Legal and Ethical

Equal access means that everyone can reach information and use a service without barriers or discrimination. Nothing about a person — a disability, their age, the language they speak or their background — should stop them opening a web page, filling in an online form or using a system at work.

Barriers that shut people out

Most barriers come from design choices, not from the person using the service. A swimming pool booking form that only works if you drag a block across the screen shuts out someone with a motor disability who relies on a keyboard or a switch. A page full of pop-ups that appear without warning is unsettling for an autistic visitor who needs things to stay calm and predictable. Long, tightly packed blocks of text slow down a reader with dyslexia. A road-safety video with no captions loses a deaf viewer, and a train timetable that shows delays in red and on-time trains in green is unreadable to someone who is colour blind. Someone who is blind or hard of sight is blocked when a picture has no written description, because their screen reader has nothing to say.

Access for everyone, not only disability

Equal access reaches further than disability. A council that publishes its recycling rules only in English, or only as a file that some phones cannot open, has excluded people just as surely as a mouse-only form does. Organisations therefore plan access in from the start: captions, keyboard access, alt text and strong contrast are chosen to match the people who will use the service, and those same features usually help visitors who are not disabled too.

Equal access means removing the barriers that stop some people using information and services. Accessibility features are often seen as help for disabled users, but they improve things for everyone — and once the barriers go, the benefits spread to individuals, organisations and society.

Individuals

People gain access to media and entertainment: captions let you follow a science video on a noisy bus, and audio description makes a nature programme usable when you cannot see the screen. An accessible website also lets you do everyday jobs at any hour and on any device, such as renewing a library loan on the way home or checking when a pool at your local leisure centre is free from your phone. Online courses and revision sites offer chances to learn and improve, while messaging and video calls make it easy to keep in touch with relatives far away.

Organisations

Businesses benefit because every member of staff can use their systems to research competitors and prices, find suppliers and communicate better with each other. When everyone can reach the records and financial systems they need, orders and invoices are less likely to be wrong, which improves financial management. Accessible customer communication, such as a clear contact form or live chat, improves service. For example, a bakery that publishes its opening hours and allergen list as plain text with proper headings lets a customer's screen reader read those details aloud, winning orders it would otherwise have lost.

Society

Social networking reduces social barriers and brings communities together, because people who cannot easily leave home can still join groups. Messaging over long distances at a lower cost keeps families and friends connected. The democratisation of knowledge means anyone with internet access can learn, not just those who can travel to a library or pay for a course. Shared online projects build a better understanding of other cultures and support international collaboration, such as schools in different countries putting together an online museum of local history.

Legal standards are the rules set out in law. Ethical standards are based on what society believes is right and wrong. An organisation has to meet both, but only one of them can be enforced in court.

Legal standards

Legal standards come from legislation, and they are enforceable: a regulator or a court can force an organisation to change what it does, and breaking the law can lead to penalties such as fines, disciplinary action against the staff responsible, or imprisonment.

Any organisation that uses technology must follow the laws covering that use. Data protection law controls how it stores and shares personal data, and the Equality Act 2010 covers how it treats the people using its services. Laws are updated and replaced over time, so an organisation has to keep checking that its systems and policies still match the current version; following an old version of a law is still breaking the law.

Ethical standards

Ethical standards are not written into law. Society works them out over time, and they are the behaviour people expect from a fair, honest organisation. No one can be prosecuted for ignoring them, but the consequences are real: customers lose trust, staff leave, and a reputation built over years can be damaged in days.

The two are not the same, and something can be legal but not ethical. A video-sharing app tunes its recommendations to keep you watching for as long as possible, even when its own research shows some clips leave young users feeling worse. No law is broken, but many people would call it unethical, because the app puts viewing time ahead of its users' wellbeing.

The Equality Act 2010 is the UK law that upholds equal access and prohibits discrimination. It brought earlier laws against unfair treatment, such as the Race Relations Act and the Disability Discrimination Act, together into one Act, so those older laws no longer apply — the Equality Act 2010 is the one that does.

Under the Act, discrimination in access to information and services is illegal. An organisation, or an individual working within it, that discriminates can be prosecuted, so providing fair access is a legal duty rather than a goodwill gesture.

What counts as discrimination

Discrimination can take several forms when you provide information or run a service:

• Offensive content — words, pictures or jokes that insult a group of people, such as a climbing centre's printed welcome leaflet that includes a mocking joke about people with dwarfism.
• Failing to provide accessibility tools to a member of staff — a hotel that refuses to fit a hearing loop at its busy reception desk, so the receptionist who is hard of hearing cannot hear guests checking in or ask them to repeat themselves. Treating an employee this way is discrimination too, and the hotel can be prosecuted.
• Offering content in one inaccessible format only — a bowling alley that shows its lane prices only as a colour-coded chart, so a visitor with colour vision deficiency cannot tell the prices apart. Adding text labels to each colour removes the barrier.

Plan access from the start

Because the duty is legal, an organisation must think about access before it launches a service, rather than waiting for a complaint and patching things afterwards. Checking keyboard access, text alternatives and captions at the design stage is cheaper than rebuilding later, and it keeps the organisation within the law.

Professional guidelines are rules that focus on one profession or industry. They are based on actions agreed by key organisations, such as a professional body or a trade association, and are usually published as a code of practice or code of conduct. They set out the standards that members of that profession are expected to meet when they do their job, for example how to treat clients, keep records, handle complaints or give every customer equal access to a service.

Not the same as law

Professional guidelines are not enforceable by law unless a licence to practise is involved. If someone needs a licence to do the job, breaking the guidelines can lead to that licence being revoked. This stops the person working in the profession until the licence is restored.

For example, a trade association for heating engineers publishes guidelines on how members should record the safety checks they carry out when servicing a boiler. A member who signs off the work without doing the checks could have their registration withdrawn, which stops them servicing gas appliances until it is restored.

Reputation

For an organisation, not following professional guidelines risks its reputation. Clients and other businesses expect professionals to keep to the agreed standards. If a company is seen to ignore them, customers may take their business elsewhere, contracts may be lost and good staff may leave. Where no licence is involved there is no fine or prosecution under the guidelines themselves: the damage is to trust. A company that ignores guidelines on equal access, for instance, can lose customers who feel shut out, even though it has broken no law.

Accepted standards are agreed ways of doing things that have built up over time because people have found they give good results. They are often called best practice. No single law or organisation creates them: they grow from experience and are reshaped as technology changes. For example, IT teams have learned to test new software on the browsers and devices their staff actually use before rolling it out, rather than assuming it will work everywhere.

Because technology moves on, accepted standards are reviewed and updated regularly. Organisations are expected to follow the current version rather than an old one, and checking for updates is part of keeping a service working well. They are not enforceable by law in themselves: an organisation cannot be fined or prosecuted simply for ignoring one. The consequences are practical instead. A service that breaks an accepted standard may not work for some users, customers may complain, and the organisation's reputation can suffer. A standard can still be written into a contract or into an organisation's own policies, which makes it binding in practice for that organisation.

To tell standards apart, ask what backs them up. Law is enforceable and breaking it can lead to penalties such as fines. An accepted standard rests on agreement and expectation, so ignoring it usually costs an organisation trust and customers rather than leading to a court case. WCAG is a well-known accepted standard covering web accessibility.

WCAG (Web Content Accessibility Guidelines) is an accepted standard: a set of recommendations for making web content easier to access. It is aimed mainly at the people who build web pages, so that users with disabilities who rely on assistive technologies such as screen readers, magnifiers, captions and keyboard-only input can use their content. Following it also improves the experience for everyone, on all kinds of devices: clear headings, large targets and a simple layout are easier to use on a phone or when you are in a hurry.

For example, a leisure centre publishes its swimming timetable online. If the page follows WCAG, someone using a screen reader can hear the times in a sensible order, and someone who cannot use a mouse can still move through the page. A visitor reading the timetable on a phone in bright sunlight also benefits from strong contrast and clear headings.

WCAG is not a law. An organisation cannot be prosecuted simply for breaking it, although it may be written into contracts or into the organisation's own policies. That makes WCAG an accepted standard rather than legislation.

WCAG is versioned. Version 2.1 includes everything in version 2.0 and adds new content. One addition is a guideline for input modalities under the Operable principle: anything a user does with a complex touchscreen gesture, such as a pinch or a swipe, should also be possible with a simple tap or click, so people using assistive technologies get an equivalent experience. Version 2.1 does not replace 2.0; it contains 2.0 and builds on it.

WCAG (Web Content Accessibility Guidelines) is organised around four principles: perceivable, operable, understandable and robust. Each principle has guidelines describing what accessible web content should do, and a site needs to meet all four, not just one.

For example, a school library search page is perceivable if its labels stand out clearly from the background, operable if the search box and buttons can be used with Tab and Enter, understandable if the instructions are clear and any mistakes are explained, and robust if it still works with a screen reader on a tablet. The principles work together: a page that is easy to see but impossible to use without a mouse is not accessible.

Alt text (alternative text) is a short written description attached to an image on a web page. You do not usually see it on the page: a screen reader reads it aloud in place of the image, and a browser displays it if the image fails to load.

Good alt text gives the purpose of the image in that place, not a list of every detail. On a school sports page, a photo of the winning relay team could have the alt text "Year 8 relay team holding the district trophy after the final". Someone who cannot see the photo still knows what it adds to the report. For a chart, "Bar chart: Year 9 earned the most house points in March" is more useful than "a chart". A screen reader already announces that the item is an image, so there is no need to begin with "Image of".

Some images are only decoration, such as a patterned strip beside a heading. These can be given empty alt text (alt="") so a screen reader skips them instead of announcing an image that carries no information. A complex diagram, such as the steps in the water cycle, may need a longer description in the surrounding text, because every label crammed into the alt text is hard to listen to.

Why it matters

A screen reader cannot work out what a picture shows. Without alt text, a blind or low-vision user may hear only "image" and miss the information completely. Alt text also helps any user whose images fail to load, because the description appears in place of the picture. In WCAG (Web Content Accessibility Guidelines), providing text alternatives for non-text content is a guideline under the Perceivable principle: users must be able to receive the content, whatever form it starts in.

Not every user can type or click a mouse, so websites and online forms need alternative input methods. Two common ones are keyboard accessibility and voice data entry.

Keyboard accessibility

Keyboard accessibility means every task on a site or form can be completed using only a keyboard. Tab moves between fields and buttons, Enter follows a link or presses a button, and Space ticks a checkbox. Focus should follow the visual order of the page, so tabbing moves down the screen in the order you would read it, and no task should depend on a mouse-only action such as dragging an item into a box.

This matters for someone with a motor disability, a tremor or a long-term injury such as repetitive strain injury, because holding and steering a mouse can be painful or impossible. It also covers switch devices, which send the same key presses as a keyboard. These features help everyone: many users tab through a form simply because it is quicker than reaching for the mouse.

For example, a library's online reservation form lets you tab to the book title, then the pickup date, then the reserve button, so a borrower who cannot use a mouse still reserves a book in under a minute.

Voice data entry

Voice data entry lets a user dictate information into a form instead of typing it. The device or browser converts the speech to text and puts it into the field, and the user checks the result on screen. Someone who cannot type easily because of a motor disability, or who finds spelling difficult because of dyslexia, can speak their name, address and date of birth instead of hunting for keys.

For example, a college application form accepts a spoken name and date of birth, so an applicant with dyspraxia, who finds small keys hard to hit accurately, can complete it without typing every field.

Where keyboard access sits in WCAG

The keyboard requirement is a guideline under the Operable principle of WCAG (Web Content Accessibility Guidelines): all functionality must be available from a keyboard. A site that meets it does not shut out users who cannot hold or steer a mouse.

An Internet Service Provider (ISP) is the company that connects an end user to the internet and to the websites and services they access. When you pay for a home broadband package, or for a mobile data plan on your phone, that payment buys you a connection. The ISP supplies it: it carries your requests out to a website and brings that website's content back to your screen.

Standing in the middle

An ISP sits between the customer and the content. Every request you make travels through the ISP's network before it reaches the site you asked for, and the reply comes back through the ISP too. For example, when a games console downloads a large update for a multiplayer game, the request for that file passes through equipment owned by the ISP before it reaches the game company's server, and the ISP chooses which path that data takes across its own network.

Because the ISP is in the middle, it is technically able to control how content is delivered to different customers. It can decide how data is routed across its network and how quickly that data reaches each customer, so it could let one service load quickly while holding another back. That power over access to online services is why net neutrality matters.

The connection, not the content

The ISP is not the website or the content provider. If you use your ISP to reach a site full of guitar tutorials, the ISP does not own those tutorials, write them or decide how the site presents them; it only provides the connection that gets you there.

Net neutrality is the principle that Internet Service Providers (ISPs) should treat all customers, data, devices and services equally, without favouring one over another. An ISP is the company that provides your connection, so it is the party that has to stay neutral.

The same content for every customer

Under net neutrality, all users have access to the same content. A household on the cheapest package and a household paying for the fastest deal both reach the same websites — the ISP cannot quietly hand one of them a stripped-back version of the web. A phone browsing on mobile data reaches the same sites as a laptop on home broadband, because a mobile network is simply another ISP. Nor can an ISP decide that some kinds of gadget deserve the full internet while others get a cut-down one: the content behind the connection stays the same whatever screen it ends up on.

No artificial limits on one service

Net neutrality also means an ISP does not artificially limit or slow down the speed of one service compared with another. It does not mean every connection runs at exactly the same speed: a newer phone may download faster than an older tablet simply because its hardware is better. What matters is that the ISP is not the one choosing to hold a particular service back.

Picture an ISP as a postal worker who drops one shop's letters through the door straight away but leaves a rival shop's letters in the van for a week. The letters weigh the same and the customers have not changed, so the delay is entirely the delivery firm's choice. Net neutrality says an ISP must not behave like that postal worker: it should carry every service's data as quickly as the connection allows, and let customers decide which services succeed.

Breaking net neutrality happens when an ISP uses its control of your connection to treat some online services better or worse than others. The problem is not that speeds differ; it is that the ISP is choosing winners and losers based on its own interests.

Favouring its own service

Some ISPs sell other products as well as broadband. Imagine that “Rivergate” supplies home broadband and also sells its own smart security cameras, “Rivergate Watch”. Customers pay Rivergate for the cameras and for the broadband that uploads their clips to the cloud. If Rivergate lets its own cameras upload at full speed but slows uploads from a rival brand, “HaloCam”, it is using its control of the network to help its own shop. A household might give up on HaloCam not because it is worse, but because the ISP made it frustrating to use.

Slowing a site it disapproves of

An ISP can also break net neutrality by slowing the speed at which customers can download pages or files from a site whose message it does not like. Suppose a local campaign group, “Friends of Marsh Lane Park”, runs a website arguing against a new building development. If the ISP’s directors back the development and quietly make downloads from that website slow for their customers, the ISP is using its position to limit who gets heard. The campaign site has done nothing wrong; the ISP is simply treating it differently from other sites because of its own opinions.

Why this matters

In both cases, the unequal treatment comes from the ISP’s decisions about traffic, not from the website or from your device. Net neutrality is designed to prevent this. ISPs can still manage their networks, but they must not favour or disadvantage particular services or customers because of their own preferences or commercial interests.

Net neutrality means an ISP treats all traffic equally, without favouring one service or customer over another. A difference in speed or access does not break it when the website or the device caused that difference rather than the ISP.

When the website sets the rule

A website can make its own rules about who sees what. For example, a school's learning site lets pupils who log in download the full revision packs, while visitors who are not signed in see only a sample page. The ISP still carries the school's pages to everyone in the same way, so the signed-in pupils getting more is the website's decision. The ISP is not favouring or slowing particular traffic, so net neutrality is not broken.

When the device has its own limit

Devices have different maximum download speeds. An old tablet may load a video more slowly than a new laptop on the same home network, because the tablet's hardware cannot handle as much data at once. The internet connection is the same for both; the older device simply cannot make use of all the speed available. The difference comes from the device, not from the ISP treating one service or customer unequally, so net neutrality is not broken.

Who caused the difference?

If the ISP is favouring or disadvantaging particular traffic, that is a breach. If the difference comes from the website's own rules or the device's own limits, it is not.

One benefit of net neutrality to organisations is level access and equality. It means every company's website and online service is treated the same way by Internet Service Providers (ISPs), no matter how big that company is or how much it spends.

No preferential treatment

Under net neutrality, an ISP cannot make one organisation's website load faster simply because that organisation has paid more or is a bigger customer. A national chain with a huge advertising budget gets the same treatment as a two-person business working from a spare room. The ISP is there to carry traffic, not to choose whose traffic deserves to arrive first.

This is about equal treatment, not identical service: an ISP can still manage its network to keep it running smoothly, but it must not favour or disadvantage particular services or customers.

Why this matters for smaller companies

Because of this equality, smaller companies are not pushed aside in favour of larger, wealthier competitors. A small business can reach customers on the same terms as a large rival, which supports fair competition and gives new or smaller organisations a real chance to compete online.

For example, imagine you print custom T-shirts in a converted garage and take orders through your own website, while a large clothing retailer sells similar designs. If the retailer could pay an ISP for a faster route to customers, your pages might crawl while its pages appeared instantly, and buyers would give up and go elsewhere. Under net neutrality, neither site can be slowed to make the other look better, so you win customers through better designs and quicker replies to questions rather than through the size of your bank balance.

Net neutrality therefore lets organisations of every size rely on the internet as a level playing field.

One benefit of net neutrality for organisations is that ISPs cannot block, slow or throttle their traffic, or prioritise traffic according to the ISP's own preferences.

Throttling means deliberately slowing down a connection or a particular service. Under net neutrality, an ISP cannot decide that one organisation's website should be slowed while another is sped up. It also cannot block a service, which would stop customers reaching it completely, or prioritise some traffic because it prefers that service or has a commercial interest in it.

This matters because an organisation's website and online services depend on ISPs delivering content at a fair speed and without interference. If an ISP could block or slow traffic, the organisation might lose customers, struggle to process orders or be unable to provide its online service reliably.

For example, a village bakery takes celebration cake orders through its website, and customers pay a deposit online. If an ISP throttled the bakery's site during a busy week or blocked it outright, customers would give up and buy from a supermarket instead, and the bakery would lose orders it had already planned to bake. The bakery has no way to force an ISP to deliver its pages at a fair speed.

Net neutrality is about equal treatment, not identical speeds: a small site may still load more slowly than a large one because of its own server, and ISPs can still carry out ordinary network management. What they cannot do is use that control to favour or disadvantage particular services or customers.

An acceptable use policy (AUP) is a document that sets out how an organisation's IT systems and devices may be used. It tells everyone who uses them what they are expected to do, and not do, with the network, computers, email and internet. Without one, staff would have to guess what counts as reasonable use, and the organisation would have no written rule to point to when someone behaved badly.

An AUP is part of an organisation's wider information security policy, the whole set of documents about keeping systems and data safe. Rules on passwords, backups and virus protection sit alongside it. The AUP is the part that deals with people's everyday behaviour, which matters because many security incidents start with a person's mistake.

Reducing threats

An AUP helps reduce internal threats from inside the organisation. Accidental internal threats are mistakes by someone who means no harm, such as emailing a file to the wrong contact. Malicious internal threats are deliberate, such as an employee copying a customer list before moving to a rival. It also helps reduce external threats, because outside attackers often get in through a weakness a member of staff leaves open, such as reading a login code aloud to a caller pretending to be from the IT team.

What it protects against

By making the rules clear, an AUP protects the organisation from staff misusing IT, stealing data, sharing confidential information, damaging its reputation, introducing malware and acting as a security weakness. Clear rules also give the organisation grounds to act when they are broken.

For example, a small karting circuit keeps records of who has booked and takes photos of customers at the track. If an employee posted a photo of a customer's crash on social media, the AUP would not physically stop them, but it would show they had broken a written rule, so the circuit could investigate and act. Honest staff also know where the boundary lies.

An AUP is not the same as an acceptable software policy: the software policy covers installing and using software, while the AUP covers how people behave when using IT systems.

An acceptable use policy (AUP) is divided into sections. The scope and assets sections set the boundaries for everything that follows: who the rules apply to, and what the rules protect.

Scope

The scope states who must follow the policy. It usually covers every employee, whatever their role, as well as managers, temporary and agency staff, contractors and volunteers. Visitors who are handed temporary login details may be included too. Depending on the organisation, the scope may cover the whole business or just one site, department or team.

The scope can also name the systems it covers, such as the payroll system, the staff intranet and the files kept on the shared drive, along with any personally owned device that connects to them. This matters because a policy that does not say who it applies to cannot be enforced against anyone.

Assets

The assets section lists the equipment, documents and knowledge that the policy protects.

• Equipment includes laptops, tablets, phones, printers, servers, network equipment and removable storage such as USB drives.
• Documents include client records, contracts, invoices, designs, staff records and reports.
• Knowledge covers what staff know, such as trade secrets, recipes, formulas, plans and ideas that give the organisation an advantage.

Naming the assets matters for two reasons. It tells staff exactly what they must protect, so nobody assumes the rules only cover the equipment they happen to be sitting at. It also shows the organisation what it holds and how valuable each asset is, so it can decide how much protection each one needs. A client contact database needs far more protection than a box of blank name badges.

The unacceptable section of an acceptable use policy (AUP) lists the behaviours that are never allowed when staff use the organisation's IT. It matters because staff need to see exactly where the boundary sits, and the organisation needs a rule written down before it can act on a breach.

What is ruled out, and the risk it creates

Make every rule specific

A rule such as 'staff must not copy customer orders to a personal device or personal cloud account' can be checked and enforced. A rule such as 'staff must be careful with data' cannot, because nobody can say for certain whether it has been broken.

For example, a bakery chain might write: 'Staff must not look up a customer's order history unless they are handling that customer's order or complaint.' Someone browsing a celebrity's cake orders has plainly broken it, so the organisation can point to the exact sentence it relies on.

The monitoring section of an acceptable use policy explains how an organisation checks and records whether staff are following the rules. Monitoring does not stop an action happening; it gathers evidence of what staff have already done, so their behaviour can be compared with the policy.

Ways behaviour is monitored

Blocking websites is not monitoring. Blocking stops a page from opening, so it controls behaviour rather than checking it, and it leaves no record of what a member of staff has done. Monitoring checks and records behaviour, so there is evidence that can be compared with the policy.

The sanctions section of an acceptable use policy (AUP) sets out what happens when a member of staff, or anyone else the policy covers, breaks the rules. It defines the process that will be followed and the penalties that can be applied, so nobody is treated unfairly or surprised.

The process usually starts informally with a quiet word. If the behaviour continues or is serious, it moves through formal stages, so the penalty matches how serious the behaviour was. A formal case normally begins with a disciplinary hearing: a meeting where the evidence is presented, the member of staff can explain what happened, and a decision is made.

Sanctions the organisation can apply

• A verbal or written warning. A written warning is kept on the person's file and used if the behaviour continues.
• Further training, where the problem was a lack of knowledge, such as not knowing how to report a data breach.
• Demotion or a reduction in pay, moving the person to a less senior job or lowering their pay.
• Suspension, sending the person home for a set period, sometimes without pay.
• Termination of employment, dismissing the person, for severe or repeated breaches.

Fines and legal action are not sanctions on the staff member. A fine or a court case is aimed at the organisation, for example from a regulator or a customer, and any police case is separate and is not run by the organisation.

The section matters because staff know the consequences before they break a rule, so the organisation can act consistently and staff cannot claim they did not realise how serious the behaviour was.

The agreement section is where a person acknowledges that they have read the acceptable use policy and agree to follow it. Until someone agrees, the AUP is only a document sitting on a shelf; it does not show that anyone has accepted the rules.

How agreement is shown

On a paper AUP, the person signs their name. On a digital version, they tick or click a box, for example when they first log on or when they open the policy in an online staff handbook. A digital version is quicker to collect and easier to store and check, but a tick box is still a valid way of acknowledging the policy.

The date of agreement is recorded, so the organisation knows when the person agreed and which version of the policy was current at that time. When the policy is updated, staff must agree to the new version, and the date shows who has already done so and who still needs to.

A paper AUP is often countersigned by a more senior person, such as a line manager. The countersignature verifies that the signature is genuine and shows that a named senior person has seen the document, so the member of staff cannot later claim they never signed it.

Why agreement matters

Agreement is what makes the policy enforceable. Because the member of staff has agreed, and the date is recorded, they cannot say they did not know the rules, so the sanctions section can be used. For the organisation, the signed or ticked agreement is evidence that staff were told what was expected of them. For example, a catering company updates its AUP on its staff intranet; when you log on, a box asks you to agree, and the system records the date and version beside your name.

Targeted advertising is when a social media platform uses the data it holds about you to decide which advert you see. The platform is not choosing adverts at random: it matches each advert to users whose details and interests fit what the advertiser asked for.

When an organisation sets up a paid advert, it can choose factors such as gender, age, location and interests. For example, a company selling revision planners might target 14- to 16-year-olds in Manchester who follow study or homework accounts. The platform compares those choices with the profile data it stores, such as your age, town and the pages you like, and shows the advert only to users who match.

Third-party cookies add to this picture. These are small files placed by a company other than the website you are visiting, and they record pages you view across different websites. If you spend time reading about camping tents on an outdoor shop's site, a third-party cookie can pass that interest to an advertising platform, which may later show you adverts for sleeping bags. Your browsing outside the platform can therefore shape the adverts you see inside it, and it helps the platform build a picture of what you like.

Because the data is different for each person, different users receive different adverts, and each advert is more relevant to that user's age and interests.

This is the aim of targeted marketing: to put an advert in front of the people most likely to want the product, rather than paying to show it to everyone. It also shows how personal and business activity can blur. Your personal posts, likes and browsing create the data that businesses use to aim adverts at you, so using social media for fun affects what commercial messages you receive.

A social media advertising campaign is a paid set of adverts placed in social feeds, so they appear between people's personal posts. Businesses use social media in this way because they can set the campaign up themselves, choose who sees it and change it quickly if it is not working.

Setting up a campaign

• Format: an image is quick and cheap and suits one clear offer, such as a free drink with breakfast; a video costs more to make but can show a product in use.
• Type of user to target: the advertiser picks the audience most likely to buy, so the budget is not wasted on people who will never be interested.
• Budget: the money set aside for the campaign; a bigger budget buys more showings to more people, while a small one means the advert appears less often.
• Duration: a few days to advertise an event, or several weeks to build regular custom.

What an advert is designed to do

A single campaign can use several purposes in turn: a trampoline park might run a video to build awareness, then a booking link to create conversions, then a form for a taster session to generate leads.

Analytics and trends show the business the demographics of the people who responded, such as their age, gender and location, and which adverts gained the most likes, comments and shares. Comparing an image with a video, for example, shows which earned more engagement, so the next campaign's budget goes on the format that worked.

An influencer, or paid content creator, is someone with a social media following who is paid to promote products or services. This is called paid promotion. The creator gains money or free products, while the business reaches a large audience.

Why both sides agree

The creator is paid a fee, or sometimes given free products, to feature a business in their posts. In return, the business reaches the creator's followers more quickly and widely than it could through its own account. For example, a small climbing gym pays a local climber with 30,000 followers to show its new bouldering wall in a short video. Many viewers already watch his clips and value his opinion, so the gym becomes known to people who have never visited.

Brand awareness and trust

This builds brand awareness: more people recognise the business and what it sells. It can also build trust, because followers already listen to that creator. A recommendation from someone they choose to follow can feel more believable than a company advertising itself. That trust depends on the promotion being honest; if you follow a creator and feel tricked, the creator's reputation and the business's image can suffer.

Advertising must be acknowledged

Some platforms require paid promotions to be clearly acknowledged as advertising. The creator might add a paid partnership label or state that the post is an advert. This tells followers that money or gifts were involved, so they can judge the recommendation fairly. It also makes the boundary between a personal post and business content visible: the same friendly video has become commercial promotion.

The boundary between work and personal life blurs when the same digital systems are used for both. Your phone, messaging apps and social media can be how you chat with friends and how an employer reaches you, which makes it harder to switch off.

Contact outside working hours

Digital systems make it quick for a business to reach staff, and some employers expect people to install a work app on their own phone. A notification about a changed shift or a customer message can arrive on a day off or after midnight, and because it is your own device you see it straight away. A read receipt that shows the message has been opened makes it awkward to ignore. As a result, staff may answer messages and complete small tasks outside their contracted hours, without extra pay — a swimming teacher replying to a booking message on a rest day, for example.

One account, two audiences

Your contact list and follower list hold everyone at once: family, friends and people you know through a job, with no switch to separate them. A message about a rota change sits between birthday messages, and a photo meant for friends lands in the same feed as a post about work. Because the audiences are mixed, your online behaviour can have professional consequences: a joke posted on a personal account, or a photo you are tagged in, may be seen by a manager, colleague or customer and damage your professional reputation.

Professional networks in your own time

Business-focused social networks are built for work rather than chat. In their own time, employees use them to build contacts, follow news in their field and look out for vacancies, and past colleagues stay in touch through them. Because a profile shows someone's roles and skills in one place, and contacts pass on openings, it is easier for employees to hear about a new role and move between jobs — sometimes without actively applying.

Employers often look at what you share online when they are deciding who to shortlist for a job. Checking someone's public posts in this way is sometimes called screening. A search of your name, profile and recent comments can reveal things that a CV would not.

What employers may learn

Your online activity can give an employer useful insight into how you communicate, what interests you and how you present yourself. For example, if you apply for a customer service role and your public posts show you politely answering questions in a local hobby group, that supports your application. The reverse is also true: rude replies or jokes that target a group of people can raise doubts about how you would treat customers or colleagues.

Your posts can be used against you

Personal posts can be seen by people outside your friends list, including employers. Even a post you delete may already have been screenshotted or shared. Privacy settings reduce the risk but do not make you invisible, especially if a friend's account is public or you comment in a public group. The same applies to anything you write on a public forum or blog.

This can affect your job prospects, your professional reputation and your employment. An employer might decide not to shortlist you or withdraw an offer, and an existing employee can face disciplinary action if their posts damage the organisation's image. A personal account is not automatically separate from working life: what you post online shapes how trustworthy, reliable or suitable you appear to an employer.

Processing personal data means doing anything with it: any action taken with information that can identify a living person. The person the data is about is called the data subject.

Processing covers a whole chain of actions, including:

• collecting it, such as asking for details on a sign-up form
• storing it, whether on paper, on a computer or in the cloud
• using it, for example looking up a customer's order
• sharing it with another organisation
• deleting it once it is no longer needed

Even small actions count. Opening a record, correcting a phone number or printing a list are all ways of processing personal data.

The law applies to organisations

In the UK, the Data Protection Act 2018 and UK GDPR work together as the current law. Any organisation that processes personal data, from a corner shop to a secondary school, must follow the data protection principles. These include processing data lawfully, collecting it only for the stated purpose, collecting only what is needed, keeping it accurate, keeping it only as long as necessary and protecting it.

The principles are legal requirements, not optional good practice. An organisation that ignores them can be investigated by the Information Commissioner's Office (ICO) and fined. For example, a youth football club collects players' names and medical conditions on registration forms, keeps them in a spreadsheet, uses them to contact parents about matches and deletes them when a player leaves. Each of those steps is processing, so each must follow the principles, such as asking only for the information the club genuinely needs.

Where the data is stored does not matter

The law follows the data wherever it is held: on a shop till, on a staff laptop, in paper files or in cloud storage, even when the cloud service runs on servers in another country. Moving data into the cloud does not pass responsibility to the cloud provider. The organisation that collected the data stays responsible for looking after it, so it should check how securely the provider stores and protects it.

Data protection principles are legal rules organisations must follow when processing personal data. In the UK they come from the UK GDPR and the Data Protection Act 2018.

The seven principles

Anonymising data removes identifying details so it is no longer personal data. A bus company, for example, can turn its journey records into anonymous counts of passengers at each stop, and then use those counts freely.

Data subject rights are the legal rights of the person a record is about, called the data subject. An organisation must respect these rights as part of data protection; they are not optional good practice.

Subject access means you can ask to see all the personal data an organisation holds about you and get copies. For example, a youth theatre group must show a member the contact details and attendance notes it keeps about them. If an organisation refuses to let someone see or obtain copies of their data, it breaks their subject access rights.

The right to be informed means you must be told how your data is used, including whether it is shared or sold. A puzzle app that passes your username to an advertising company should explain this clearly.

Consent is your permission for how your data is used. You also have the right to object to processing, such as asking a music streaming service to stop using your listening history to choose adverts for you.

The right to be forgotten lets you ask an organisation to delete all your personal data. The organisation must act if it has no further use for the data, or if you object to it being used for marketing. This is a right you must request; it is not automatic.

Breach notification means you have the right to be told if there is a breach of your data that is likely to put you at risk. If a climbing centre loses a tablet holding members' emergency contact details, it must tell the people affected when the loss is likely to put them at risk.

When you email more than one person, your email program gives you three address boxes: To, Cc and Bcc. Addresses typed into To or Cc appear in the header that every recipient receives. An address typed into Bcc (blind carbon copy) is hidden from the other recipients.

What each recipient can see

So the To and Cc lists are visible to all, the Bcc list is visible only to the sender, and the people in Bcc cannot see each other. If a recipient replies to everyone, only the To and Cc addresses are contacted.

Why this protects personal data

An email address identifies a living person, so it is personal data. Imagine you are collecting raffle prizes for a school charity fair and you email 15 local shops to ask. If every address goes in To, each shop opens a message listing the other 14 and learns who else you asked; some owners may not want a rival to know they are helping.

Putting the 15 addresses in Bcc means each shop sees only its own address and yours, so no address reaches anyone with no reason to hold it. That applies the protected principle: personal data is kept secure and seen only by the people who need it. As a rule, use Bcc for a group who do not know each other, and To when everyone may need to reply to all.

Bcc hides addresses, not the message: everyone still receives the same email and can forward it, so it does not keep the contents secret. It also works for a single hidden address. A student emailing a leisure centre about a cancelled swimming lesson can Bcc a parent, so the parent gets a copy while the centre never collects the parent's address.

A website must get your permission before it stores or reads information on your device. This information is usually in cookies — small text files — but the same rule covers other data saved by a site. The permission is called cookie consent.

Why consent is needed

Cookies can remember your login, basket or preferences, but they can also track what you do across websites so adverts can target you. Because the data is stored on your own device, the law gives you a say before that happens. The UK rule that sets this out is the Privacy and Electronic Communications Regulations (PECR), which grew out of the EU ePrivacy Directive. A site should not place non-essential cookies, such as advertising or tracking cookies, until you have agreed. Cookies the site needs in order to work, such as one that keeps you logged in, are essential, so those do not need your consent.

What a cookie banner does

A cookie banner is the message that appears when you visit a site. It explains what cookies the site wants to use and asks you to accept or reject them. Clicking accept gives the website permission to store cookies on your device, often including advertising and tracking cookies. Your consent must be a clear action: a site cannot treat you as agreeing just because you carry on browsing, and boxes must not be pre-ticked. For example, a music streaming site might ask to use cookies that remember the playlists you have made and also show you adverts for concert tickets. If you reject, the site should not use those optional cookies.

Cookies are not illegal. Using them is legal when the site asks for consent and follows the rules.

Intellectual property (IP) is original work created by an organisation or individual that the law can protect. It might be creative, such as a game character, or identify a business, such as a bottle's distinctive shape.

Why organisations protect their intellectual property

Original work usually has commercial value: it is what an organisation sells, what makes its brand recognisable, and what gives it an advantage over competitors. Protection stops others benefiting from that work without permission, so a rival cannot copy the game character and sell it as its own.

Protection gives the owner control over how the work is used and lets them make money from it, either by selling the work or by charging someone else to use it.

Protection is also an incentive. A studio will only spend two years and a lot of money developing a new game if it knows the finished work can be protected. Without that reassurance, fewer organisations and individuals would invest time and money in creating and innovating.

The main methods of protection

There are three main methods of protecting intellectual property:

Intellectual property is not the same as the data an organisation holds. Firewalls, encryption and passwords protect data, but do nothing to stop a rival copying your logo.

Infringement and the drawbacks

Infringing intellectual property rights means using protected work without permission. An organisation can take legal action against anyone who infringes its copyright, trademarks or patents, and can seek fines and compensation. If a small studio finds a rival selling T-shirts with its game character, it can go to court to stop the sales and claim the rival's profits.

Protection has drawbacks: registering trademarks and patents, and enforcing rights, is costly and slow, hitting small organisations hardest. Protection can hold back improvement: while a patent is in force, others cannot use or improve the invention without permission, so better versions may be delayed.

Copyright is an automatic legal right that gives the creator of an original creative work control over how it is used. It begins automatically when the work is created, so you do not have to apply for it. A copyright symbol (©) is useful because it reminds people who owns the work, but it is not required. A drawing with no symbol is still protected, and adding a symbol to someone else's work does not make it yours.

Expression, not ideas

Copyright protects the way an idea is expressed, not the idea itself. Imagine you tell a friend your idea for a maze game. Your friend can make their own maze game with a similar idea, but they cannot copy your program code, your character drawings or your level layouts without permission. Those are your expression of the idea.

Copyright can cover original literary works such as writing, dramatic works, artistic works, musical works, sound recordings, films and computer programs. So it can apply to something as different as a hand-bound comic sold at a school fair, the recording of a school orchestra's concert, or the code behind a mobile app.

What the holder can control

The copyright holder can stop others copying, renting or lending, performing, broadcasting, showing in public or adapting the work without permission. For example, a photographer could object if a café printed one of their photos on menus and posters without asking, because that is copying and showing the work in public. The right gives the creator control and a way to earn from their work.

Copyright protects a creative work, but the person who made it is not always the person who owns the rights. Ownership can change hands, the right runs out after a set time, and a few uses are allowed without asking.

Who owns the copyright

Copyright belongs to the creator of the work: the person who wrote, drew, composed or programmed it. Ownership can move, though:

• If an employee creates a work as part of their job, the employer usually owns the copyright. The employee was paid to produce the work, so the organisation that paid keeps the rights.
• Rights can be transferred to another person or organisation, for example by selling them or leaving them to someone in a will. Whoever receives the rights then decides how the work may be used.

How long copyright lasts

Copyright does not last for ever. It lasts for a period set by law, and the length depends on the type of work. Once that period expires, anyone can reprint, adapt or reuse an old book whose copyright has run out, without asking permission.

Fair dealing

Fair dealing lets you use a copyright work without permission in a few limited cases while the right is still in force: private study or research, education, criticism or review, reporting current events and private back-ups.

It is not a general permission to use a work however you like. The use must be fair, usually limited in amount, and must not take away the owner's chance to make money. Quoting two sentences from a geography textbook in a school project is fair dealing; scanning the whole book and publishing it online is not, because you copied far more than you needed.

A trademark is a recognisable sign, symbol, name or logo that identifies a company's goods or services. It is how customers spot a brand and tell one company's products apart from another's. For example, a football club's crest on a shirt tells you the shirt is official, and a drink's distinctive bottle shape tells you who made it.

Registered and unregistered

The two symbols that appear next to brands show the difference:

Many people assume a trademark happens on its own as soon as a company designs a logo. It does not. Unlike copyright, a trademark is not automatic: to gain legal protection the company must apply for it and have it registered.

What registration involves

Registering a trademark takes time and costs money, because the application has to be checked to make sure the mark is not too close to one already registered. It lasts for a fixed period rather than forever, but the owner can renew it, so a well-used brand can stay protected for a very long time.

Why it matters to a business

A trademark protects brand identity: the name and look that customers trust. Once registered, the owner can take action to stop others using a confusingly similar mark, such as a rival snack company bringing out a bag with the same colours, lettering and shape. If a copy is close enough that shoppers might pick it up by mistake, the owner can demand it is changed or withdrawn, and can take legal action against the copier.

Counterfeiting is the illegal use of a trademark on similar goods, such as selling fake trainers carrying a well-known logo. Counterfeiting damages the brand owner, because customers who buy poor-quality fakes blame the real company, and it damages the customer, who pays for goods that are not what they seem.

A patent is a legal right that protects an invention — a new product or process, and the way it works. It stops other people making, using or selling your invention without your permission.

What can be patented

Not every idea qualifies. To be granted a patent, an invention must:

• be new — nobody has made or published it before, so you cannot patent something that is already on sale;
• involve an inventive step — it must not be an obvious tweak to something that already exists;
• be capable of being made or used — it has to work in practice, not just be a theory on paper.

For example, a plug that switches itself off once a phone battery is full could be patented, because it is a new device that does a real job. By contrast, a short story cannot be patented — copyright protects the words you write, while a patent protects something that works.

Applying, paying and renewing

A patent is not automatic. You have to apply to a patent office and be granted the patent before you hold any rights at all. Applying is expensive, and it can take a long time while the office checks that your invention really is new. Once granted, the patent must be renewed, usually by paying a fee at intervals, or it lapses and stops protecting you.

The rights it gives, and what happens at the end

While the patent is in force, the owner has exclusive rights: they can stop others making, using or selling the invention, which lets them make money from it. They can also license the patent, letting another business use the invention for a fee, or sell the rights outright to someone else.

Protection does not last forever. Once the patent period ends, any business is free to copy the invention, because the details are published in the patent. That trade-off is what makes patents encourage innovation: an inventor gains a temporary advantage over competitors and a real chance to recover the money spent on research and development, so investing in new ideas is worthwhile.

Licensing is when the owner of intellectual property gives permission for someone else to use their work, under conditions the owner sets out. You need that permission before using protected work, unless a legal exception applies or a licence already covers what you want to do.

Licensing sets the rules

A licence is not a free-for-all: the owner decides exactly what is allowed, and the conditions are binding. Typical restrictions include:

• Non-commercial use only — you can use the work in a free project but not to make money, so a community newsletter is fine while a shop's advert is not.
• Share-alike — if you adapt the work, your new version must be released under the same licence, so nobody can lock up your improved version.
• No adaptations — the work has to be used exactly as it is, with no edits.

Break a condition and you fall outside the licence, which makes your use unauthorised.

Creative Commons

Creative Commons (CC) is a type of licensing that lets work be used free of charge, provided you keep to the conditions the owner has chosen. For example, a track marked CC BY-NC could be used in a school robotics club video, but not as background music in a company advert, because NC means non-commercial. A Creative Commons licence does not mean a work has no conditions and can be used however you like.

Attribution

Attribution means acknowledging the original creator when their work is used under a licence or with permission. Most Creative Commons licences require it. If you use a CC-licensed dragon illustration by a local artist on a club website, name the artist and state the licence, for example "Illustration by J. Okafor, CC BY 4.0", with a link to the licence terms. Credit does not create permission: attributing a song you had no right to use does not make that use legal.

Ethical use of intellectual property means treating other people's work fairly. It is about more than avoiding illegal copying: you respect the creator's rights, keep to the conditions of any licence, and give credit where it is due. Something can be legal but still unethical.

Legal is not always ethical

Imagine you download a free set of game sprites. The licence allows you to use them without crediting the artist, so using them is legal. If you publish a game and let players believe you drew the sprites yourself, you have still taken credit for someone else's work. Many people would call that unfair even though no law has been broken. Ethical use means not taking credit for another person's work, and not using it in ways the creator would object to.

When a licence does not cover what you want to do, ethical use means asking the creator for permission rather than assuming you can do it. If permission is given, you follow every condition attached to it.

Credit and conditions

Giving credit, often called attribution, means naming the original creator when you use their work. Some licences make this a condition; even when they do not, naming the creator is the fair thing to do. It shows that the work is theirs and helps other people find the original. Credit is not permission, though: naming the creator does not give you the right to use work that you have no licence or permission for.

Following licence terms is part of ethical use because the creator has set those terms for a reason. They might limit use to non-commercial projects, or ask that changes are described. Keeping to those terms respects the creator's control over their work.

Why organisations encourage it

Organisations should encourage ethical use as well as legal use. It builds trust with creators and customers, and it protects the organisation's reputation. If a company is known for using other people's work fairly, creators are more likely to let it use their work in future.

The Computer Misuse Act 1990 is the UK law that makes computer misuse a criminal offence. It was passed so that getting into a computer system without permission counts as a crime. The Act has been amended since 1990, so today's offences and penalties differ from the original version.

The offences

The Act defines three main offences:

• Unauthorised access — getting into computer material without permission, or attempting to do so knowing it is not allowed.
• Unauthorised access with intent to commit further offences — getting into a system without permission planning to carry out another crime as well.
• Unauthorised modification of computer material — changing data, programs or settings without permission. Intentionally spreading malware is treated as unauthorised modification.

Criminal use also includes creating malware and intentionally spreading it. Creating malware intended for use in an offence can be prosecuted as making an article for computer misuse; deliberate spreading is unauthorised modification. Accidental infection is not intentional spreading.

Current penalties

A later amendment added a further offence: making, supplying or obtaining articles for computer misuse, punished with up to 2 years' imprisonment and/or an unlimited fine.

An unlimited fine means there is no maximum fine set by law, so a court can impose any amount. A person can be imprisoned, fined, or both.

Worked example

Suppose you help out at a local swimming club and use one of its tablets. A link on the club's system opens a page of members' contact details that is meant only for club staff, and you know this. Opening it is unauthorised access, carrying up to 2 years. Opening it planning to change another member's details is unauthorised access with intent to commit further offences, up to 5 years. Actually editing the details is unauthorised modification, up to 10 years. A program that automatically edits every record could be making an article for computer misuse, up to 2 years.

Unauthorised access means gaining, or attempting to gain, access to computer material — a device, an account, a folder or a whole system — without permission, when the person knows the access is not authorised. It covers trying as well as succeeding: nobody has to get in for the offence to happen.

Why a failed attempt still counts

The offence is complete the moment someone tries, knowing they have no right to be there. The owner does not need to lose data or money, and a wrong guess does not make the person innocent.

For example, a student at a youth club edits the web address of the club's booking page to reach its admin area. The page refuses and shows an error, but they knew they had no permission and were trying to get in — so the offence has been committed even though nothing opened.

Ways it can happen

• Sitting at a classroom computer a teacher has left signed in and opening the folder holding next week's test.
• Signing in to a neighbour's home router with the default admin password printed on the sticker underneath it, then changing its settings.
• Guessing the PIN on someone else's tablet and reading their messages.

The route in might be another person's login details, password-cracking software or an unlocked machine. All of these are the same offence because of one shared fact: the person knows the access is not authorised. Weak protection does not make access allowed — permission is what matters.

Access with intent to commit further offences

This is the more serious offence: getting into a computer without permission and doing it in order to commit another crime, or to make one easier. That crime could be theft (copying a company's customer list and selling it to a rival), fraud, blackmail or harassment (using someone else's account to send cruel messages to their contacts).

It is punished more harshly because the break-in is only the first step — the person is using the access to cause far greater harm, so the law looks at the plan behind the access as well as the access itself.

Unauthorised modification means changing data, programs or settings on a computer system without permission. It is one of the three main offences under the Computer Misuse Act 1990, alongside unauthorised access and unauthorised access with the intention of committing another offence.

The change must be deliberate and made with no right to do it — a file that is damaged by accident is not this offence. For example, a pupil who edits the school's reward-points database to add 500 points to their own record has changed data without permission.

What counts as modification?

Installing malware counts as unauthorised modification, because it puts new files on a system and changes its settings without the owner's permission. Software can do the changing for you too: a free toolbar that switches a company's browser homepage and search engine to a different site has altered settings without permission, and a program that quietly creates extra user accounts has changed data.

Permission is the deciding factor. An IT technician updating a database as part of their job is authorised; someone making the same change without approval is committing an offence. Unauthorised modification can make records unreliable or stop software working, so the Computer Misuse Act 1990 sets a penalty of up to 10 years in prison and an unlimited fine.

Malware is software written to cause harm, such as damaging a device or corrupting files. Creating it and deliberately spreading it are both criminal offences, but the law treats them in different ways.

Creating malware

Writing malware can be treated as making an article for use in computer misuse. The offence is committed by producing the tool, not only by using it. For example, if you write a program that scrambles every document on a computer so its owner cannot open them, you have created malware. It does not need to have damaged anything yet: making a tool that is designed for computer misuse, intending it to be used that way, is enough.

Intentionally spreading malware

Deliberately distributing malware is also an offence. Spreading it on purpose is treated as unauthorised modification under the Computer Misuse Act 1990, because once the malware runs it changes data, programs or settings on someone else's system without their permission. Sending an infected game mod to a friend, uploading it to a shared cloud folder or copying it onto a school network drive on purpose are all examples of intentional spreading.

Intention is the key difference. If your own device picks up an infection and the malware copies itself to your contacts without you knowing, you have not intentionally spread it — the person who released the malware is responsible. Accidental infection is not the same as deliberately passing malware on.

Why it is treated seriously

Malware can corrupt data or damage a computer system. It might wipe a folder of coursework, change figures in a spreadsheet or stop a device from starting up. Because the harm can be serious and hard to undo, the law treats creating and intentionally spreading malware as criminal offences.

Malware can reach a device by more than one route. A route is the path a malicious program takes to get onto your system or to start running on it.

Infected removable storage

Removable storage devices such as memory cards and portable hard drives can carry malware from one device to another. The malware may be hidden in a file or program stored on the drive. When you connect the device and open that file, the malicious code can transfer to your computer and run. No internet connection is needed for this route, so an infected drive can still spread malware on a network that is otherwise well protected.

Unsecured or open Wi-Fi

An unsecured or open Wi-Fi network has no password or security key, so anyone nearby can join it. Because the network is not protected, a malicious device on it could intercept data you send, redirect you to a fake page or swap a file you download for an infected one. You cannot easily tell who else is connected.

Untrusted websites and downloaded files

Untrusted websites are sites you do not know or trust. They may offer free software, game add-ons or tools that hide malware inside the download. When you visit the site or download and run the file, the malicious program can install itself. For example, a pop-up advert might offer a free drawing app; the installer also copies harmful code onto your device.

Email malware is malicious software that arrives in an email and can be installed when you open an attachment or click a link. The email is only the delivery method: the harmful code is hidden inside the attached file or on the web page that the link opens.

You do not infect a computer simply by receiving or opening an email. The infection happens when you take the next step and run the attachment or follow the link, because that is when the malicious code is allowed to execute. For example, an email might claim to be a cinema sending your booking receipt, with an attachment called booking-receipt.pdf.exe. The end of the name tells the computer to run it as a program, but the .pdf part makes it look like an ordinary document, so opening it can install malware on your device. A link can work in a similar way: it may look like a normal web address but take you to a page that tries to run harmful code.

Reducing the risk

Treat unexpected attachments and links with suspicion, especially if the message is urgent, asks you to sign in, or comes from an address you do not recognise. Do not open the attachment or click the link.

• Do not open suspicious attachments or links: this stops any hidden program from running, so the malware never gets the chance to install.
• Delete the email: removing it reduces the chance that you or someone else opens it by mistake later.
• Report it: telling your email provider or school IT team can help them block the sender and warn other users, which protects them from the same message.