment_link.description
The SafeguardEd team within LGfL are here to help schools with all matters to do with safeguarding children, both online and offline. The SafeguardEd service is predominantly free to all schools, and offers a wide range of support including, extensive safeguarding training delivered by leading experts, policy guidance and templates and quality-assured resources for staff, parents and carers to help.

# data[].attributes.attachment_link.title
Search LGfL safeguarding and online safety resources | LGFL

# data[].attributes.attachment_link.description
Registered Address: ​9th Floor, 10 Exchange Square, Primrose Street, London, EC2A 2BR. London Grid for Learning Trust - a charity whose mission is the advancement of Education. A company limited by guarantee registered in England no 4205579 Reg charity no 1090412.

# data[].attributes.attachment_link.readable_text
Skip to main content

Cookies on GOV.UK

We use some essential cookies to make this website work.

We'd like to set additional cookies to understand how you use GOV.UK, remember your settings and improve government services.

We also use cookies set by other sites to help us deliver content from their services.

Accept additional cookies Reject additional cookies View cookies

Guidance on responding to incidents and safeguarding children and young people

Applies to England

Documents

Details

This non-statutory advice aims to support designated safeguarding leads (or equivalents) and senior leadership teams in education settings in England in responding effectively to incidents involving the sharing of nudes and semi-nudes.

It includes guidance on:

risk assessing incidents

safeguarding and supporting children and young people

handling devices and imagery

recording incidents, including the role of other agencies

providing education on the sharing of nudes and semi-nudes

This advice is non-statutory and should be read alongside the Department for Education's:

A one-page summary of how to respond to incidents is also available for all members of staff in education settings.

Thank you for your feedback

Report a problem with this page

# data[].attributes.attachment_link.title
Sharing nudes and semi-nudes: advice for education settings working with children and young people

# data[].attributes.attachment_link.description
Skip to main content We use some essential cookies to make this website work. We'd like to set additional cookies to understand how you use GOV.UK, remember your settings and improve government services. We also use cookies set by other sites to help us deliver content from their services.

# data[].attributes.attachment_link.readable_text
Cookies on GOV.UK

We use some essential cookies to make this website work.

We'd like to set additional cookies to understand how you use GOV.UK, remember your settings and improve government services.

We also use cookies set by other sites to help us deliver content from their services.

You have accepted additional cookies. You can change your cookie settings at any time.

You have rejected additional cookies. You can change your cookie settings at any time.

Accept additional cookies Reject additional cookies View cookies

Skip to main content

How schools can prohibit the use of mobile phones throughout the school day.

Details

This guidance explains how to develop, implement and maintain a policy that prohibits the use of mobile phones in school. It should be read alongside the guidance on:

It is for:

multi-academy trusts

trust boards and proprietors

governing bodies

school leaders and staff

local authorities

It applies to all:

maintained schools

academies

free schools

non-maintained special schools

independent schools

# data[].attributes.attachment_link.description
How schools can prohibit the use of mobile phones throughout the school day.

# data[].attributes.attachment_link.readable_text
The importance of meeting the standard

Properly configured firewalls prevent many attacks. They also make scanning for suitable hacking targets much harder.

How to meet the standard

Ask your IT service provider to set up your devices to meet the standards described in the technical requirements.

Agree with your IT service provider a system for monitoring logs and documenting decisions made on inbound traffic.

Your IT service provider may be a staff technician or an external service provider.

Remember that this standard may change over time with changing cyber threats.

You are free to choose any suitable firewall.

Technical requirements to meet the standard

To meet this standard you must:

protect every device with a correctly configured boundary, or software firewall, or a device that performs the same function

change the default administrator password, or disable remote access on each firewall

protect access to the firewall's administrative interface with multi-factor authentication (MFA), or a small specified IP-allow list combined with a managed password, or prevent access from the internet entirely

keep firewall firmware up to date

check monitoring logs as they can be useful in detecting suspicious activity

block inbound unauthenticated connections by default

document reasons why particular inbound traffic has been permitted through the firewall

review reasons why particular inbound traffic has been permitted through the firewall often, change the rules when access is no longer needed

enable a software firewall for devices used on untrusted networks, like public wi-fi

Dependencies to the standard

See our broadband internet standards.

When to meet the standard

You should already be meeting this standard for the security of your networks. If you are not already meeting this standard you should make it a priority to review each device in your network.

The importance of meeting the standard

Security systems are sometimes disabled to make very marginal improvements to user experience. This is an unjustifiable risk calculation in most circumstances.

Attackers scan for and exploit devices where the security features are not enabled. Using the security features that devices already have is the most basic form of cyber security.

Attackers who gain physical access to a network device can exploit a system much more easily, so this should be prevented.

Recording network devices helps schools keep networks up-to-date and speeds up recovery.

How to meet the standard

Network devices include routers, switches, access points, servers and similar items.

Ask your IT service provider to record and set up your devices and boot up systems to meet the technical requirements.

Agree with your IT service provider a system for recording and reviewing decisions made about network security features.

Your IT service provider may be a staff technician or an external service provider.

Remember that this standard may change over time with changing cyber threats.

The National Cyber Security Centre has published guidance on:

Technical requirements to meet the standard

To meet this standard you must:

keep a register, list, or diagram of all the network devices

avoid leaving network devices in unlocked or unattended locations

remove or disable unused user accounts, including guest and unused administrator accounts

change default device passwords

require authentication for users to access sensitive school data or network data

remove or disable all unnecessary software according to your organisational need

disable any auto-run features that allow file execution

set up filtering and monitoring services to work with the network's security features enabled

immediately change passwords which have been compromised or suspected of compromise

protect against a brute-force attack on all passwords by allowing no more than 10 guesses in 5 minutes, or locking devices after no more than 10 unsuccessful attempts

If network devices have conflicting security features, document the decisions you make on which security features have been enabled or disabled on your network. Review this document when you change these decisions.

To physically access switches and boot-up settings use a password or PIN of at least 6 characters. The password or PIN must only be used to access this device.

For all other devices, you must enforce password strength at the system level. If you use a deny list for automatic blocking of common passwords, use a password with at least 8 characters. If you do not use a deny list, use a password with at least 12 characters or a biometric test.

Password manager software is recommended.

The National Cyber Security Centre provides detailed guidance on:

Dependencies to the standard

See our standards on network switching.

When to meet the standard

You should already be meeting this standard.

The importance of meeting the standard

Successful cyber attacks target user accounts with the widest access and highest privileges on a network.

You must limit the numbers and access of network and global administrative accounts.

If you prevent and limit the compromise of these accounts you prevent and limit successful cyber attacks.

How to meet the standard

Ask your IT service provider or network manager to set up accounts to meet the technical requirements. If a single staff member controls account access, another senior school staff member or governor should approve that staff member's own account.

There must be a user account creation, approval and removal process. You should make this part of school joining and leaving protocols.

Your IT service provider may be a staff technician or an external service provider.

Remember that this standard may change over time with changing cyber threats.

Technical requirements to meet the standard

You must control user accounts and access privileges. Including accounts used by third parties, for example, support services or device management.

Only authorised people can have an account which allows them to access, alter, disclose or delete the held personal data. The data owner or controller, or the data protection officer, must identify and authorise these tasks.

Users should have a separate account for routine business, including internet access, if their main account:

is an administrative account

enables the execution of software that makes significant system or security changes

can make changes to the operating system

can create new accounts

can change the privileges of existing accounts

Users must be authenticated with unique credentials before they access devices or services. This can include using passwords.

You must enforce password strength at the system level.

If you use a deny list for automatic blocking of common passwords, use a password with at least 8 characters. If you do not use a deny list, use a password with at least 12 characters or a biometric test. The National Cyber Security Centre recommends using passwords made up of 3 random words. Enforce account lockouts after a number of failed attempts and require service provider or network manager permission to unlock.

The National Cyber Security Centre provides guidance on password administration for system owners.

You must immediately change any password that has been compromised or suspected of compromise.

You must remove unused accounts. This may include the accounts of users who have left their employment, or accounts that have not been used for a prolonged period of time. This is particularly important for accounts with administrator privileges. You should review this termly.

Unused role privileges must be removed or disabled.

No user's account should have more access to devices than required to carry out their role.

Use different accounts with specific rights for different purposes or have IT service providers and administrators enable just-in-time access, giving individual users time-limited privileges as required. The National Cyber Security Centre provides detailed guidance on privileged access management.

For younger children or users with special educational needs:

consider using authentication methods other than passwords

consider using a separate account accessed by the teacher rather than the student

segment the network so such accounts cannot reach sensitive data

consider if the data or service being accessed requires authentication

The NCSC offers this guidance on alternatives to passwords.

You should not use global administrator accounts for routine business.

You should only use accounts requiring administrator privileges to complete the tasks that need it.

You should use service accounts for running system services and not user accounts.

When to meet the standard

You should implement this standard as soon as you can and with the introduction of each new account.

The importance of meeting the standard

Multi-factor authentication only allows access to a service when you present 2 or more different forms of authentication. It reduces the possibility of an attacker compromising an account. This is especially important if an account has access to sensitive or personal data.

In this context, sensitive or personal data is all data that if lost or compromised, would have a serious impact on the establishment, staff or students.

The Information Commissioner's Office explains what personal data is.

How to meet the standard

Ask your IT service provider to set up the applicable users with the multi-factor authentication methods which meet the technical requirements.

You should provide training to users unfamiliar with multi-factor authentication.

The National Cyber Security Centre provides detailed guidance on:

Your IT service provider may be a staff technician or an external service provider.

Remember that this standard may change over time with changing cyber threats.

Technical requirements to meet the standard

Where practical, you must enable multi-factor authentication. This should always include cloud services for non-teaching staff. All staff are strongly encouraged to use multi-factor authentication.

Ask users for a second authentication factor when accessing sensitive data. For example, when moving from a lesson plan to financial or personal data.

Multi-factor authentication should include at least 2 of the following:

passwords constructed in the formats described earlier in standard 3

a managed device, that may belong to the organisation

an application on a trusted device

a device with a trusted network IP address, you should not use this in MFA for accounts with administrator rights or for accessing sensitive data

a physically separate token

a known/trusted account, where a second party authenticates another's credentials

a biometric test

When to meet the standard

You should implement this standard as soon as you can.

The importance of meeting the standard

Up-to-date anti-malware and anti-virus software reduces the risk from many forms of cyber attack.

Some applications protect against viruses and general malware, some against one only. You need to protect against both.

How to meet the standard

Ask your IT service provider to set up your devices to meet the technical requirements.

The National Cyber Security Centre publishes advice on antivirus and other security software.

Your IT service provider may be a staff technician or an external service provider.

Your school or college must organise the responsibilities and processes for risk-assessment, authorisation and documentation for any access to potentially malicious websites.

Remember that this standard may change over time with changing cyber threats.

Technical requirements to meet the standard

You must make sure anti-malware software and associated files and databases are kept up to date.

Make sure the anti-malware software:

is set up to scan files upon access, when downloaded, opened, or accessed from a network folder

scans web pages as they are accessed

prevents access to potentially malicious websites, unless risk-assessed, authorised and documented against a specific business requirement

Do not run applications or access data which has been identified as malware. Use the anti-malware software to eliminate the problem.

When to meet the standard

You should meet this standard as soon as you can.

The importance of meeting the standard

Applications can insert malware onto a network or have unintentional security weaknesses. This makes attacks easier to execute against a network.

Users should not download applications. The IT service provider should check them first.

How to meet the standard

Ask your IT service provider to set up your devices to meet the technical requirements. Agree how this will be done with your IT service provider and document how you have met the requirements.

The National Cyber Security Centre provides guidance on:

Your IT service provider may be a staff technician or an external service provider.

Remember that this standard may change over time with changing cyber threats.

Technical requirements to meet the standard

The IT service provider should approve all code and applications that are deployed and make sure they do not pose a security risk. They should do this in the best way possible given available resources.

Best practice is to maintain a current list of approved applications. Applications with invalid or no digital signatures should not be installed or used.

You could search the internet to check the reputation of the application and the hosting site, or run unknown applications or code within a sandbox environment.

Make sure the network's anti-malware service is scanning all downloaded applications.

When to meet the standard

You should meet this standard as soon as possible.

The importance of meeting the standard

Hackers try to identify and exploit the vulnerability that each new security update addresses. They try to do this before users are able to update their systems. In the last year, several attacks on educational establishments have taken advantage of this.

Unsupported software does not receive security updates and over time it becomes:

more vulnerable as methods of exploitation are discovered

less compatible with the security measures integrated into the network operating system

You must not use unlicensed hardware or software.

Unlicensed software may not be a legitimate copy, or it may not be updatable to the latest secure standards.

You must avoid or replace unpatched or unsupported hardware or software, including operating systems. These devices are the most popular targets for successful cyber attacks. If this is not possible, then these devices and software must not be accessible from the internet - so that scanning tools cannot find weaknesses.

How to meet the standard

Ask your IT service provider to make sure all devices and software are licensed, supported and set up to meet the technical requirements.

Subscribing to services rather than buying items can be a way to help achieve this. This is known as Software as a Service ( SaaS).

So that appropriate risk assessment and mitigation can take place, your IT service provider should tell leadership and governors at the school or college and alter the network accordingly when devices or software:

have become unsupported

are about to become unsupported

Your IT service provider may be a staff technician or an external service provider.

Remember that this standard may change over time with changing cyber threats.

The National Cyber Security Centre provides guidance on:

Technical requirements to meet the standard

All software must be currently licensed.

The licensing of most modern software can be checked through the software itself. Software which successfully updates can be presumed to be licensed. Older software may have to be researched.

You should remove unsupported software. If this is not possible then you must only use the software on parts of the network which prevent all traffic to and from the internet. Support does not have to come from the original manufacturer and can come from third parties as long as this does not invalidate a licence.

Unsupported devices must only access segmented areas of the network which do not grant access to sensitive data.

You must enable automatic updates.

You must complete manual updates to hardware or software, including configuration changes, within 14 days of the release of the patch where the vulnerability is:

described as high risk or worse

has a Common Vulnerability Scoring System (CVSSv3) score of 7 or above

The Common Vulnerability Scoring System is the security industry standard for measuring the danger of a vulnerability. The score is a number from 1 to 10 where 10 is the most dangerous. There is a more detailed explanation of CVSSv3 on the NVD website.

When notified by the Department for Education ( DfE), patches should be applied within 3 days of notification. This will only be done in instances of dangerous zero-day attacks where institutions are at immediate risk and there is a suitable patch available.

Dependencies to the standard

See our standards on network switching.

When to meet the standard

You should meet this standard as soon as possible.

The importance of meeting the standard

A backup is an additional copy of data, held in a different location, in case the original data is lost or damaged. If all copies were held in the same location, they would all be at risk from natural disasters and criminal damage.

Backups of important data are crucial for quick recovery in the event of disaster. The safest way to achieve this is to have a pattern of backing up on a rolling schedule. You should keep these backups off the network when not in use and check them regularly.

How to meet the standard

Ask your IT service provider to install and configure your devices to meet the standards described in the technical requirements. If your IT service provider is an external contractor, the scope of this should be included in your service agreement.

Be prepared to ask your service provider to explain what they are doing to help you achieve this standard. Including where the backups are located, how often they are done, how often they are checked and how long a restoration will take.

A school itself must determine which of its data is important to its operations but it is likely to include personal, financial, management and network data as a minimum.

The National Cyber Security Centre has published detailed guidance on:

Your IT service provider may be a staff technician or an external service provider.

Remember that this standard may change over time with changing cyber threats.

Technical requirements to meet the standard

You should have at least 3 backup copies of important data, on at least 2 separate devices. At least 1 of these copies must be off-site (on large sites, these copies should be far enough away to avoid dangers from fire, flood, theft and similar risks).

Remember, you need 3 backup copies, you do not need 3 storage locations or 3 storage devices. For example, 2 backups taken at different times on the same device (as long as they do not overwrite each other) will count as 2 of the 3 backup copies.

You should schedule backups regularly. How often you need to create backups depends on:

how often the data changes

how difficult the information would be to replace if the backups failed

At least 1 of the backups must be offline at all times. An offline backup is sometimes known as a cold backup.

A cloud backup is an off-site backup. Cloud data held in separated cloud services are held in separate devices.

If the offline backup is in the cloud, access must be:

by a secure account identity

impossible from any device unless an authorised user has logged on in person

Remember, off-site means in an alternative physical or digital location, offline means that is not connected to the network

The number of devices with these access permissions must be kept to an absolute minimum.

A secure account identity is defined as a specified account secured with a username and multi-factor authentication.

A device which cannot access the backup is defined as a device that has no valid credentials.

Where the cloud services allow it, set up the controls to:

only allow authorised devices to create new or appended backups

deny connection requests when backup is not in use

Regularly check that the backups work.

When to meet the standard

You should implement this standard as soon as you can.

The importance of meeting the standard

Being unprepared for a cyber attack can lead to poor decisions, slow recovery and expensive mistakes.

A good response plan made ahead of time will speed up your response, reduce stress levels and confusion.

Effective response will reduce the material, reputational and safeguarding damage from ransomware attacks.

How to meet the standard

Talk to your IT service provider and make sure you have a cyber attack contingency plan. The plan must be part of your business continuity and disaster recovery plan.

The school's governors should ensure the creation and testing of these plans. In multi-academy trusts, oversight might happen at trust level.

The National Cyber Security Centre provides advice on contingency planning:

To help with testing, they also provide an exercise kit.

As part of the Risk Protection Arrangement there is a template cyber response plan.

Your IT service provider may be a staff technician or an external service provider.

Remember that this standard may change over time with changing cyber threats.

Technical requirements to meet the standard

All schools and colleges must include a contingency plan for loss of some or all IT systems in their business continuity and disaster recovery plan. This is required by the schools financial value standard.

This plan must include:

staff responsibilities

out of hours contacts and procedures

internal and external reporting and communications plans

priorities for service restoration

the minimum operational IT requirements

where you can find additional help and resources

Keep hard copies of key information in case of total system failure.

Test and review these plans regularly.

When to meet the standard

You should meet this standard as soon as possible.

The importance of meeting the standard

Cyber attacks are crimes against a school that need to be investigated so perpetrators can be found and counter-measures identified.

A cyber attack is defined as an intentional and unauthorised attempt to access or compromise the data, hardware or software on a computer network or system. An attack could be made by a person outside or inside the school.

The National Cyber Security Centre define what a cyber incident is.

This compromise of data might include:

stealing the data

copying the data

tampering with the data

damaging or disrupting the data, or similar

unauthorised access

You should report any suspicious cyber incident to Action Fraud on 0300 123 2040 or on the Action Fraud website.

Police investigations may find out if any compromised data has been published or sold and identify the perpetrator.

How to meet the standard

Ask your IT service provider to notify the school leadership team of all cyber attacks. Appropriate action and information-sharing must be carried out in accordance with the General Data Protection Regulation (GDPR).

Where a data breach has or may have occurred, report to the Information Commissioner's Office ( ICO).

These incidents should also be reported to the DfE sector cyber team at Sector.Incidentreporting@education.gov.uk.

Academy trusts have to report these attacks to ESFA.

Exercise judgement in reporting. Incidents where any compromise may have taken place or other damage was caused should be reported. But receipt of a phishing email alone, for example, does not require reporting to DfE but can be reported to Action Fraud at report@phishing.gov.uk.

Where the incident causes long term school closure, the closure of more than 1 school or serious financial damage, you should also inform the National Cyber Security Centre.

Technical requirements to meet the standard

Schools and colleges must report cyber attacks to:

Where applicable schools and colleges must report cyber attacks to ICO.

You must act in accordance with:

When to meet the standard

You should implement this standard as soon as you can.

The importance of meeting the standard

The protection of sensitive and personal data is vital to:

the safety of staff and students

the reputation of schools and colleges

the confidence placed in schools and colleges

avoid the legal liabilities which security breaches expose schools and colleges to

How to meet the standard

You should control access to data in consultation with your IT service provider and the Data Protection Officer. This is to safeguard staff and students as required by the General Data Protection Regulation (GDPR).

To meet the standard, you must:

understand the definition of personal data

assess the risk of compromise, and the degree of damage caused by a security compromise, to work out the resources required to protect the data

pseudonymise or encrypt any personal data while stored and in transit to a third party

ensure the confidentiality, integrity and availability of the data and systems processing them

restore complete and accurate data after an incident in a timely fashion

design and apply processes for testing and assessing the effectiveness of all measures used to safeguard data and its use

There is DfE guidance on:

Technical requirements to meet the standard

Academy trusts should incorporate the risk assessment into the risk register.

If you rely upon encryption to protect data, this should be:

strong encryption

using encryption systems that are still supported

with a life appropriate to the sensitivity of the data being stored

The ICO provides advice on how data encryption should be used.

The ICO also provides a template for DPIA.

Additional protection or password protection should meet the technical requirements in the account access standard.

You should limit access to those staff with a specific need. Do this by specific content area, and not blanket permissions.

By achieving all the cyber standards you can meet the additional requirements for:

When to meet the standard

You should already be meeting this standard in accordance with GDPR.

The importance of meeting the standard

The most common forms of cyber attack rely on mistakes by staff members to be successful. Avoiding these mistakes prevents the attacks.

Basic cyber security knowledge amongst staff and governors is vital in promoting a more risk aware school culture.

How to meet the standard

Staff with access to your IT network must take basic cyber security training every year.

At least one member of the governing body should complete the training.

Remember that the training may change over time with changing cyber threats.

Technical requirements to meet the standard

Staff who require access to your IT network must take basic cyber security training every year. The training should be part of the induction training for new staff

This training should focus on:

phishing

password security

social engineering

the dangers of removable storage media

The National Cyber Security Centre has published suitable training materials:

At least one current governor must complete the same basic cyber security training. These governors should read the NCSC publication school cyber security questions for governors.

When to meet the standard

You should be looking to implement this standard as soon as you can but within 12 months as a minimum.

# data[].attributes.attachment_link.title
Meeting digital and technology standards in schools and colleges

# data[].attributes.attachment_link.description
Find out what standards your school or college should meet on cyber security, user accounts and data protection.

# data[].attributes.attachment_link.readable_text
The Prevent duty requires all education providers 'to help prevent the risk of people becoming terrorists or supporting terrorism'. This includes safeguarding learners from extremist ideologies and radicalisation.

Most importantly, providers should consider the needs of children, young people and adult learners at each stage of the safeguarding process. Providers should consider radicalisation concerns in line with their existing safeguarding processes, skills and experience.

Managing radicalisation and extremism safeguarding concerns

Safeguarding learners who are susceptible to radicalisation into terrorism depends on effective partnership.

To comply with the Prevent duty, schools, colleges and further education independent training providers must show evidence of:

productive co-operation, in particular with local Prevent staff, the police and local authorities

co-ordination through existing multi-agency forums

Each local authority has its own referral routes for safeguarding learners from radicalisation and extremism. Effective partnerships will ensure that you understand these processes.

Find out your Prevent referral process in your local authority.

Contact and build partnerships with your:

local authority Prevent lead

local authority Prevent education officer (if you have one)

DfE regional Prevent coordinator

local authority children or adult services

safeguarding children partnership

local policing team (search on your local police website)

Contact partners to understand the local risk and threats in your area.

Make sure you understand what radicalisation means and why learners may be susceptible to being drawn into terrorism. For more information, read 'how children, young people and adult learners become susceptible to radicalisation' in understanding and identifying radicalisation in your educational setting.

Make sure you know how to get advice from a wide range of professionals in children's social care. Find out how to ask for support from your local Prevent teams or the police when you need it.

Make sure you're familiar with the support available for someone at risk of radicalisation. For more information, read managing the risk of radicalisation in your educational setting.

Think about what support your setting can give to a learner who is susceptible to radicalisation into terrorism.

Think about how your curriculum can build resilience to radicalisation for all learners.

Staff responsibilities in relation to the Prevent duty

All staff should look out for concerning changes in behaviour and report them to the designated safeguarding lead ( DSL).

Behaviours that might cause concern

Any concerning changes in behaviour may indicate a safeguarding concern. These changes can be emotional, verbal or physical.

A learner may be vulnerable in certain ways that could make them more susceptible to a range of harms. These could include sexual exploitation, extremism and radicalisation, or serious violence.

For more information, read understanding and identifying radicalisation risk in your educational setting.

How to raise concerns

If staff have any concerns about a learner's welfare, they should speak to the DSL immediately. All staff should refer to their setting's safeguarding procedures.

Staff should know about:

Staff in further education (FE) should know about the Prevent for further education and training:

For more information, staff should speak to the DSL.

How to report extremism

If you need to report extremism concerns about an adult working in a school, college or organisation that works with children, young people or adult learners, you should:

contact your local authority designated officer (LADO) through your local safeguarding partnership or local authority

submit the details at report extremism in education

Online training for Prevent awareness

Online courses on Prevent awareness include:

For more information about available training, contact your local authority.

Resources for teachers and school leaders

You can get more guidance, resources and practical advice from:

# data[].attributes.attachment_link.title
The Prevent duty: an introduction for those with safeguarding responsibilities

# data[].attributes.attachment_link.description
The Prevent duty requires all education providers 'to help prevent the risk of people becoming terrorists or supporting terrorism'. This includes safeguarding learners from extremist ideologies and radicalisation. Most importantly, providers should consider the needs of children, young people and adult learners at each stage of the safeguarding process.

# data[].attributes.attachment_link.readable_text
What the Online Safety Act does

The Online Safety Act 2023 (the Act) is a new set of laws that protects children and adults online. It puts a range of new duties on social media companies and search services, making them more responsible for their users' safety on their platforms.

The Act will give providers new duties to implement systems and processes to reduce risks their services are used for illegal activity, and to take down illegal content when it does appear.

The strongest protections in the Act have been designed for children and will make the UK the safest place in the world to be a child online. Platforms will be required to prevent children from accessing harmful and age-inappropriate content and provide parents and children with clear and accessible ways to report problems online when they do arise.

The Act will also protect adult users, ensuring that major platforms will need to be more transparent about which kinds of potentially harmful content they allow, and give people more control over the types of content they want to see.

Ofcom is now the independent regulator of Online Safety. It will set out steps providers can take to fulfil their safety duties in codes of practice. It will have a broad range of powers to assess and enforce providers' compliance with the framework.

Providers' safety duties are proportionate to factors including the risk of harm to individuals, and the size and capacity of each provider. This makes sure that while safety measures will need to be put in place across the board, we aren't requiring small services with limited functionality to take the same actions as the largest corporations. Ofcom is required to take users' rights into account when setting out steps to take. And providers have simultaneous duties to pay particular regard to users' rights when fulfilling their safety duties.

The Act also introduced some new criminal offences - details are set out below.

Who the Act applies to

The Act's duties apply to search services and services that allow users to post content online or to interact with each other. This includes a range of websites, apps and other services, including social media services, consumer file cloud storage and sharing sites, video sharing platforms, online forums, dating services, and online instant messaging services.

The Act applies to services even if the companies providing them are outside the UK should they have links to the UK. This includes if the service has a significant number of UK users, if the UK is a target market or it is capable of being accessed by UK users and there is a material risk of significant harm to such users.

How the Online Safety Act is being implemented

The Act passed into law on 26 October 2023. Now work is being carried out to bring its protections into effect.

Ofcom is leading work to implement the Act's provisions and are taking a phased approach to bringing duties into effect. Government also needs to make secondary legislation in some areas to enable elements of the framework.

The Act requires Ofcom to develop guidance and codes of practice that will set out how online platforms can meet their duties. Ofcom will carry out public consultations on draft codes of practice before finalising them. Ofcom has already begun this work; the main phases are set out below:

Duties about illegal content - Ofcom has published draft codes of practice and guidance for consultation. The consultation closed on 23 February 2024. We expect these duties to begin to be in effect from early 2025.

Duties about content harmful to children - Ofcom has published draft guidance for consultation about use of age assurance to prevent children accessing online pornography. The consultation closed on 5 March 2024. Ofcom has also published draft codes of practice and guidance about protecting children from harmful content such as promotion of self-harm or suicide on 8 May 2024.

Duties for categorised services - some platforms will have to comply with additional requirements to protect users. The Act created categories of service and during implementation the thresholds will be defined to determine which services fall into which categories (Category 1, 2A or 2B). Ofcom has published advice to government on how to set the thresholds for these categories and issued a call for evidence on 25 March 2024, (closing 20 May 2024). Once the thresholds have been set in regulations by government, Ofcom will publish a register setting out which services fall into which categories and will publish further codes of practice and guidance for consultation.

New offences introduced by the Act

The criminal offences introduced by the Act came into effect on 31 January 2024. These offences cover:

encouraging or assisting serious self-harm

cyberflashing

sending false information intended to cause non-trivial harm

threatening communications

intimate image abuse

epilepsy trolling

These new offences apply directly to the individuals sending them, and convictions have already been made under the cyberflashing and threatening communications offences.

Some of these offences will be further bolstered when the Criminal Justice Bill completes its passage through Parliament.

Types of content that the Act tackles

Illegal content

The Act requires all companies to take robust action against illegal content and activity. Platforms will be required to implement measures to reduce the risks their services are used for illegal offending. They will also need to put in place systems for removing illegal content when it does appear. Search services will also have new duties to take steps to reduce the risks users encounter illegal content via their services.

The Act sets out a list of priority offences. These reflect the most serious and prevalent illegal content and activity, against which companies must take proactive measures.

Platforms must also remove any other illegal content where there is an individual victim (actual or intended), where it is flagged to them by users, or they become aware of it through any other means.

The illegal content duties are not just about removing existing illegal content; they are also about stopping it from appearing at all. Platforms need to think about how they design their sites to reduce the likelihood of them being used for criminal activity in the first place.

The kinds of illegal content and activity that platforms need to protect users from are set out in the Act, and this includes content relating to:

child sexual abuse

controlling or coercive behaviour

extreme sexual violence

extreme pornography

fraud

racially or religiously aggravated public order offences

inciting violence

illegal immigration and people smuggling

promoting or facilitating suicide

intimate image abuse

selling illegal drugs or weapons

sexual exploitation

terrorism

Content that is harmful to children

Protecting children is at the heart of the Online Safety Act. Although some content is not illegal, it could be harmful or age-inappropriate for children and platforms need to protect children from it.

Companies with websites that are likely to be accessed by children need to take steps to protect children from harmful content and behaviour.

The categories of harmful content that platforms need to protect children from encountering are set out in the Act. Children must be prevented from accessing Primary Priority Content, and should be given age-appropriate access to Priority Content. The types of content which fall into these categories are set out below.

Primary Priority Content

pornography

content that encourages, promotes, or provides instructions for either:

self-harm

eating disorders or

suicide

Priority Content

bullying

abusive or hateful content

content which depicts or encourages serious violence or injury

content which encourages dangerous stunts and challenges; and

content which encourages the ingestion, inhalation or exposure to harmful substances.

Age-appropriate experiences for children online

The Act requires social media companies to enforce their age limits consistently and protect their child users.

Services must assess any risks to children from using their platforms and set appropriate age restrictions, ensuring that child users have age-appropriate experiences and are shielded from harmful content. Websites with age restrictions need to specify in their terms of service what measures they use to prevent underage access and apply these terms consistently.

Different technologies can be used to check people's ages online. These are called age assurance technologies.

The new laws mean social media companies will have to say what technology they are using, if any, and apply these measures consistently. Companies can no longer say their service is for users above a certain age in their terms of service and do nothing to prevent younger children accessing it.

Adults will have more control over the content they see

Major user to user online platforms (Category 1) will be required to offer adult users tools to give them greater control over the kinds of content they see and who they engage with online. This includes giving them the option of filtering out unverified users, which will help stop anonymous trolls from contacting them.

Adult users will also be able to verify their identity and access tools which enable them to reduce the likelihood that they see content from non-verified users, and prevent non-verified users from interacting with their content.

Following the publication of guidance by Ofcom, major platforms will need to proactively offer adult users optional tools to help them reduce the likelihood that they will encounter certain types of content. These categories of content are set out in the Act and includes content that does not meet a criminal threshold but encourages, promotes or provides instructions for suicide harm or eating disorders. These tools also apply to abusive or hate content including racist, antisemitic, homophobic or misogynist content. The tools must be effective and easy to access.

The Act already protects children from seeing this content.

The Act will tackle suicide and self-harm content

Any site that allows users to share content or interact with each other is in scope of the Online Safety Act. These laws also require sites to rapidly remove illegal suicide and self-harm content and proactively protect users from content that is illegal under the Suicide Act 1961. The Act has also introduced a new criminal offence for encouraging or assisting serious self-harm.

Services that are likely to be accessed by children must prevent children of all ages from encountering legal content that encourages, promotes or provides instruction for suicide and self-harm.

The Act also requires major services (Category 1 services) to uphold their terms of service where they say they will remove or restrict content or suspend users. If a service says they prohibit certain kinds of suicide or self-harm content the Act requires them to enforce these terms consistently and transparently. These companies must also have effective reporting and redress mechanisms in place enabling users to raise concerns about companies' enforcement of their terms of service, if users feel that companies are not fulfilling their duties.

How the Act will be enforced

Ofcom is now the regulator of online safety and must make sure that platforms are protecting their users. Once the new duties are in effect, following Ofcom's publication of final codes and guidance, platforms will have to show they have processes in place to meet the requirements set out by the Act. Ofcom will monitor how effective those processes are at protecting internet users from harm. Ofcom will have powers to take action against companies which do not follow their new duties.

Companies can be fined up to £18 million or 10 percent of their qualifying worldwide revenue, whichever is greater. Criminal action can be taken against senior managers who fail to ensure companies follow information requests from Ofcom. Ofcom will also be able to hold companies and senior managers (where they are at fault) criminally liable if the provider fails to comply with Ofcom 's enforcement notices in relation to specific child safety duties or to child sexual abuse and exploitation on their service.

In the most extreme cases, with the agreement of the courts, Ofcom will be able to require payment providers, advertisers and internet service providers to stop working with a site, preventing it from generating money or being accessed from the UK.

How the Act affects companies that are not based in the UK

The Act gives Ofcom the powers they need to take appropriate action against all companies in scope, no matter where they are based, where services have relevant links with the UK. This means services with a significant number of UK users or where UK users are a target market, as well as other services which have in-scope content that presents a risk of significant harm to people in the UK.

How the Act tackles harmful algorithms

The Act requires providers to specifically consider how algorithms could impact users' exposure to illegal content - and children's exposure content that is harmful to children - as part of their risk assessments.

Providers will then need to take steps to mitigate and effectively manage any identified risks. This includes considering their platform's design, functionalities, algorithms, and any other features likely to meet the illegal content and child safety duties.

The law also makes it clear that harm can arise from the way content is disseminated, such as when an algorithm repeatedly pushes content to a child in large volumes over a short space of time.

Some platforms will be required to publish annual transparency reports containing online safety related information, such as information about the algorithms they use and their effect on users' experience, including children.

How the Act protects women and girls

The most harmful illegal online content disproportionately affects women and girls, and the Act requires platforms to proactively tackle this. Illegal content includes harassment, stalking, controlling or coercive behaviour, extreme pornography, and revenge pornography.

All user-to-user and search services have duties to put in place systems and processes to remove this content when it is flagged to them. The measures companies must take to remove illegal content will be set out in Ofcom 's codes of practice.

When developing these codes, Ofcom is required to consult with the Victim's Commissioner and Domestic Abuse Commissioner to guarantee that the voices and views of women, girls and victims are reflected.

The Act also requires Ofcom to produce guidance that summarises in one clear place the measures that can be taken to tackle the abuse that women and girls disproportionately face online. This guidance will ensure it is easy for platforms to implement holistic and effective protections for women and girls across their various duties.

Government is continuing to strengthen the protections for women and girls online beyond the Online Safety Act, and recently announced that it would amend the Criminal Justice Bill to make maliciously creating a sexually explicit deepfake of an adult a specific criminal offence.

Independent Review of Pornography Regulation, Legislation and Enforcement

The past two decades have seen a dramatic change in the way we consume media and interact with content online. We need to ensure pornography regulation and legislation reflects this change.

Separate to the Online Safety Act, the government announced the Independent Pornography Review to assess the regulation, legislation and enforcement of online and offline pornographic content. It investigates how exploitation and abuse is tackled in the industry and examines the potentially harmful impact of pornography. This review will help ensure the laws and regulations governing a dramatically changed pornography industry are once again fit for purpose.

In line with the Terms of Reference, the Review is looking to publish a report with recommendations for government by the end of Summer 2024.

Background information: useful websites

Legislation

Notices

Consultations and other publications (including relevant Ofcom consultations)

# data[].attributes.attachment_link.description
The Online Safety Act 2023 (the Act) is a new set of laws that protects children and adults online. It puts a range of new duties on social media companies and search services, making them more responsible for their users' safety on their platforms. The Act will give providers new duties to implement systems and processes to reduce risks their services are used for illegal activity, and to take down illegal content when it does appear.

# data[].attributes.attachment_link.readable_text
The National Crime Agency's CEOP Education team aim to help protect children and young people from online child sexual abuse.

We do this through our education programme, providing training, resources and information to professionals working with children, young people and their families.

I am:

Respecting me, you, us: building healthy relationships and creating positive cultures is a CEOP Education resource for 12 -14 year olds developed in association with clinical psychologist, Dr. Elly Hanson.

Under 18 and worried about online sexual abuse?
To report, click to visit the CEOP Safety Centre.

# data[].attributes.attachment_link.description
The CEOP Education programme from the National Crime Agency's CEOP Education team aims to protect children and young people aged 4-18 from online child sexual abuse.

# data[].attributes.attachment_link.readable_text
Skip to content

What we do

Help & advice

Helpful information and guidance on a range of key online safety topics.

The Childnet Film Competition 2024 is open!

Do you know any young people aged 7-18 who are passionate about film? Can they tell a good story, create animation or inspire positive change? Would they like to make a short film about online safety?
Then enter the competition now!

Download brand new interactive resource ReelLife!

An interactive resource to help young people aged 9-14 identify the potential risks of social media.
Check out the resource...

Try out the Childnet Digital Leaders Programme today!

A youth leadership training programme empowering young people to educate their peers about online safety.
Sign up for a guest login

Blog

The latest advice and guidance on key online safety issues, as well as information on the latest apps and games.

Free resources to help you teach about online safety.

We use cookies on our website to give you the most relevant experience by remembering your preferences and repeat visits. By clicking "Accept All", you consent to the use of ALL the cookies. However, you may visit "Cookie Settings" to provide a controlled consent.

# data[].attributes.attachment_link.title
Childnet - Online safety for young people

# data[].attributes.attachment_link.description
Helping make the internet a great and safe place for children and young people.

# data[].attributes.attachment_link.description
Each of these collections have been mapped to the Education for a Connected World framework set out by the UK Council for Internet Safety. Pages contain downloadable teacher resource documents with lesson ideas, discussion points and potential homework activities.

# data[].attributes.attachment_link.readable_text
Skip to content

Resources

A collection of five stories created to help parents and teachers educate children aged 3-7 about online safety, with accompanying teaching activities.

We use cookies on our website to give you the most relevant experience by remembering your preferences and repeat visits. By clicking "Accept All", you consent to the use of ALL the cookies. However, you may visit "Cookie Settings" to provide a controlled consent.

# data[].attributes.attachment_link.description
The Digiduck® collection has been created to help parents and teachers educate children aged 3 - 7 about online safety. The collection includes a ebooks, PDFs, a poster and an interactive app.

# data[].attributes.attachment_link.title
Safer Internet Day 2025 - UK Safer Internet Centre

# data[].attributes.attachment_link.description
Online Safety Tips, Advice and Resources

# data[].attributes.attachment_link.provider_name
Be Internet Legends - A Program to Teach Children Internet Safety

# data[].attributes.attachment_link.title
Be Internet Legends - A Program to Teach Children Internet Safety

# data[].attributes.attachment_link.description
Be Internet Legends is a multifaceted program that includes a fun and free of charge web-based game called Interland and an educational curriculum to teach children how to be safe and responsible explorers of the online world.

# data[].attributes.attachment_link.readable_text
This series of short films for secondary schools uses animation and real life case studies to explore key issues around digital literacy and online safety.
Below you'll find short films about fake news, live streaming, pornography, mental wellbeing, copyright and ownership, sensitive pictures, online gaming, cyber-bullying, digital footprints, and online security.

This series touches on elements of PSHE, citizenship and computing at GCSE in England, Wales and Northern Ireland and National 4 and 5 in Scotland.
Due to the sensitive nature of the subject matter, we strongly advise teacher viewing before watching with your students.

# data[].attributes.attachment_link.description
This series of short films for secondary schools uses animation and real life case studies to explore key issues around digital literacy and online safety.

# data[].attributes.attachment_link.readable_text
Skip to content

Resources PSHE Toolkits

A practical online safety toolkit for educators with films and lesson plans to explore online issues with pupils aged 11-14 years old.

A practical online safety PSHE toolkit with films and lesson plans to explore online issues with pupils aged 11-14 years old.

Films, lesson plans, guidance and worksheets

Quick downloads

To dowload a copy of the following films, right click each link and select 'Save link as...'

Donate

Even a small donation can support the development of our online safety resources and help our Education Team to connect with more children and young people.
Donate

As part of our work in the UK Safer Internet Centre

As part of our work in the UK Safer Internet Centre

We use cookies on our website to give you the most relevant experience by remembering your preferences and repeat visits. By clicking "Accept All", you consent to the use of ALL the cookies. However, you may visit "Cookie Settings" to provide a controlled consent.

# data[].attributes.attachment_link.title
Crossing the Line: PSHE toolkit | Childnet

# data[].attributes.attachment_link.description
Skip to content Resources PSHE Toolkits A practical online safety toolkit for educators with films and lesson plans to explore online issues with pupils aged 11-14 years old. To dowload a copy of the following films, right click each link and select 'Save link as...'

# data[].attributes.attachment_link.title
Ofcom report: Almost a quarter of children aged 5-7 have smartphones

# data[].attributes.attachment_link.description
A study of children’s online and media habits in the UK has found that a quarter of five to seven year olds have a smartphone and many are using social media.

# data[].attributes.attachment_link.readable_text
The new law has been hailed by organisations such as the NSPCC, yet it continues to be hotly debated. We explain what it is and what it means for families.

The Government says the law will make the UK "the safest place in the world to be online." First proposed in 2017, the Online Safety Bill has now been passed into law as the Online Safety Act 2023. Its proponents claim it will protect children from harmful material by forcing websites and apps to remove illegal content and give adults better powers to screen out content we just don't want to see.

What is in the Online Safety Act?

In a word, lots. Its first draft, presented to Parliament in 2021, was a hefty 145 pages long. The latest iteration has mushroomed to almost twice that size. It's a complicated piece of legislation, in part because it aims to regulate a highly complex area.

The law applies to any 'user-to-user service' accessible within the UK. That means any kind of online service where content created, uploaded or shared by a user can be encountered and experienced by another user.

If that sounds broad, that's because it is - it potentially affects vast numbers of websites and apps that have any kind of messaging, sharing or forum function from potentially thousands of businesses and organisations, not just household multinational names such as Facebook, Twitter, TikTok, Snapchat, YouTube etc. However, the websites of news organisations - such as broadcasters and newspapers - are exempt, as are their comments sections.

How does the Online Safety Act aim to keep kids safe?

The law imposes Duties of Care on any user-to-user service. The most important Duty of Care for services is to protect the online safety of both children and adults. When it comes to adults, services have additional duties to 'protect content of democratic importance' and 'journalistic content'.

In practice this means they'll have to conduct and publish risk assessments about the potential harmful content on their service. They must remove any such harmful content.

'Harmful content' includes stuff that was already illegal in the UK, such as anything encouraging terrorism or child abuse, for example. It now includes more types of content, such as content encouraging self-harm, deep fake pornography, fraudulent paid-for advertising and cyber-flashing which is when someone sends someone else an unwanted nude photo or video.

How will the law be enforced?

Ofcom, which currently regulates organisations such as broadcasters, telecoms companies and postal services, will have responsibility for enforcing the law. If user-to-user services don't remove harmful content, Ofcom will have the power to block access to them within the UK by working with internet service providers such as Vodafone, search engines and app stores.

This is a big addition to Ofcom's responsibilities. The closest equivalent within its current portfolio of responsibilities is when it investigates news broadcasters for alleged breaches of impartiality - but such investigations can currently take months.

Now that the bill has received royal assent, the regulator will draw up codes of conduct designed to help companies comply with the new rules. What will be in these codes of conduct remains to be seen.

What happens if the rules are broken?

A company can be fined up to 10% of its global turnover. Their executives and employees could go to prison.

Is pornography other than deep-fake porn covered by the Online Safety Act?

Any pornographic online service - whether or not it has any user-to-user functionality - must have mandatory age verification to prevent it being accessed by children.

Opponents of the law are worried that this will lead to treasure troves of data being accumulated on adults' private habits. Such sensitive data could become a tempting target for hackers intent on extortion, which has precedent.

Is it true the Online Safety Act will block 'legal but harmful' content?

While the duty of care on user-to-user services will compel them to prevent children from seeing 'legal but harmful' content, such as advocacy in favour of eating disorders, a similar duty of care that would have been applicable to adults has been removed from the law.

Even so, the biggest platforms and services will have to offer adults better (and better advertised) control over the content they are exposed to - filtering out unverified users to stop anonymous trolls in their tracks, for example, or topics and themes that they decide they don't want to see.

Why is the Online Safety Act controversial?

The original prohibition against 'legal but harmful' for adults was seen by critics as unjustifiable censorship in only restricting access to such content online, but not offline.

That provision has been removed now, so there's nothing to worry about?

For critics of the law, the biggest overarching concern is that it penalises not the people who create illegal and harmful content but the people or companies that enable it to be seen.

For the law's proponents, this is justified since the recommendation algorithms on services such as social networks enable such content to be consumed and shared much more widely than they would've been otherwise. However, as we've seen, the law potentially applies to many countless websites, apps and services, whether or not they are social networks and whether or not they have recommendation algorithms.

Critics are also concerned that the duty of care to block 'legal but harmful' content for children will lead to inconsistent standards of what is and isn't harmful as defined by a multitude of private companies, organisations and other providers of user-to-user services.

Is it true the Online Safety Act will ban WhatsApp?!

Some messaging apps, such as WhatsApp, iMessage and Signal, use end-to-end encryption. This technology protects the privacy of users and their messages by making it impossible for anyone other than the sender and recipient to access those messages. Not even the companies that provide those messaging services can access them.

The law, on paper, gives Ofcom the power to unlock such encryption for dealing with illegal and harmful content. However, such a power is impossible as it would weaken the protections offered by end-to-end encryption so much that it could make such communications much more vulnerable to hackers. The makers of the affected messaging apps, such as Meta and Apple, stated that they intended to withdraw their services from the UK once the bill become law rather than use alternative, weaker forms of encryption that are easier for governments and hackers to unlock.

The Government has since stated that Ofcom will not use this power until it is possible to do so. So, services that use end-to-end encryption, such as WhatsApp, and other similar forms of encryption, such as those used to protect financial services, managers and computing services, remain available in the UK.

Will 'tech bosses' really be jailed for breaking the law?

As the law is so new, it's hard to say. For proponents of the law, this provision will be an incentive for user-to-user services to take their duties of care seriously. Opponents of the law are concerned that this provision will inadvertently lead to UK-based executives, workers and employees blocking content that isn't harmful to avoid even the prospect of prosecution.

So is the Online Safety Act fit for purpose?

It depends on who you ask.

"The NSPCC worked on the Online Safety Bill for over five years, so we were delighted to see it being approved and look forward to the Bill becoming law soon," says Rani Govender, senior child safety online policy officer at the charity.

The charity is, she says, fully aware that: "we can never remove all risk to children's safety and wellbeing online, but we can ensure tech companies step up and take an active role in protecting the children who use their services. The Online Safety Bill will introduce a vital regulatory framework to ensure that companies can no longer overlook the risks that their platforms pose to children through requiring them to meet new safety duties."

Not everyone is so convinced, however. "I think the Online Safety Bill has been developed with the best of intentions, but the assumption that platforms, and platforms alone, can address harms that occur, is a naïve one," says Andy Phippen, Professor of IT Ethics and Digital Rights at Bournemouth University. "I'd much rather see a broad range of measures, including effective education and people trained in online harms - supporting young people - rather than assuming technology alone can solve this."

He worries, too, that attempts to protect children from harmful content could have unintended and negative consequences, so that: "filtering based upon sexual keywords will also block content on sex education, gender and identity."

James Baker, Campaigns Manager at Open Rights Group, which campaigns on digital rights issues, believes it is likely that some of the law's intended outcomes will not be achieved: "for example, young people may find ways around age verification technology in order to be able to access adult content."

It is, he says: "vital that parents don't rely on this Bill for keeping their children safe. Parents can apply controls to individual devices to restrict content, but above all they need to keep talking to their children about what they are seeing online. We need to empower children to navigate the online world safely."

Stay up-to-date with the very latest news from Vodafone by following us on and LinkedIn and signing up for News Centre website notifications.

# data[].attributes.attachment_link.title
Online Safety Act 2023: Everything you need to know

# data[].attributes.attachment_link.description
The new law has been hailed by organisations such as the NSPCC, yet it continues to be hotly debated. We explain what it is and what it means for families.

# data[].attributes.attachment_link.readable_text
If you've experienced or witnessed harm online we can help. Report Harmful Content can help you to report harmful content online by providing up to date information on community standards and direct links to the correct reporting facilities across multiple platforms

Under 18?
Click here for child friendly advice Get advice on how to report abuse and harassment in sport
Close popup boxes

# data[].attributes.attachment_link.authors[].name
Designed and Developed by South West Grid for Learning (https://swgfl.org.uk/)

# data[].attributes.attachment_link.title
Report Harmful Content - We Help You Remove Content

# data[].attributes.attachment_link.description
Helping anyone who comes across harmful content online

# data[].attributes.attachment_link.title
Report Harmful Content - Reporting Legal But Harmful Content Online

# data[].attributes.attachment_link.readable_text
The inquest heard Mia's parents had several times raised concerns with JFS staff that Mia was feeling lonely and isolated.

Yet Mr Janin said neither he nor his wife had any idea of the true extent of what his daughter had been going through.

The day after Mia returned to school after lockdown was lifted, Mia's mother Marisa discovered her lifeless body in her bathroom at the family home in Harrow.

Mr Janin said: "Suddenly I heard a horrible scream from my wife. This time everything stopped for me and my wife. Life changed completely."

In statements to the inquest, Mia's friends said their JFS friendship group was nicknamed the "suicide squad" in the months before Mia's death.

They also told police one of Mia's TikTok videos was shared to a Snapchat group, created by male pupils at JFS, where they mocked her.

Another child reported the boys used the group chat to share faked nude photos of the girls.

"Kids were manipulating images of girls. And Mia was one of them. And took it very badly," Mr Janin said.

Coroner Mr Murphy said at the inquest there was no evidence images or video about Mia were circulated in the group, except for that TikTok video.

JFS has said it only knew about the group after Mia's death. When Mia died in 2021, she was the third child suicide at the school in five years.

# data[].attributes.attachment_link.title
Mia Janin took own life after bullying - inquest

# data[].attributes.attachment_link.description
Schoolgirl Mia Janin's last voice note is released to the BBC as an inquest into her death concludes.

# data[].attributes.attachment_link.title
Protecting children from bullying and cyberbullying | NSPCC Learning

# data[].attributes.attachment_link.description
Describes what bullying and cyberbullying is, how it affects children and how people working with children can prevent and respond to it.

# data[].attributes.attachment_link.authors[].name
Liv McMahon, Tom Singleton & Georgina HayesTechnology reporters

# data[].attributes.attachment_link.title
Do ‘much, much more’ on age verification, social media apps told

# data[].attributes.attachment_link.description
The regulator finds a fifth of children are pretending to be adults, potentially exposing them to harm.

# data[].attributes.attachment_link.readable_text
Download our free Talk PANTS resources, teaching children the Underwear Rule to help keep them safe from abuse.

We've developed:

lesson plans

slide presentations, and

classroom activities

with the PSHE Association to help schools and nurseries talk PANTS with children, without ever using scary words or even mentioning sex.

The Quality Mark is awarded exclusively to resources that meet the PSHE Association's best practice principles for safe and effective PSHE education.

You will also find resources for children with SEND, early years settings, working with diverse groups and links to the relevant curriculum areas in each of the four nations.

# data[].attributes.attachment_link.title
PANTS resources for schools and teachers | NSPCC Learning

# data[].attributes.attachment_link.description
Free classroom resources for PANTS (The Underwear Rule) including a lesson plan, slide presentation, curriculum links, classroom activities and more.

# data[].attributes.attachment_link.description
Use Report Remove to remove a nude image shared online

# data[].attributes.attachment_link.readable_text
'Rachel', a primary school teacher from Greater Manchester, opens up about discovering her eldest child had been groomed to send explicit photographs on Spotify and is working with a safeguarding expert to help other parents

As a strict parent of two and a primary school teacher that educates young children on internet safety, 'Rachel' thought she was one step ahead in protecting her children from the dark corners of the web.

She forbid the two of them to use social media apps like Instagram and Snapchat, but allowed her eldest to use Spotify to listen to music and podcasts.

So when she found out her eldest, 11, was being groomed on the streaming site by a secret grooming community, she felt as though the 'bottom of the world had fallen'.

Rachel, which is not her real name, was horrified and in shock to find that her daughter, still in primary school, had uploaded sexually explicit images at least ten times at the request of anonymous users on the site, claiming to also be young children - one at the age of 12.

She found out what had been happening when Spotify emailed her to say the account had been disabled for violating their terms and conditions - and her daughter, in tears filled with guilt and shame, admitted it had been going on for months.

The little girl, from Stockport, Greater Manchester, had been creating playlists about topics she was interested in, such as Minecraft, which then received followers, as first reported by the Manchester Evening News.

These followers were then able to edit the titles as a way of communicating, asking her to send explicit images.

Rachel says her daughter received multiple requests and exact instructions on what pictures to upload and felt pressured to conform.

The more times she uploaded images, as 'custom artwork', the more followers she gained - adding up to 327 - which made her feel good about herself and the cycle continued, her mum admits.

The grooming began just before the summer but Rachel only found out what was happening a few weeks ago, and immediately reported it to the police.

"You hear horror stories about predators using apps to groom so neither of them [her children] have Instagram, TikTok, Snapchat - I've kept them well away from them as much as I possibly can," Rachel told the Mirror.

"Because Spotify hasn't got any messaging function, I never even considered that.

"When I found out it was as if the bottom of the world fell away. At that moment, I think just shock, horror, but how?"

Her daughter explained one user repeatedly asked her for pictures to the point where she 'gave in'.

Another who she'd met on Spotify, claiming to be 12, emailed her asking for a graphic video of herself.

One other asked her 'to put up one leg and hold it and show a good view' of her genitals.

A few more asked for a 'mirror picture with your legs spread' and for a 'tit pic'.

Her parents found there to be at least 12 accounts asking for this type of content.

With a search of certain keywords on Spotify, the Mirror found playlists with pornographic images.

Despite the young girl's account being removed, her content was still online, the mum says, and she claims she had to individually report each image - of which they found 10 - in order to get them deleted.

"She got more followers, it made her feel good, and then you're in the echo chamber, people saying nice things about her then more were requesting pictures and it kind of goes around in a cycle," Rachel explained on why she thinks her daughter did it, adding that she had never been directly told by an adult to not upload pictures to Spotify in particular.

"I've always been really open with them about why they're not allowed the other apps, people on there aren't very nice, they're not old enough.

"I work at a school so I know what the education is. And she thinks she followed the rules - 'I didn't tell them my name, where I lived.'

"On one hand I thought, 'yes you did follow the rules' but on the other hand I wanted to say 'how did you not see the link?'

"As a teacher myself, you don't want to use that language and say 'don't share sexually explicit content' at that age, for fear parents are going to come and complain about taking away that child's innocence or whatever it is."

Rachel says her daughter was terrified of telling the truth, but they assured her that it wasn't her fault from the get-go and have been regularly checking in on her.

The mum-of-two says the daughter has become more attached than usual, wanting more affection, and is now seeing a child psychologist every week to help build back her self-esteem.

They now fear how this might impact her future relationships.

"We've been so clear on that - you have made a mistake but everyone makes mistakes and this is not your fault," Rachel continued.

"She has taken a lot from the fact we are determined to turn it into a positive. She loves that people are talking about it, that the word is out there.

"She wants to stop this from happening to others. Showing her the power of taking her experiences and acting to help is really helpful for her to see."

Whether she will allow her back on Spotify, Rachel is undecided.

She wants the company, along with other tech giants, to do more to protect children.

And argues the Government needs to act to make sure the long-awaited Online Safety Bill, which was debated in UK Parliament on Tuesday, holds tech giants to account to protect children.

In the latest update, under the proposed changes, senior managers at tech firms will be criminally liable for repeated breaches of their duty of care to children and could face up to two years in jail.

In response to Rachel's story, Spotify said: "Spotify takes the safety of minors on our platform extremely seriously, and we do not allow content that promotes, solicits, or facilitates child sexual abuse or exploitation.

"We have processes and technology in place that allow us to detect and remove any such exploitative material."

While Rachel has felt grateful to Spotify for taking down her daughter's account, she's disappointed that it took uploading ten pictures before actually banning her as a user.

"Why did someone get away with breaching their guidelines ten times before being taken down?" Rachel probed.

"If they did it the first time she did it, we wouldn't be here now. We would have had the same conversation but it would not be to this extent.

"We know it's not just Spotify, there are predators in literally every corner of the internet who are going to do whatever they can to find the loopholes.

"We want companies to have, rather than a moral obligation, a legal obligation to act.

"These companies need to think about children first than profits first".

On Spotify's rule page, a sub-section titled 'sensitive content' says sexually explicit content is not allowed and that breaking the rules may result in result in the content being removed. Repeated or egregious violations may result in accounts being suspended or terminated, they say.

"Don't post excessively violent or graphic content, and don't post sexually explicit content," it states.

"What to avoid: Content that contains sexually explicit material includes, but may not be limited to: pornography or visual depictions of genitalia or nudity presented for the purpose of sexual gratification, advocating or glorifying sexual themes related to rape, incest, or beastiality.

"Please respect Spotify, the owners of the Content, and other users of the Spotify Service. Don't engage in any activity, post any User Content, or register and/or use a username, which is or includes material that is offensive, abusive, defamatory, pornographic, threatening, or obscene."

Greater Manchester Police says an "investigation is underway" following the reports.

But although the possibility of the perpetrators never being caught frustrates Rachel, it makes her even more determined to call for change to stop it from happening to anyone else.

Rachel and her husband have petitioned their local MP Andrew Gwynne to raise the case in parliament.

Mr Gwynne told the Mirror: "I - as a suspect many others are - was unaware that groomers could manipulate platforms like Spotify to commit this kind of abuse. It raises really serious questions about what action Spotify will take to ensure this doesn't happen again, and what the Government will do to ensure that our children are kept safe online.

"I am particularly concerned at reports made by the family that they had to repeatedly complain before Spotify removed the material in question. That is just totally unacceptable, and I expect a full and frank explanation from Spotify on how this was allowed to happen.

"Moving forward, I want assurances from the Government that the Online Safety Bill is tough enough to address this kind of abuse. The internet is constantly evolving, and unless legislation evolves with it, I'm worried we'll see more cases like this."

The mum added: "Sadly there are always going to be predators out there.

"I'm determined to raise awareness to protect others.

"It can't just be our daughter."

Rachel is working with Gabriella Russo, a safeguarding consultant with more than 25 years of experience, to get the word out to other parents and to help advise on what they can do if they find themselves in a similar situation.

Gabriella supplies training to schools and charities and was formerly a manager with the NSPCC. Like them, she had never come across youngsters being groomed in this way - but says predators are always one step ahead looking for loopholes.

Here, the expert outlines a number of warning signs to look for and advice for parents:

Steps to take

"In my experience of working in the field, any parent that discovers their child is being abused is going to have that heart-dropping fear - 'what exactly have they been put through? And what do we do?'" Gabriella began.

"Firstly, parents need to be aware of what apps their kids are on because they do have age restrictions and time and time again, I've gone into schools and talked about this and you always have kids go, 'but I'm allowed that one we use that anyway.'

"Parents need to not be afraid to be parents and put some rules in place.

"It's complicated and difficult because we don't want our children to be the odd one out. But we also need to be the parent or the carer in the situation.

"You can do this by making conversation about being online as normal and natural. For children, the online world is real, it's part of their life.

"And so actually, talking about that as much as any other part of their real life, is really important. Not just conversations about these rules, but learning about their online life as much as you can - pay an interest in what they're doing with their friends online, and don't be afraid to implement 'no phones in the bedroom at night' etc.

"And be prepared to say 'this is going to be out in the open, I can check it whenever, I can have your password' - obviously age appropriate.

"If you're gradually helping your children to navigate online safely then as they get older, they will be able to spot things themselves."
Samaritans SANEline Mind
She added: "It's parenting in a different space.

"I think a lot of a lot of parents are concerned about reserving childhood innocence. 'I don't want to talk about too much too early,' but it's happening."

Gabriella adds that parents should have password access to their children's social media accounts and game apps during primary school age.

As children get older, the line is less clear-cut, but it depends on the maturity of the child and if they have special needs for example, she says.

"I think what's really important for children is to know that they can talk to an adult about anything they're unsure about," Gabriella continued.

"One of the things that can be done is helping children identify who the adults are that they would talk to.

"That could be a conversation where, 'if anything was ever worrying you, who would you talk to if you didn't want to talk to me as your mum or your dad, who are the other adults around you?'

"We want our children to talk to us, but I'd rather a child speak to another adult for help than nobody. And if you're a parent, if you're not the first port of call, sometimes that's natural."

Warning signs

"I would definitely be concerned about a child making friends online with anyone I didn't know offline," Gabriella warned.

"You can make amazing friendships online as an adult, but can they be sure that they are who they say they are?

"Anything where they're being encouraged to do something that doesn't sit right with them - anything where they've been encouraged to join something that they know they wouldn't be allowed to by their parents.

"Or, anything where they're being asked to send something that's going to be kept confidential, or secret, anything around keeping secrets, because if you have to keep it as a secret, what's that about? But also, nothing online is guaranteed secret.

"Do the kids have a real understanding of healthy relationships - what's a good interaction? There'll be more alert later on, but also help them to really understand that and trust their own instincts as well.

"If it doesn't feel right. It's probably not. And even if you're wrong, the world's not going to fall apart if you don't participate because you can join in next time if it wasn't."

Gabriella says if parents find themselves in this situation, it's important not to let emotions get the better of them.

"The initial response is so important because they will open up more," she added.

The expert urges everyone to report incidents to the police, alert the school where the child attends, and then seek therapeutic support.

"These groomers and paedophiles will find another corner that hasn't been exploited yet. They're going to be steps ahead," Gabriella said.

"So we just have to do our very best and being aware all of those foundations, hopefully, a child will be like 'well hang on, this doesn't feel right."
If you have information on child exploitation and abuse or suspect it may be happening but want to remain completely anonymous, you can contact the independent charity Crimestoppers online or on the phone. You can also call the NSPCC on 0808 800 5000 if you're concerned about a child.

# data[].attributes.attachment_link.title
Mum warns parents after daughter, 11, was groomed on Spotify

# data[].attributes.attachment_link.description
'Rachel', a primary school teacher from Greater Manchester, opens up about discovering her eldest child had been groomed to send explicit photographs on Spotify and is working with a safeguarding expert to help other parents

# data[].attributes.attachment_link.readable_text
What are 'Add Everyone' group chats?

'Add Everyone' group chats can go by many names, but their purpose is often the same. These WhatsApp groups are spaces where children and young people are invited to join a chat that contains content such as sexual images, material promoting self-harm, sexual violence, racism and other inappropriate content. These chats may be created by adults seeking to connect with younger users or by young people themselves as a seemingly fun activity. However, as the name suggests, it is difficult to control who becomes a member of these groups, which means that access to children and young people can easily fall into the wrong hands. In some cases, the group owners ask for children to add their contacts to the group, 'except their parents'.
As WhatsApp has lowered its minimum age from 16 to 13 this year, the risk of young users encountering inappropriate content and adults may increase. However, reports indicate that these groups have targeted children as young as 9.

# data[].attributes.attachment_link.title
Safeguarding Alert: The 'Add Everyone' Explicit WhatsApp Group - Ineqe Safeguarding Group

# data[].attributes.attachment_link.description
Your Content Goes Here Your Content Goes Here Recent concerns have emerged regarding a WhatsApp group known as 'Add Everyone.' Schools and regional police forces across the UK have warned that this group exposes children and young people to explicit and harmful material. Imagine

# data[].attributes.body
Reporting online grooming

# data[].attributes.attachment_link.readable_text
Are you being bullied?

If you are being bullied, or you are not ready to make a report to CEOP, you can talk to Childline anonymously online or on the phone - No worry is too big or too small.

Visit Childline

# data[].attributes.attachment_link.description
Are you being bullied? If you are being bullied, or you are not ready to make a report to CEOP, you can talk to Childline anonymously online or on the phone - No worry is too big or too small. Visit Childline

# data[].attributes.attachment_link.readable_text
For over a decade, Ukie and the video games industry have supported parents and families by sharing top tips, expert knowledge, and answering questions all about video games. Ask About Games gives parents and families access a wealth of free information and resources, ensuring families can enjoy video games safely and happily!

# data[].attributes.attachment_link.title
A responsible industry - UK video games industry

# data[].attributes.attachment_link.description
Find out all the ways that the UK video games industry looks after its players

# data[].attributes.attachment_link.title
Digital Parenting Pro | Parental Controls Guide | Vodafone UK

# data[].attributes.attachment_link.description
Digital Parenting Pro is one of the UK’s largest parental controls & safety settings resources, created by Vodafone & in partnership with Digital Awareness UK.

# data[].attributes.attachment_link.description
Activate parental controls, Balance screen time and Check and Chat digital.

# data[].attributes.headline
Online Safety Support for parents of SEND pupils

# data[].attributes.subject
Online Safety Support for parents of SEND pupils

# data[].attributes.attachment_link.readable_text
All children and young people deserve the opportunity to benefit from connected technology safely.

That's why we've created a range of guides to empower parents and carers to help young
people with Special Educational Needs and Disabilities (SEND) to stay safe online.

Why's this important?

The online world can be a lifeline for children with additional needs. It allows them to develop new skills, be creative, and find their 'tribe'.

However, from our research, we know that children and young people already facing offline
vulnerabilities, are more likely to face risk and harm online.

Out of the different types of risks, young people with SEND are more likely to experience
contact risks online like sexting under pressure and coercion.

So, taking the time to learn some simple strategies, informing children of safety tools, and
staying engaged in what they do, are effective ways to keep their time online positive.

What's inside the guides?

You'll find insights and resources to support young people while they are connecting and
sharing, browsing the internet, and online gaming.

You'll find helpful tips to:
● Encourage young people to adopt good online habits
● Stay informed about the online risks they face online
● And how to make use of safety tools to help them thrive in their digital world

# data[].attributes.attachment_link.title
Supporting children and young with SEND online | Internet Matters

# data[].attributes.attachment_link.description
All children and young people deserve the opportunity to benefit from connected technology safely. That's why we've created a range of guides to empower parents and carers to help young people with Special Educational Needs and Disabilities (SEND) to stay safe online. Why's this important?

# data[].attributes.attachment_link.authors[].name
Designed and Developed by Will Earp and Matt Rosser, SWGfL (https://swgfl.org.uk/)

# data[].attributes.attachment_link.title
Swiggle.org.uk - Child Friendly Search Engine for Kids

# data[].attributes.attachment_link.description
Swiggle is a friendly search engine for kids aimed at Key Stage 2. With educational search results, Swiggle is fun and simple for children to use when learning to search the internet. There are also tools and information on how to stay safe online.

# data[].attributes.attachment_link.readable_text
This paper is the second in a series of reports exploring the impact of pornography on children. As Children's Commissioner, it is my duty to protect children from harm in both the physical and online worlds. As the Online Safety Bill moves through Parliament, I want to use this opportunity to turn the tide on pornography's harms to children. I am clear that children should not be able to access pornography, and my office's work in this space continues to demonstrate the harm it can cause to children and young people.

My first report, published in January 2023, " A lot of it is actually just abuse", set out findings from a survey of over a thousand 16-21-year-olds and focus groups with teenagers. It established that the average age at which children first view pornography is now 13 years old. Substantial proportions of young people surveyed who had seen pornography viewed it at a much younger age than 13 - 27% by age 11 and 10% by the age of 9. Young people spoke about the unbearable pressure to view hardcore pornography even if they do not want to, much of which depicts degrading acts and violence against women. Our survey analysis also demonstrated a significant link between an early age of first exposure to pornography and frequency of exposure in later years. The age of first exposure and frequency of exposure were shown to be closely linked to the likelihood of a young person viewing violent content online. Frequent users of pornography were also more likely to have real-life experience of an aggressive or degrading sex act.

For too long we have brushed the issue of pornography under the carpet as awkward, uncomfortable, or too difficult to solve. It is crucial that we don't shy away from discussing the nature, scale and impacts of online pornography. No child should be able to stumble across pornography online; in a world where pornography is a click away for any child, I am clear that this must change and until then we must grapple with the implications. Sadly, we are hearing from more young people that they are watching pornography and thinking that it is reflective of real life or healthy relationships, which is not the case. This is reflected from what I heard recently from a young person:

"Porn is often the starting point for young people when it comes to sex, how to have sex, and what to expect." - Young woman, 20, first saw pornography aged 10.

From this work it is evident that some children and young people are being negatively impacted by pornography. I have been so concerned by the growing research that shows pornography may influence harmful behaviour. I knew this was an area I needed to explore further. That is why I have used my statutory powers to request data, and for the first time collected case files on child-on child sexual abuse from one police force and from one Sexual Abuse Referral Centre (SARC), where children had been referred because they had been sexually abused by another child. My office has carried out innovative analysis of the text these documents to understand more about the role that pornography might play at this sharpest end of child abuse cases.

It is incredibly concerning that I found references to specific acts of sexual violence commonly seen in pornography in half of the interviews carried out following these cases of sexual abuse. Additional review of some of these cases found children suggesting direct links between pornography exposure and the harmful sexual behaviour exhibited.

This new analysis, together with other evidence in this report, presents a compelling case. This report contributes to the literature on pornography's role in shaping and fuelling violence against women and girls.[i] The risk factors behind harmful sexual behaviour and children abusing other children are complex, with pornography being one possible factor among others. Much of the abuse is taking forms which are depicted in pornography.

This report, once again, makes for difficult reading. It includes accounts of sexual violence and descriptions of aggressive sexual acts found in pornography. It is perhaps the work that I have found hardest to publish since becoming Children's Commissioner. Each of the 502 case files analysed for this report represents terrible trauma wrought on a child, by another child.

This report is focused on the harms that children face from accessing violent pornography, and how that might influence their own harmful sexual behaviour. That is why regulation online is so critical to protect children and young people. I am categorically clear: no child should be able to access or watch pornography. Protecting children from seeing inappropriate material is critical, but it is just one part of the essential and urgent work of protecting children from sexual abuse. It cannot work in isolation and must be combined with broader preventative measures. It must also go hand in hand with making sure that any child who is a victim of this most terrible crime is given the support they need to recover, and access to swift and effective justice. That is why I have committed to further work directly with child victims to understand their experiences, so I can make wider recommendations about what needs to change.

This report is dedicated to the children who have suffered from the effects of online pornography exposure. It is my duty to stand up and protect you, and I hope this report is a step towards doing so.

**

This report is not intended to be read by children, but by researchers and policy makers interested in making children safer. It makes frequent reference to sexual harassment and sexual violence. This includes descriptions of pornographic content, language and discussion of sexual abuse. This content may be difficult to read. However, we think it is important to understand how pornography impacts children, in order that we may better protect all children from harm.

# data[].attributes.attachment_link.title
Evidence on pornography's influence on harmful sexual behaviour among children | Children's Commissioner for England

# data[].attributes.attachment_link.description
This paper is the second in a series of reports exploring the impact of pornography on children. As Children's Commissioner, it is my duty to protect

# data[].attributes.attachment_link.readable_text
This research explores children's experiences of harm online, including the pathways to harm, its impact and the use of and perceptions towards online protections.

We have carried out this research in line with our duty to promote and research media literacy in the UK, and to build our evidence base as part of our role as the online safety regulator.

This research explores the pathways through which children encounter violent content online, the impact this can have, and perceptions and use of safety measures. It also provides an overview of children's description of what violent content looks like, which they said was an 'unavoidable' part of being online.

Content warning: This report contains mention of potentially distressing themes regarding children's experiences with violent content, including sexual violence. The report contains generalised descriptions of specific pieces of violent content, but detailed descriptions have been omitted.

This research explores the pathways through which children encounter content related to suicide, self-harm and eating disorders, the impact this can have, and perceptions of safety measures. It also provides an overview of children's description of what content promoting suicide, self-harm and eating disorders looks like online, which children in our sample had high level of familiarity with and characterised it as being prolific on social media.

Content warning: This report contains distressing discussions of children and young people's experiences with suicide, self-harm and eating disorder content and behaviours.

This research explores the pathways through which children are exposed to cyberbullying, the impact this can have, and perceptions of what works to address cyberbullying. It also explored what cyberbullying looks like among children, which was said to happen anywhere children interacted online and tended to concentrate on whichever platforms were most popular at the time.

Children face a range of risks online, and the harms they may experience can be complex and nuanced. The severity of harm can also vary between children. In light of this complexity, we need to understand the mechanisms by which online content and conduct may give rise to harm.

This research explored how different risk factors combine to increase the likelihood of harm to children. The findings help us understand what is needed to keep children safe online. We will use them to inform our online safety work, including our guidance to regulated services on how they meet their duties.

Our research has found that while most children between 8 and 17 have a profile on at least one social media platform, some are younger than the minimum age required to use that platform. When a child enters a false age to gain access to the platform, as they get older, so does their false 'user age'. This puts them at greater risk of encountering age-inappropriate or potentially harmful content.

We wanted to estimate the proportion of children who have a false 'user age' on their online profile, making them appear older than they actually are.

2023 data

2022 data

Social media platforms publish advice on staying safe online, but there are concerns that children don't engage with this information. Serious games have been shown to help engage people with content to improve their safety online, but there is limited empirical evidence on this.

Ofcom's Behavioural Insight Hub designed a simple serious game, and carried out a pilot randomised controlled trial (RCT) to test the effectiveness of a serious game to keep children safe online.

# data[].attributes.attachment_link.description
This research explores children's experiences of harm online, as well as understanding children's and parents' attitudes towards certain online protections.

# data[].attributes.attachment_link.description
Kiddle is a safe search engine, offering a safe web, image, and video search. Results are vetted by editors.

# data[].attributes.attachment_link.readable_text
Struggling to keep up with the apps, games, and websites your kids are using? Common Sense's Parents' Ultimate Guides can help keep you up to date and answer your questions about all the latest platforms and trends. Whether you're trying to figure out if a new app is safe for your teen or if a popular game includes blood and gore, we've got you covered.

# data[].attributes.attachment_link.description
Struggling to keep up with the apps, games, and websites your kids are using? Common Sense's Parents' Ultimate Guides can help keep you up to date and answer your questions about all the latest platforms and trends.

# data[].attributes.attachment_link.title
My Family’s Digital Toolkit - tailored online safety advice | Internet Matters

# data[].attributes.attachment_link.description
Every child is different with their own online interests and activities. We created a simple tool to provide tailored advice to meet family’s digital needs.

# data[].attributes.attachment_link.title
Digital Safeguarding- the online world of educating young people