Teaching Middle Schoolers about the Privacy Threats of Tracking and Pervasive Personalization: A Classroom Intervention Using Design-Based Research

With the pervasive and evolving use of tracking and AI to make inferences about online platform users, it has become imperative for adolescents—a key demographic using such platforms—to develop a deep understanding of these practices to protect their privacy. Traditionally, K-12 cybersecurity education has largely been confined to extracurricular activities, limiting underrepresented students’ access. To resolve this shortcoming, we partnered with a rural-identifying middle school to deliver AI-related privacy education in classrooms. Using Design-Based Research methodology, we identified students’ AI-related privacy learning needs and developed six education modules. This paper focuses on the design, classroom implementation, and evaluation of module #2, covering the privacy threats of Tracking and Pervasive Personalization (TaPP). Student assessment outcomes show they developed transferable foundational knowledge of the privacy implications of tracking and personalization after participating in the TaPP module. Our findings demonstrate the benefits of integrating AI-related privacy education into existing K-12 curricula.


INTRODUCTION
The increasingly pervasive use of Artifcial Intelligence (AI) in some of the most popular online platforms frequented by adolescents has researchers worried about how this technology may violate or erode their online privacy and security [6].Extant literature shows that while adolescents value privacy, they fnd the rewards of sharing online worth the risks [21].Particularly, social media infuencers' sharing behavior [50], peer pressure and even default app settings motivate adolescents to share their lives online, making them more susceptible to privacy threats [2,21].Research shows that most adolescents' knowledge of privacy implications is limited to the "stranger danger" concept, the consequences of password sharing [67] and the interpersonal privacy threats of sharing their lives online (e.g., cyberbullying and revenge porn).In contrast, many adolescents lack the fundamental understanding that online activities generate data [67] used by algorithms to shape their broader online experience [88,101].Subsequently, adolescents remain oblivious to the potential privacy violations and/or discrimination they may be subjected to due to the tracking, collection, and use of their data for algorithmic decision-making [72,107].And while the outcomes of algorithmic targeting are generally less visible than the interpersonal issues that may arise from sharing on social networks, the privacy consequences of the former (which range from receiving unwanted or embarrassing personalized promotions [9] to unforeseen impacts on their college applications [101] and racial and gender discrimination in online job advertisements [72,107]) are generally more pervasive than the latter-especially for users who do not reach infuencer status.
These threats are particularly consequential for adolescents for several reasons.First, adolescents are walking the boundary between parental control over their internet exposure [7] and becoming independent denizens of online platforms [96].Second, adolescents' inherent tendency to engage in risky behavior [54] can leave a trail of unfavorable footprints that, when used in algorithmic decision-making (e.g., resume screening, video analysis for job interviews, criminal risk assessment), are likely to misrepresent their evolving identities, hindering future endeavors.Finally, the lack of legislative protection (for example, in the US, protections under the Children Online Privacy Protection Act (COPPA) end at 13 years) [93] renders them further vulnerable.
To address these enduring challenges, we partnered with a rural identifying middle school in the Southeastern US, where we implemented six AI-related privacy education modules in teacherfacilitated classrooms.The modules teach them foundational concepts of AI-related privacy that go beyond "tips and tricks" and "best practices" to help develop transferable understanding and relevant skills.The topics of our education modules-AI Agents and Tracking, Tracking and Pervasive Personalization, Virality, Misinformation, Filter Bubbles, and Algorithmic Bias and Fairness-were informed by students' learning needs and teachers' recommendations derived through student interviews and participatory design sessions with the Math and Computer Science teachers.The current paper covers our fndings regarding the Tracking and Pervasive Personalization (TaPP) module.

Motivation
In the feld of AI-related privacy, risks evolve at an accelerating pace: advances in AI technology perpetually enable us to engage in novel online experiences that come with novel threats to our privacy and security.So, to efectively manage evolving AI-related privacy threats, it is imperative for adolescents to develop a "deep understanding" [83] of the underlying algorithmic processes that violate their privacy [87].When students gain a deeper conceptual understanding, they learn to transfer their understanding to realworld settings [79], thus helping them develop strategies to manage AI-related privacy threats efectively-and adapt those strategies as the threats evolve.
While current K-12 Computer Science curricula teach students basic cybersecurity principles [35], they take a basic "digital literacy" approach [80]: Students learn "best practices" and "tips and tricks" about the confdentiality-integrity-availability (CIA) triad, cryptography, network security, viruses and malware, and the promotion of cyberawareness and cybersafety, which do not produce understanding of the underlying processes [35].So, at school, adolescents do not develop usable knowledge to efectively manage pervasive and evolving AI-related privacy threats.Furthermore, there exist several AI-related privacy education eforts for adolescents in the form of summer camps, workshops, or online self-learning [3,8,35].While these eforts are an important part of the multi-prong approach to addressing this complex issue facing adolescents (e.g [67,106]), they similarly often fail to facilitate "deep understanding" [83,96].Additionally, as advances in educational research eforts (e.g., [3]) are not reaching classrooms, many adolescents do not receive the education [82].Particularly, extracurricular education tends to be less accessible to adolescents from limited-resource backgrounds [62] (e.g., due to the high cost of enrollment [18], time requirements, underdeveloped personal interests, lack of guidance, etc.).
To resolve these issues of equity and inclusion, our research integrates AI-related privacy education into existing K-12 curricula.This has several advantages.First of all, classrooms ofer access to education regardless of socioeconomic background, time availability, or interest [4,90].Access to AI-related privacy materials is crucial for all, but even more so for adolescents hailing from underrepresented, limited-resource backgrounds or rural communities who tend to have limited guidance around digital privacy [7,55], are generally more enthusiastic about online communication and relationships [60], is generally more likely to adopt social media platforms [55,96], and are disproportionately afected by privacy threats [45].To specifcally account for the limitations faced by underfunded schools, we purposefully collaborated with a rural, identifying, low-resourced school district in the Southeastern United States that serves a high-needs student population.Moreover, by targeting middle school students, we are able to educate them before they are legally allowed to drop out of school (at our location, at the age of 17), thereby even catching the small but signifcant proportion of students (in our specifc district: 4.1% [70]) who eventually drop out of high school.In short, conducting privacy education intervention studies in teacher-facilitated classrooms is a step towards ensuring every child receives the education they deserve [82].
Another reason to advocate for in-classroom privacy education is that adolescents require long-term exposure and guidance to develop a "deep understanding" of AI-related privacy [48].Most eforts in this feld lack a foundational, theory-based pedagogical approach that promotes such an in-depth understanding of the principles [33].Our fundamental goal is to transform the feld from "best practices" that result in a mere "amorphous understanding [35]" of the subject matter to a theory-based pedagogical approach that allows students to develop a "deep understanding" of AI-related privacy threats.To accomplish this goal, our education modules draw parallels between AI-related privacy and the math and computing principles that underly the content being taught, akin to [35].Importantly, students are supposed to learn these math and computing principles anyway-indeed, the only way to justify the classroom time needed to integrate our modules into students' existing curriculum was to ensure that the modules would also teach students math and computing knowledge in accordance with state-mandated standards.We argue that this integration of AI-related privacy knowledge in existing math and computing classes helps students develop robust and transferable conceptual skills they can use to protect themselves despite continuous technological changes (and their social context) [59,65,66,73,95].
Finally, integrating education materials into the existing K-12 curriculum will contribute towards bridging the gap between research and practice by developing curriculum and educational materials in collaboration with school teachers.Such an efort to increase teacher involvement gives teachers more agency over the education materials and provides opportunities for evidence-informed practice, thereby giving teachers the fexibility to adaptively implement our research in practice [82].

Contributions
In this paper, we present our process of integrating AI-related privacy education in existing K-12 curricula, using our TaPP module as an example.We also present the outcomes of our extensive evaluations of the efcacy of the TaPP module.As such, this paper makes the following contributions: • Teacher-facilitated, in-classroom intervention: Our effort moves AI-related privacy education from an extracurricular setting into the existing K-12 curriculum-something that is largely considered "uncharted territory" [35] in the feld of privacy education-thereby ensuring that our research reaches the classroom (as per [82]).Unlike many other studies [89] 1 , our study is conducted in the classroom during the academic year and taught by the students' regular teachers.This efort takes a step towards removing a critical barrier that has heretofore prevented equitable access to such education.The results of our study can be used as empirical evidence to advocate for integrating privacy education in existing K-12 curricula [4].• Teacher involvement in curriculum development: Integrating any additional topics into the existing K-12 curriculum requires navigating delicate infrastructural and policy requirements, such as the need to satisfy state-mandated standards, ensuring new materials are cohesive with the established curriculum while preparing students for their state-wide exams and providing teachers with the resources needed to give them sufcient expertise and comfort in teaching these new topics.To integrate our AI-related privacy modules into the existing school curriculum in a time-, resource-, and teacher-friendly manner, our development and implementation process crucially depended upon continuous collaboration with teachers (i.e., via weekly feedback meetings at every stage of the module development and deployment process), which is a novel approach in privacy education research [35].Collaborating with teachers provides distinct advantages [85]: Teachers have pedagogical expertise, and they have daily interaction with students and therefore understand what concepts best relate to them and how to best present these concepts.Furthermore, involving teachers in the creation of the education materials allows them to adopt the materials without much additional workload, and to adapt their teaching strategies in case of unprecedented events in the classroom [79].Finally, collaborating with teachers also meant that we received targeted, efective feedback to help improve the integration of our privacy education modules in the classroom.[15], which may lead to concerns about the validity of the evaluation of the efcacy of the intervention.To alleviate such concerns, we employed Design-Based Research (DBR) [15], a mixed-methods research methodology specifcally designed for conducting classroom interventions [4,44,90].In using this DBR approach, our paper contributes not only the results of our TaPP module evaluation but also provides a methodological roadmap of how to conduct intervention studies in teacher-facilitated classrooms that can be adopted by other privacy/computing education researchers.In line with the DBR approach, we report and refect on our eforts supported by formative, summative, and refexive evaluation methods.

BACKGROUND
This section presents extant studies on privacy implications of data tracking and pervasive personalization, adolescents' knowledge of the topic, and the status of privacy education curricula.

Data Tracking, Personalization, and Privacy Threat
The rise of online platforms and the advent of powerful machine learning technologies has spawned a thriving ecosystem of technologies that track user behavior to create profles that inform algorithmic decisions [47].One common outcome of those algorithmic decisions is personalized content that is contextually relevant to the user's interests.Personalized content increases user engagement and retention by providing users with the information or products they seek [58].As a result, these technologies have been widely adopted by businesses and government agencies to create personalized solutions, ranging from targeted advertisements to legal and judiciary processes [14].
To generate these personalized solutions businesses rely on user profles generated by extensively tracking users' demographics (e.g.age, gender, location), online behavior (e.g., friend network, type of device, time of use) and browsing habits (e.g., search terms and click streams) [1,32,61,91].In addition to tracking, profles are built by sharing data between devices, websites, and application platforms [105].
Over the years, the use of data tracking to generate personalized advertisements also referred to as "programmatic advertising" [28], has become ubiquitous, generating higher conversion than any other form of digital advertising [43].This apparent success has sprouted an intricate ecosystem of inter-website third-party tracking tools [28,76] that collect an array of user information, both overtly and covertly [1,13,76].Businesses can use this data, such as purchase patterns, to identify pregnancy and delivery dates, which allows them to show targeted ads relevant to pregnancy and childbirth, or they may use demographic information to adjust product pricing to maximize proft [9,107].When users perceive such personalized recommendations as benefcial, they are more amenable towards them, which in turn increases their comfort level [74,97] and their tendency to share their data.In the long run, though, this covert, pervasive data collection tends to raise privacy concerns [1,56,69] and makes users feel discomfort about data tracking [9,91].Moreover, as data accumulates, users often tend to consider the highly personalized recommendations generated from cross-platform tracking as "creepy" [94] and a violation of their privacy [34].
Aside from privacy issues around unwanted programmatic advertising, personalized content can also be discriminatory: in the past, systems have shown higher prices for standardized test preparation based on demographics, recommended high-paying and executive jobs to male users more than female users, and produced more arrest records when searching for stereotypically Black names as compared to white names.[72,107].
To summarize, data tracking and personalization can adversely afect people's lives-especially vulnerable people's lives-when they are used to make decisions about supportive housing, unemployment benefts, foster home placement, policing, detention, etc. [14].Understandably, users across all age groups, including adolescents, are concerned about having their online behaviors tracked, profled, and categorized as a stereotype [9,69].Regardless of these concerns, though, research suggests that adolescents do not fully comprehend the mechanisms that track their actions online [9].As a result, they do not know how to protect their online privacy [9], rendering them vulnerable.The following section, therefore discusses adolescents' knowledge of data tracking, pervasive personalization, and their privacy implications.

What Adolescents Know about Data
Tracking, Personalization, and Privacy Implications The majority of adolescent Internet users reported instances of online privacy violations where they could not help themselves, indicating how vulnerable and unprepared adolescents' are to manage their privacy online [6,96,99].To protect their privacy, both children and adolescents desire more control over their online data [2], and often fnd the lack of control over personal data creepy [100].However, efective control over one's data requires an understanding of who collects their data, why it is collected, and how it is used [46].Research shows that 79% of adolescents' understanding of privacy is limited to the consequences of sharing information like photos, names, passwords, and other personal details with strangers [22,57].When discussing potential privacy threats, they report concerns around "personal data being stolen by unknown actors, " and their eforts to protect their personal data are focused on protecting their account details and personal profle [71].In an increasingly data-driven world, privacy threats extend beyond such interpersonal situations to data tracking and the use of data for personalization.Privacy on the internet often involves novel platforms and technologies that many do not thoroughly understand [30].This is especially true for adolescents, many of whom do not understand the algorithmic decision-making processes that exploit their personal data for such purposes [48,103].As a result, a majority of adolescents have not developed mental models that can help them make informed decisions around data privacy [48,103].Furthermore, many adolescents struggle to conceptualize algorithmic decision-making due to the abstract, intangible nature of the process [53]-this is similar to the struggles of non-experts in the AI domain in general [64].Consequently, most adolescents tend to be unaware of the privacy threats stemming from the use of personal data for algorithmic decision-making, they generally do not know how algorithmic predictions can shape future outcomes, and they usually have little knowledge about how to protect their data from such practices [71,102].This, combined with their youthful lack of discretion, renders them vulnerable to unwanted advertising and discriminatory practices [2].
To summarize, while most adolescents have a rudimentary understanding of privacy, many have neither the knowledge nor the skills to protect the privacy of their data.In a world of widespread data tracking and algorithmic decision-making, protecting one's data privacy requires a robust understanding of AI and its privacy implications.The next section addresses existing education eforts on this front and identifes what these eforts are lacking.

Current Status of Privacy Education for Adolescents
Privacy and cybersecurity education, a subset of the broader CS education curriculum, has received much attention across all education levels, covering topics such as cryptography, network security, cyber-attacks, viruses, malware, hacking, ofensive security, social engineering, cryptography, authentication, and authorization [35,71,89].The abstract nature of the concept of privacy continues to keep the subject opaque [30], with many education eforts promoting general cyber-awareness and cyber-safety rather than specifcally addressing AI-related privacy threats, such as the consequences of tracking and personalization.Within the K-12 classroom, privacy education is part of the CS education curriculum [35].However, most curricular standards on privacy are limited to "tips and tricks" and "best practices" [80], which do not address AI-related privacy in a way that allows adolescents to cope with, rather than avoid, data tracking and pervasive personalization [35].
Surprisingly, then, AI-related privacy education is not a part of the K-12 curriculum and is instead typically ofered as extracurricular activities, sometimes as elective courses, or as online self-study resources [35].Note, though, that fewer than 10% of all AI and/or privacy education interventions are conducted with adolescents [89], and the ones that are, typically teach adolescents to abstain from sharing information online or to only use online platforms under adult supervision and control of access [21]-an approach that is both inefective (research shows a negative correlation between parental monitoring and adolescents' online privacy [21]) and impractical (since even K-12 education itself has shifted towards a more digital landscape).Furthermore, most of these extracurricular teaching activities (e.g., "Fakesbook" [106] and "KidPrivacy" [67], as well as recent studies that have taught data mining techniques using high-level software tools with middle school students [17,26]) are not tailored to students in rural and low-income school districts [60] (e.g., they command device dependency [25]), and only few of them are responsive to learners' prior knowledge, include instruction for teachers, or ofer assessment/learner feedback [25].Finally, as most of these activities involve one-of interventions over a short time period [17,89], they are also considered insuffcient, as adolescents require long-term exposure and guidance to sufciently conceptualize and develop mental models around tracking and personalization [41,48].

How can we meet Adolescents' Privacy
Learning Needs?
While it is likely that existing privacy education activities are delivered in the form of extracurricular activities simply because they are easier to conduct, we argue that it may be worth the efort to integrate AI-related privacy education into existing K-12 curricula and classrooms, so as to provide all students with sufcient guidance and resources to develop fundamental knowledge of complex topics like data tracking and personalization.Indeed, adolescents require constant guidance, sufcient scafolding, and nudging from educators and adults to conceptualize such complex topics [41,53].
To provide a more holistic picture of the data tracking and collection process, privacy education must also be a collective experience: learning about others' experiences makes adolescents cognizant of their selective exposure to online platforms and devices [30].Furthermore, as privacy-preserving decisions are infuenced by social circles and peers, it is imperative to implement interventions at a collective level (e.g., in a classroom) so as to create more sustainable behavior changes.This supports our position on moving AI-related privacy education from extracurricular activities to classroom education and from basic digital literacy approaches to a more fundamental understanding of the underlying personalization mechanisms.Conducting intervention in teacher-facilitated classrooms during the academic year presents a series of challenges, though.Firstly, teachers may not have the domain expertise to efectively teach this topic-an intervention must therefore not only teach the students, but also the teachers.Furthermore, when developing teaching materials in low-resourced schools such as the one we collaborated with, any additional teaching activities must be tightly integrated into the existing curriculum and meet state standards to justify the time and efort spent on them [51].A sizeable body of literature collaborates with K-12 teachers to determine teachers' knowledge requirements and conduct training sessions [84].Nonetheless, resource limitations and teaching material issues continue to persist.
To address these challenges head-on, we collaborated with a rural, low-resourced middle school to integrate AI-related privacy education into their existing curriculum.Two teachers were directly involved in the identifcation of students' learning needs, the development of the materials, and the implementation of the materials in their classrooms.This paper discusses the design, implementation, and evaluation of the TaPP module, which covers one of six topics we identifed as a key student learning need.

METHODOLOGY: CONDUCTING EDUCATION INTERVENTION IN CLASSROOMS
In this study, we aim to teach middle-school students about AIrelated privacy implications in teacher-facilitated classrooms.
Because classrooms are naturalistic settings that are unpredictable and complex [4,15,75], traditional research methods are not recommended for evaluating classroom interventions [15].For example, controlled experiments are unsatisfactory in exploring outcomes from classroom research [68]: treating a classroom like an experimental setting ignores the many confounding factors that exist in classrooms [15,68] while enforcing experimental control creates an unrealistic environment-either solution would produce invalid results.Furthermore, implementing a randomized control protocol in a classroom setting raises moral issues of excluding students in the control group from receiving the intervention [15].Therefore, we employed "Design-Based Research"(DBR) [15], a metamethodology that has been specifcally designed for conducting classroom research and studying learning in situ that is responsive to the contextual elements of the classroom and its potential confounds [68].

What is Design-Based Research?
Easterday et al. characterize DBR as having a research component and a design component [27].The research component focuses on problem identifcation, data collection, intervention methods, and contextual analysis of intervention outcomes [39].The design component is used to develop curricula, learning materials, and instructional strategies [5,90].The research and design components' functions are executed in the fve phases (see Figure 1): focus (identifying students' learning needs), understand (learning about the classroom context), defne and conceive (identifying learning outcomes, activities, and assessment methods), build (developing learning activities and assessments), test (implementing the instructional tools in the classroom), evaluate (assessing whether the learning activities positively impacted students' learning), and present (refecting on the outcomes to identify features of the instructional tools that successfully addressed the initial learning needs) [27].
Completing the present phase concludes the frst iteration of DBR, and is usually succeeded by another iteration of designing, testing, evaluating, and presenting.Iterative refnement of design, test, evaluation, and refection is the key methodological feature that makes DBR powerful [77].Each iteration collects new data about the classroom needs and students' role in their learning.These data inform the redesign of the curricula, learning materials, and intervention methods, thereby improving the implementation and education value for the next iteration.This approach motivated us to conduct a pilot study, allowing us to gain hands-on classroom research experience and use the outcomes to make data-informed design and implementation decisions in the main study.We purposefully chose an adjacent but  not identical topic for the pilot study, so that the outcomes of the pilot would not unduly infuence the outcomes of the main study.One of the most commonly faced methodological issues in DBR is the tension between adhering to a strict research protocol and making an intervention "work" in a complex setting, which often necessitates changing the intervention as it unfolds [78].These changes make experimental control challenging [40,68], thereby raising concerns about the validity and reliability of the results (i.e., can students' knowledge gained be attributed to the intervention?).So, while DBR design interventions can be tested in an experimental setup, experimentation typically assumes a supporting role in DBR, producing results that are only meaningful when amended with additional data collected through naturalistic inquiry.DBR facilitates such data collection, thereby ensuring rigor [78].Indeed, DBR researchers recommend using a diversity of methods to accommodate the possibility of design protocols that are enacted diferently than planned [39,90].Whereas exposing people to the intervention will inevitably lead to quantifable knowledge gain, understanding how the intervention contributes to knowledge acquisition comes from more in-depth probing [15].

Why we chose DBR
Our goal of integrating AI-related privacy education materials into the existing K-12 curriculum requires us to evaluate our intervention in an in-classroom study.As such, we argue that DBR is the most suitable research methodology for creating usable knowledge about how our education materials can be integrated into existing curricula for the following reasons: • The fundamental tenet of DBR is to build a connection between educational research and real-world problems [5,40,90] by partnering with K-12 schools and instructors [90].• DBR is a longitudinal classroom research framework that produces usable knowledge through iterative design refnement based on teacher and student feedback [11].
• DBR provides a tried and tested [92] classroom research approach that produces evidence of its efects across multiple settings, generates plausible causal accounts that can be linked with experiments by assisting in the identifcation of relevant contextual factors, and enriches our understanding of the nature of the intervention itself [15,19,77].
In the following sections, we present our focus phase, where we identifed students' learning needs using a series of semi-structured interviews and a participatory design session (section 4).We then conduct two iterations of the design, test, evaluate, and present phases: The frst iteration is a pilot study about AI Agents (section 5), while the second iteration constitutes our main study, i.e., the Tracking and Pervasive Personalization (TaPP) module (section 6).

Participant Recruitment and Consent
Our study was conducted at a low-resource, rural-identifying middle school in the Southeastern US serving a high-needs student population.The entire school population (229 students in grades 5 through 8; ages 13 to 18) received the educational elements of the module2 , 99 of whom had given assent and parental consent to participate in our research activities, which allowed us access to their pre-and post-test results and their in-classroom observational data.
For the semi-structured interviews (section 4.1), we invited 32 consented participants, who were compensated with 10 USD gift cards.For the main intervention study, 87 of the 99 consented students participated in all the activities and assessments.The data from these 87 participants (i.e., the qualitative data gathered during the refection activities and the quantitative analysis of their preand post-test answers) are presented in section 6.We compensated all students who participated in the module with 5 USD gift cards.

FOCUS PHASE: IDENTIFYING LEARNING NEEDS
We conducted two activities in the focus phase of our DBR process: a semi-structured interview study to identify students' learning needs and a participatory design study with the two main Math and CS teachers of the school to translate these learning needs into education topics.

Semi-Structured Interviews with Students
4.1.1Interview Procedures.We conducted hour-long semi-structured Zoom interviews with 32 consented students (for demographics, see table 1a) to investigate their understanding and learning needs regarding AI-related privacy threats.We asked participants about their online experiences, technology use, privacy practices, experience with online threats, knowledge of AI, the role of AI in their lives, and possible AI devices that they used or interacted with.The interview protocol can be found in section A in the Appendix.We iteratively interviewed participants, interpreted their responses, and updated the interview protocol until we reached saturation at 32 participants.AI perception: Most students across all grade levels consider AI to be robots, with a small percentage of 8 th graders associating AI with conversation agents upon probing: "It's a like a robot controlling things... like a computer controlling stuf." -P10 7 th grade Male , 7 th AI recognition: 6 th , and 8 th graders students told us they have personal cell phones and social media accounts, with YouTube being their most used platform.Yet, they did not recognize these systems as powered by AI technology, nor did they believe that they use AI daily.Upon further probing, participants told us that they indeed have experience with, e.g., YouTube's recommended videos and often rely on those recommendations.Participants even talked about targeted ads, but they did not equate recommendations or ads with AI or data tracking.The following quotes show evidence of students' lack of AI recognition: "My daily life, not really.I don't see artifcial intelligence, most of the time." -P9 8 th grade Male "Yes, because I'll be talking to my friend on FaceTime or something and then it's like about a specifc thing, like, the other day it was about Jordan [...] and then all of a sudden TikTok shows me pictures or videos of ships and stuf.Yeah, really good." -P3 8 th grade Female How AI works: At this point in the interviews, we would explain to students how the YouTube recommendations or the targeted ads they encounter are indeed examples of AI.When we subsequently asked students to refect on how these systems work, students' responses were unsatisfactory.Some students referred to recommendations as a naturally occurring process, while others considered it as random or a "mind of its own": "I think it's random because there are some random set up on the app everywhere, and I was just like oh this sounds interesting." -P11 5 th grade Female AI Engagement: Finally, we found that students do engage with targeted ads and recommendations.They also had experience with smart home devices like Alexa or voice assistants like Siri.However, students did not consider their interaction with targeted ads or recommendations as engagement with AI.Students associated conversational agents with AI after probing, but until then, they had not considered those interactions as engagement with AI either.
To understand if students had any mental models regarding algorithmic decisions and data tracking, we continued to probe on the topic.Upon probing, we realized that students who have their own online accounts have high-level and disconnected mental models around tracking and AI and could even begin to connect them with our help: "There's 'videos are liked by you'.So they give you some similar kind of suggestions, every time you open the link." -P20 8 th grade Male Privacy practices: We fnd that students' understanding of privacy is limited to "tips and tricks" regarding stranger danger, the risks of password sharing, and reporting anything bad (e.g., untoward messages) to their parents: "I just know to block people that I don't know, because of stranger danger." -P4 6 th grade Male "If it's something like that, then I'll tell my mom about it and usually let her handle it." -P32 8 th grade Female Privacy concerns: Even after probing, students did not associate the pervasive use of AI systems with potential privacy implications.Specifcally, only 2 out of 12 8 th -grade interviewees were vaguely familiar with data tracking and pervasive personalization, while students at lower grade levels did not associate their online activities with the privacy threats of tracking and pervasive personalization at all.This particular fnding allowed us to identify the privacy threats of tracking and pervasive personalization as one of the key learning needs during the participatory design session.

Participatory Design with Teachers
Following our interview study, we conducted a participatory design session with the two main Computer Science and Math teachers.Similar to participatory design sessions in HCI, our goal was to extract learning needs from the interview fndings and turn them into education module topics.learning needs as potential module topics.Next, two groups-led by the teachers-each outlined a preliminary module for half of the topics, highlighting for each topic its potential alignment with existing standards and curricular activities, students' topic-specifc needs, and teaching strategies to address these needs.Subsequently, each group presented their module designs to the other group, followed by a discussion.Finally, we had a plenary discussion to fnalize the topics, curricular design strategies, implementation ideas, and teaching strategies.The TaPP module topic emerged from our awareness that AI advancements have amplifed the privacy and security concerns related to data tracking and pervasive personalization.Teachers informed us that the majority of middle-school students are unaware of the fact that their online activities are being tracked and used for algorithmic decision-making, and they acknowledged that students are consequently oblivious to the real-life, long-term privacy implications of these practices (examples related to housing, loans, credit card applications, and criminal risk assessments were mentioned).However, since middle schoolers are unable to conceptualize the abstract processes that leverage their online footprints to create these adverse outcomes, many are unable to think carefully about data tracking and, therefore remain uncommitted to take action.Thus, we decided that in the TaPP module, students must gain a conceptual understanding of tracking and pervasive personalization, its implications, and potentially actionable privacy practices to avoid negative consequences.

DESIGN-TEST-EVALUATE-PRESENT ITERATION 1: AI AGENTS MODULE (PILOT STUDY)
This section covers our frst design-test-evaluate-present iteration, covering the pilot study of the AI Agents module.Note that this module was not formally evaluated since its purpose was to get a better understanding of the domain and the context in which our modules were going to be deployed.

Design Phase
In the understand step, we collaborated with the teachers to further unpack how to present the module topic within the domain (classroom) and the context (state standards, school requirements, teachers' learning goals).In the subsequent defne and conceive step, we formally defned the learning outcomes and developed the essential questions students would learn to answer in the module.In the build step, we then collaboratively developed learning activities for the Computer Science and Math classrooms to satisfy these learning outcomes (see table 2).
In Computer Science, students interacted with a chatbot, inspected its underlying high-level code, used the block coding feature to build their own chatbot, and then evaluated each others' chatbots (see section B.1 in the Appendix).Additionally, students engaged in teacher-facilitated class discussions.
The Math activities were tailored to the student's grade level and engaged students with the mathematical principles behind sentiment analysis and algorithmic decision-making to show how the chatbot leverages collected conversation data in various ways [104].In activity 1, students conducted a guided data analysis on the "personality scores" the chatbot assigned each student based on their conversation data.In activity 2, students solved linear equations to determine the sentiment of a user's response-something they had used in a conditional statement in their own chatbot.

Test Phase
All activities were conducted in the classroom and facilitated by the students' Math and Computer Science teachers (i.e., the researchers had no direct interaction with the students).Teachers observed students' engagement with the module and reported back to the team.The chatbots created by the participants were also available to the team for evaluation.

Evaluate Phase
On the positive side, teachers reported that the students were generally excited to learn about the inner workings of chatbots in the Computer Science activities.They also noted that students could critically refect on the wealth of data collected by the chatbots in the Math activities.Furthermore, they reported that the data analysis and linear equation activities, which were tailored to each grade level, nicely connected to relevant Math standards.
On the negative side, the Computer Science teachers refected that 5 th and 6 th graders struggled to develop their chatbots programmatically.These students felt "lost and unsure" during this activity and required much more time than scheduled to complete the task.Students also seemed to prefer using pen and paper-based methods to conduct tasks rather than their computers, and they preferred working in groups for better engagement and learning.

Present Phase
The pilot study helped us garner classroom research experience and allowed us to better understand the domain and the context.The key outcome of the pilot was the importance of understanding students' preparedness for the module: 5 th and 6 th graders' difculties creating their own chatbot demonstrated the need to more carefully design developmentally appropriate activities relative to learners' knowledge and skill levels-this principle was adopted as a central design focus for subsequent education modules, including the TaPP module.

DESIGN-TEST-EVALUATE-PRESENT ITERATION 2: TAPP MODULE (MAIN STUDY)
Leveraging the fndings from our pilot study, we conducted a second design-test-evaluate-present iteration for our TaPP module.To formally evaluate this module, we conducted a quantitative preand post-test of students' knowledge to complement our qualitative evaluation sources (i.e., teacher feedback and student artifacts).We also conducted a more formal refection on the module's contribution, design, and implementation with the teachers.

Design Phase
In line with DBR methodology, our Design phase consists of an Understand step, a Defne and Conceive step, and a Build step.We split the latter into a Build Activities sub-step and a Build Assessment sub-step.
6.1.1Understand.As per the fndings from the pilot study (section 5.4) and in close collaboration with the two teachers, we outlined a series of more developmentally appropriate lessons that aligned with state and school curricular requirements of the respective grade levels.The lessons were scafolded into small sections for ease of understanding and to accommodate unpredictability in students' schedules.The lessons were developed to be low-tech and web-based, and all activities were completed in groups.
6.1.2Define and conceive.We developed learning outcomes and assessments around the following essential question: "What are the privacy implications of data tracking and use for algorithmic decision-making?" (see Table 3).We iteratively refned the learning outcomes and assessments until teachers deemed them satisfactory to delivering deep and transferable understanding [83].cilitating deep level understanding) use targeted ads as an example the knowledge to others), Apply (applying the knowledge to a of personalized algorithmic decisions because students are already given setting), Analyze (breaking down the knowledge into smaller familiar with online ads, and building upon this existing knowlparts), Evaluate (using the knowledge to justify a course of action), edge contributes to deep understanding [79].Furthermore, visual and Create (using the knowledge to generate new ideas) [12].The presentations like ads (see fgure 6) help students conceptualize abstract data-related concepts [53].Similar to the pilot module, all activities were conducted in the classroom and facilitated by the students' Math and Computer Science teachers.The activities are summarized below and detailed in appendix B.2.
• Activity 1: In Computer Science, students learned about (1) data collection and tracking, (2) how and why data is collected, (3) data use, and (4) actionable privacy skills to limit data tracking.They interacted with a prototype social media platform developed by DiFranzo et al. [23], which teaches about personalized ads on social media by visualizing ads based on identifed preferences.In Math, students explored a hypothetical database with user data as independent variables (IV) and targeted ads as dependent variables (DV).The math lessons were tailored to students' grade levels.• Activity 2: In Computer Science, students interacted with a personalized data dashboard (see fgure 4).We visualized consented students' pilot activity data, with students' responses as the IV and personality predictions as the DV [104].We used the data collection aspect of the pilot module to bridge students' knowledge of the privacy threats of AI agents to the privacy threats of tracking and personalization.The education activities in the TaPP module explained data collection beyond chatbots-it simply used the chatbotcollected data to help students conceptualize data tracking based on an existing experience.In Math, 5 th graders plotted graphs, 6 th graders worked with ratios, and 7 th and 8 th graders modeled equations with the IVs and DV. and 8 th graders worked on activity 4. In Computer Science, students implemented an interest-based tourist recommender system [42].In Math, they modeled recommendations using multi-step equations, which they solved algebraically and geometrically.
6.1.4Build Assessment.We evaluated the positive efect of the education module on students' learning through the following formative and summative assessments [24,37] (see table 5 for an overview): • We conducted summative pre-and post-test surveys before the module started and a month after completion.The preand post-test asked four multiple-choice questions about data tracking, data use, and privacy skills (see appendix C for answer options and correct answers).Questions were designed such that the module activities did not directly answer any assessment questions (i.e., they measured students' insight, not mere memorization).• We conducted planned formative assessments to qualitatively measure students' depth of understanding in situ [15,24,63].The three qualitative assessments asked about data collection and use (activity 1), algorithmic decisions and personalization (activity 2), and privacy implications (activity 3).They were administered immediately after students completed the target activity.We evaluated the efects of the module on students' learning using the assessments outlined in Table 5. Pre-and post-tests were administered four weeks apart to minimize the pre-test's efect on the post-test results.The qualitative assessments were administered with a chatbot that assumed the role of tutor [36].The chatbot, which students were already familiar with from the pilot activity (see section 5), was designed to probe students to give detailed answers, helping us understand how they learned about tracking and pervasive personalization [15].
To avoid a situation where the assessment itself would impact students' learning, students did not receive any feedback on the assessments, either from their teachers or from us.Note, though, that without a control group that does not receive the module, we are unable to guarantee that students' learning can exclusively be attributed to the module activities [40].We refrained from having such a control group for ethical reasons [15].Data Cleaning.For IRB compliance, we removed identifable information and deleted responses of non-consented students, leaving us with anonymized data from 99 students (a 61.1% consent rate).For consistency, we further fltered the data to only retain students who participated in both the pre-and post-test.The demographics of the resulting 87 students are reported in table 1b.Due to the high consent and participation rates, we do not expect a big difference between non-consented, consented students and students who "dropped out" from either of the assessments.

Evaluate Phase
Below, we present details regarding the results of each assessment type (see Table 5).

Pre-and Post Test
Performance.We calculated the pre-and post-test scores (two values between 0 and 4, indicating the number of correctly answered test questions) for each participant.The distribution of the diferences between participants' pre-and post-test scores was sufciently normally distributed, so we analyzed them using a paired t-test4 [29].The t-test shows that the module significantly contributed to participants' knowledge gain: participants correctly answered signifcantly ( = .015)more questions in the post-test (M = 2.55 out of 4, SD = 1.12) compared to the pre-test (M The table shows how a hypothetical algorithm models personalized ads based of number of videos watched   (left), "creator" (middle), or "achiever" (right)).These visualizations were generated from consented students' conversation data with the chatbot collected in the pilot study.
= 2.24 out of 4, SD = 1.05).Figure 5 shows that while only 9.20% of participants correctly answered all questions in the pre-test, this proportion increased to 22.99% in the post-test.Analyzing each test question separately revealed a particular gain in students' knowledge regarding how data is used for personalization (question 3); signifcantly more participants correctly answered this question in the post-test than in the pre-test ( = 0.034, see Appendix C).

Formative
Assessments.We analyzed the formative assessment data using a set of criteria evaluating participants' understanding with respect to the learning outcomes (see Appendix D).
For each outcome, we designate a participant's understanding as "very satisfactory" if their responses address all of the criteria, "satisfactory" if their responses address at least 75% of the criteria, and "somewhat satisfactory" if responses address 50% of the criteria.We report the efects of the module on participants' knowledge gain separately for each learning outcome (see Tables 3 and 5)."You? 5 You work for the people who collect my data, and you bring it back to the people then they learn."-P1 5 th grade Female Assessment 2: Algorithmic decisions and personalization.Participants in the 6 th , 7 th , and 8 th grades demonstrated satisfactory or very satisfactory understanding of data use for personalized algorithmic decision-making.In contrast, most 5 th graders could not distinguish the usage of the collected data from the process of collecting the data, even after substantial scafolding from the chatbot: They answered "I don't know" or evaded the questions about how data is used for personalization.
More than 80% of the participants were able to refect on how their preferences are mirrored in targeted ads and identifed it as an example of personalization.Furthermore, participants refected on inaccurate inferences based on transient preferences and the problematic nature of using short-term interests for something that may have long-term implications.This was in stark contrast to our observations in the preliminary semi-structured interviews, where interviewees invariably characterized personalized content as infallible "facts" (i.e. if the system recommends a certain product, then I must I like it).For instance, this quote from a 6 th grader laments the chatbot's use of tone analysis and simple heuristics to predict their chances of becoming a scientist: "You cannot tell what people mean by their tone.Only by exactly what they say.You say that people have a very low chance of becoming a scientist in every subject.This is invalid because no matter what your favorite subject is, you can be whatever."-P5 8 th grade Male Assessment 3: Privacy implications.Participants in the 6 th , 7 th , and 8 th grades demonstrated very satisfactory understanding of the privacy risks of tracking and pervasive personalization, but most 5 th graders did not provide a substantial answer to our questions about privacy implications.This is consistent with their understanding of data use: as we had anticipated when we designed our modules for "deep understanding," we observe that without a correct understanding of how tracked data is used, it is indeed difcult for participants to conceptualize the privacy implications of pervasive data tracking.
Participants in the 6 th , 7 th , and 8 th grades determined the collection of private information as a potential privacy risk ("some company might collect private information about you."), highlighting the possibility of advertisers collecting and using users' data for illegal or unauthorized purposes ("your data might be used in ways you may not agree with").Participants also worried about data leakage ("your info could be shared with others . . .") and felt that personalized ads could be improper ("some can be inappropriate") or crafted for fraudulent purposes ("some ads could be scams").
Participants recognized that their online activities are used to infer their preferences, and they understood and expressed concerns about such data being collected and used without their explicit consent or awareness.Several participants expressed skepticism towards systems that use their data for personalized ads (e.g., "I will feel weird because they are following us" and "I would be angry") and some suggested actionable changes to handle the situation ("If I was one of these users, I will turn of cookies and adjust privacy settings to stop the data being used").Participants also registered concerns that algorithmic inferences made on transient data may misrepresent individuals: "[It is a problem] because if it said I liked science it's kind of obvious 'oh, she might want to be a scientist.' But still, that's not always true because science could be my favorite subject but I might want to be a judge.So it's better to ask than assume but I can see that program being a bit of an issue.[...] I wouldn't like them using my information without my permission even though they were not using it for anything bad." -P14 8 th grade Female Finally, a few participants demonstrated a nuanced understanding of the trade-of between the benefts of personalization and privacy concerns: They expressed satisfaction with personalized recommendations of things they were interested in but at the same time, acknowledged that the thought of being tracked did not sit well with them: "I feel glad because the stuf I want is being recommended to me.I would also feel a little uneasy knowing that diferent websites are tracking my interest."-P21 6 th grade Female 6.3.3Open-ended Survey Qestions.The open-ended survey at the end of our post-test asked participants if this module changed their attitudes and online behaviors.Participants refected on targeted ads as they relate to their online behaviors ("it makes me think about how the companies try to advertise") and reported feeling safer now that they have an in-depth understanding and actionable skill set to limit data tracking ("I feel safe knowing how to limit what I share").Participants also self-reported that since the conclusion of the module (note: the post-test was conducted a month later), they had started to apply the actionable privacy skills they had learned in this module, for example, blocking cookies and using incognito windows to avoid tracking.Additionally, participants said they had become more deliberate about the information they share online, supporting this change with respect to their in-depth understanding of the privacy implications of tracking and pervasive personalization.
Finally, participants demonstrated a very satisfactory understanding of the duality of personalization.Particularly, they could connect their online activities to both the benefts of preferencebased personalized experiences as well as the potential threats of tracking for exploitative purposes: "On one hand, targeted ads can make shopping easier.But it can also exploit your personal information by wanting shops near you." -P3 8 th grade Female

Present Phase
The pre-and post-test responses and the qualitative assessments revealed that 6 th , 7 th , and 8 th grade participants developed a robust transferable understanding of data tracking, data use, and their privacy implications, whereas 5 th graders did so only for data tracking.We discussed these fndings with the teachers and refected on module design improvement strategies in a constructivist qualitative refection session [16].
One suggestion for improvement that emerged from this session was a more thorough communication of the key concepts to the teachers of the module.While we collaborated with one Computer Science and one Math teacher, there was one additional Computer Science teacher and several additional Math teachers who were also tasked with teaching the TaPP module in their classrooms.Our collaborator teachers were, of course, well-informed about the module, but the other teachers were not as intimately familiar with its key concepts, thereby limiting their efectiveness in conveying the materials: "I remember the teachers saying something about how the other teachers weren't seeing the bigger picture, and I feel like this is an issue.If teacher's can't see the bigger issue, then students will probably have trouble too." -teacher To ensure that all teachers are as well-informed as possible, the teachers recommended using the Backward Design [98] curriculum design method in future modules, as it has been proven very efective in conveying the big picture of a new education plan to students can beneft from.We discuss the implications of long-term teachers and, by extension, to the students.education fostering deep understanding of AI-related privacy in The teachers noted that 5 th and 6 th -grade students needed more the following subsection.time to complete the activities and suggested providing more scaffolding in their lessons and increasing the fexibility of their schedules by designing shorter activities.The teachers noted that the schedule should leave room for errors and that time loss in middle school classrooms is inevitable: as students need time to get situated, a 50-minute class period rarely gives teachers 50 minutes of instruction time.Furthermore, logistical challenges like frewalls blocking access to external education materials, digital classroom passwords, internet connectivity issues, device malfunction, etc., are unavoidable.So, the design and implementation of educational materials should take these realities of the classroom environment into account.

DISCUSSION
Our study provides a roadmap for integrating AI-related privacy education in K-12 classrooms.In this section, we discuss the implications of this practice regarding the creation of deep transferable knowledge, our experience employing DBR to conduct classroom research, and the limitations of DBR.

Implications for Privacy Education in K-12 Classrooms
Integrating privacy education in classrooms broadens students' access to such education.Privacy education summer camps, workshops, or online self-learning activities can have a positive impact on adolescents' privacy practices [3,8,35], but such eforts tend to be less accessible to adolescents from limited-resource backgrounds [62].K-12 classrooms are more equitable environments for delivering privacy education because they serve students regardless of socioeconomic background [90].
Classroom-based privacy education also encourages a more collective adoption of privacy-protecting practices.Many adolescents struggle to challenge established data sharing and interaction norms [48], which prevents them from adopting responsible privacy practices.Classroom-based privacy education addresses students not just as individuals but also as a cohort, which can help change the status quo privacy-averse data-sharing behavior by collectively encouraging students to adopt privacy-preserving behaviors.Our results show that students are already concerned about their data privacy-they simply do not have the knowledge and/or motivation to protect their data [9].Arguably, taking a collective approach to AI-related privacy education can resolve both of these issues.
Finally, teaching privacy in K-12 classrooms provides an opportunity for long-term exposure, resulting in sustainable knowledge development.While disconnected and isolated short-term education interventions can be valuable experiences for students, students rarely develop a deep understanding from such interventions [79].Integrating privacy education in K-12 curricula can give students longer-term exposure to such topics.Furthermore, teacherfacilitated classrooms can provide sufcient scafolding by tailoring the content to students' learning needs.Arguably, a comprehensive, long-term, scafolded, and teacher-facilitated education module has more potential to create usable and transferable knowledge that While students in our initial semi-structured interviews had a very limited understanding of AI and its privacy implications (see section 4), upon completing the TaPP module, they demonstrated an ability to relate and apply concepts of tracking, pervasive personalization, and associated privacy threats in their daily online interactions, suggesting that they had developed a deep and transferable understanding of the topic (cf.[79]).Rapidly evolving AI systems lead to novel privacy threats that outlive online privacy "tips and tricks." Arguably, then, a deep understanding helps students adapt their privacy practices to manage the novel threats that will emerge from future AI systems.
Students gain a deeper understanding when they engage in activities that are similar to everyday activities when they externalize their knowledge, and when they get a chance to articulate their understanding [79].We used targeted ads as an example use case of pervasive personalization because semi-structured interviews revealed students' familiarity with targeted ads.Indeed, this allowed us to draw upon students' everyday experiences, which helped most of them contextualize the privacy threats of tracking and pervasive personalization-this was apparent in the results of our formative assessments and open-ended survey answers (see Section 6.3).The formative assessments via a chatbot helped students refect upon and externalize the concepts they were learning in our module-we chose to employ a chatbot not only because it aligned with the topic of our modules but also because students tended to answer chatbot questions more verbosely than traditional survey questions.Finally, we designed the module in reverse order of Bloom's taxonomoy [31], crucially requiring students to apply the concepts to analyze novel scenarios (activity three) and to create new tools (activity four), which helped students articulate their developing knowledge.We recommend that privacy education researchers design their interventions along these principles to facilitate a deeper understanding.
While our 5 th -grade participants had very satisfactory understanding of data tracking, their understanding of algorithmic decisionmaking and associated data privacy threats were only somewhat satisfactory.This may be attributed to their limited technology exposure (as demonstrated by our semi-structured interviews; see Section 4), but it can also be attributed to a lack of prerequisite computing knowledge (5 th -grade state standards focus on teaching very basic computer skills [81]).Based on these fndings, we recommend integrating education materials about data tracking and actionable skills to limit data tracking in the 5 th grade curriculum.This will match their abilities, prepare them for their online journey, and build foundational knowledge that can be further expanded in later grade levels.In contrast, 6 th to 8 th -grade students had a satisfactory or very satisfactory understanding of data tracking, personalization, and related privacy threats, indicating their ability to fully beneft from the TaPP module.So, we recommend integrating the TaPP module in 6 th to 8 th -grade curricula, using targeted ads as an example of pervasive personalization.

Using Design-Based Research (DBR) Methodology
We employed DBR methodology because it provides a collection of domain-appropriate methods to study learning in classrooms [10].Classrooms are complex, unpredictable spaces that are typically not suitable for controlled experiments [90].DBR accounts for this unpredictability by employing mixed methods, generating a combination of qualitative and quantitative data-something the HCI community is already intimately familiar with-that helped us to both quantify students' knowledge gain and to characterize and interpret these gains in the context of the learning environment.
Understanding how students think and learn about privacy is important in advancing privacy education in a way that prepares adolescents to manage their online privacy efectively.Throughout our studies, we have increasingly realized that not only the evaluation of our modules but also their design should accommodate classroom unpredictability.Importantly, the variables of unpredictability in classrooms are not fxed, and many such variables can be introduced during the intervention (e.g., device malfunction, illness 6 ).Modifying the intervention protocols (and, ultimately, building modules with a need for fexibility in mind), allowing time for the modifcations to take efect, and observing how learning emerges over time is inevitable [10,90].

The Benefts of Teacher Involvement in Module Development
In light of this unpredictability, collaborating closely with teachers and schools is an integral part of any DBR project.This collaboration ensures fdelity of classroom implementation by making sure that teachers are well-versed in the learning goals and that they understand the theoretical and practical purposes of the developed learning materials.Furthermore, increasing teacher involvement gives teachers more agency over the materials and fexibility to adaptively implement our research in practice [82].That said, it is not always possible for (all) teachers to be involved in the development of educational materials.In these cases, access to guidelines, lesson plans, teaching materials, and external resources can support instructors while implementing the education module.
Our future work will follow the teachers' recommendations and employ the Backward Design curriculum design method [98] to more efectively convey the big picture of our education materials to teachers.The Backward Design framework suggests frst identifying the learning goals (ideas, facts, concepts, principles, processes, strategies, and methods students should learn and retain), followed by the evidence of learning (developing strategies to evaluate learning and identifying evidence that counts as learning) and fnally the teaching strategies to satisfy the learning goals.Identifying the purpose of the curriculum frst helps teachers see the bigger picture and motivation behind the topics they are teaching [98], which enables them to teach more efectively and improves student 6 Our interventions were interrupted and delayed due to COVID-19 pandemic learning [79].Furthermore, it helps teachers prepare and adapt the instructional strategies as required by the classroom situation.
The education module development process benefts from having multiple accountability structures.This can involve informal moments of refection, like when a student or teacher suggests they do not like a particular topic or activity.It can also involve more formally structured refexive sessions with teachers and other stakeholders to critique the project.We have found that involving teachers, students, and external stakeholders in the module development process strengthens the education modules through feedback from diferent perspectives.Furthermore, designing and implementing education modules is mutually inclusive: Education modules should serve within and in response to the domain in which they are expected to work.As such, treating the integration of the education module with the domain as a part of the design process makes learning more efective [10].

Limitations
Classroom interventions have several inherent limitations.Conducting classroom intervention studies is a time-intensive efort that can sufer from various resource limitations.Collaborating with schools for research requires establishing relationships with the school and teachers.Unless an established relationship exists, it may be difcult to conduct an in-classroom intervention.Furthermore, when conducting a classroom intervention study during the school year, time constraints and schedules can be barriers, as schools tend to prioritize the delivery requirements to maintain state-mandated requisites.Ultimately, classrooms are complex and unpredictable environments where unprecedented events are unavoidable.When designing classroom interventions, we must leave room to accommodate such unprecedented events and grant teachers control to manage them.
We made concerted eforts (i.e., conducting pre-and post-tests four weeks apart and selecting distinctly diferent teaching and testing examples) to ensure the validity of our pre-and post-test results.Regardless, classroom limitations inevitably result in less control compared to an experimental setup.For example, students might discuss the answers to pre-test questions with each other, which could lead to an artifcial increase in correctly answered posttest questions.While one can argue for a control group to resolve this limitation, rigidly dividing students between control and intervention groups in a classroom context is both practically difcult and ethically questionable [15].In line with the DBR methodology, we instead reduce this limitation by relying on qualitative formative assessments as a more controllable means to validate the quantitative results of our pre-and post-test.Furthermore, it is worth considering that students' learning from the module pre-test and/or discussing the pre-test answers essentially contributes to their knowledge and awareness, which is ultimately aligned with the goal of the intervention.
The multiple-choice questions of our pre-and post-test have an inherent probability of randomly selecting correct answers.Although we had qualitative responses to corroborate the quantitative responses and accurately interpret learning, we acknowledge that this is indeed a limitation.Future studies would beneft from carefully developing a set of nuanced multiple-choice options to minimize such concerns.

CONCLUSION
In this paper, we report on our eforts to teach middle school students about AI-related privacy threats in teacher-facilitated classrooms.We focus our presentation in this paper on the design, implementation, and evaluation of an education module on the privacy threats of tracking and pervasive personalization.Following the Design-Based Research (DBR) methodology [15], we developed this module in collaboration with teachers, implemented it in their Computer Science and Math classrooms, and conducted formative and summative assessments to evaluate the efects of the module on students' learning.Our post-test, formative assessment and open-ended survey results showed that most students gained a deep understanding of data tracking and personalization as well as actionable privacy skills to use in their online interactions.Our research procedures and results are a valuable resource for researchers interested in integrating cybersecurity education into the K-12 classroom.

APPENDICES A SEMI-STRUCTURED INTERVIEW
Each semi-structured interview was scheduled for an hour, including the time it took for the students to walk to the CS classroom and set up zoom and audio technology.After a brief introductory conversation, we began interviewing the students.
B LEARNING ACTIVITIES B.1 Pilot Study Activities: AI Agents 5 th to 8 th graders in the Computer Science classes participated in the same activity where they were introduced to a chatbot converses with users [104] about their favorite subject and society.Students inspected the chatbot's logic model after the conversation and built their own chatbots using Juji studios no code AI chatbot builder 7 .
In the math class, students learned the mathematical principles of predictive models (for example, sentiment analysis).The topics and complexity of the math activities varied between the grade levels based on their state-mandated curriculum standards Computer Science Class.In the Computer Science students interacted with a prototype social media platform [23], where they learned about the following topics: (1)How is data generated and used, who collects data and why, how is data collected and (2) How is data generated and used, who collects data and why, how is data collected.Students also learned actionable privacy skills to limit data tracking.Then, on the same platform, students iteratively updated their preferences to see how targeted advertisements (see image 6) change based on their updated preferences to delineate tracking and personalization based on individual data.
Math Class.The Math lesson changed the perspective from user to advertiser to show the advertiser's side.Students explored a hypothetical database with user data as independent variables and targeted ads as dependent variables.5 th graders were asked to identify apps where users spend the most time, compare users based on the number of videos they watched, make line plots, and fnally, give a data-driven decision to the question "Based on these line plots, which ads do you think the fctional social media app is most likely to recommend?"Explain your thinking to defend your answer".6 th and 7 th graders were tasked to explore the data tables to identify the dependent variable (DV, i.e., the ad/suggestion) and independent variables (IVs, e.g., preferences) and to delineate relationships between them.In addition to the other tasks, students in 7th grade also made plots using one IV and the DV. 8 th graders also used the data table to write equations demonstrating the relationship between the IV and DV and to manipulate the IV values to observe changes in the DV. 7https://juji.io/no-code-ai-chatbot-builder/B.2.2 Activity 2.
Computer Science Class.We visualized students' chatbot activity data 8 and algorithmic inferences in a dashboard to facilitate students' learning and mental model development [38,52].We used data gathered from consented students' interaction with the pilot study chatbot, along with its prediction of the students' personality [104].We created an interactive dashboard visualizing algorithmic decisions [104] as dependent variables and favorite subject, and societal questions as independent variables.We placed flters in the visualization for selecting and deselecting input parameters.We created developmentally appropriate visualizations to accommodate all 5 th to 8 th graders' knowledge levels.
Math Class.Students continued to explore user activities in the hypothetical database, using mathematical concepts to represent the data and the relationship between IVs and DVs. 5 th graders worked in groups of 3. Students plotted graphs for the IVs (Time spent on YouTube, Time spent on Facebook, Time spent watching Instagram videos, and time spent watching Tiktok videos) with the DV (recommended ads).6 th graders used ratios and units to represent the data, report the diferent recommended ads using part-to-part ratios, and compare users' online activities in diferent apps using part-to-whole ratios in the simplest forms and fractions.7 th and 8 th graders used the data table to model the relationship between IV and DV in the provided word problems using equations and then solved the equations for the DV.We varied the complexity of these problems based on each grade level's state-mandated curriculum standards [86] and verifed by teachers at our partner middle school.B.2.3 Activity 3. Activity 3 aims to evaluate students' ability to apply [20,31] their understanding of the processes underlying TaPP in a practical assignment.
Computer Science Class.We designed a project adapted from [23] where we asked students to make data-driven recommendations for a fctional store based on data collected about its customers.To improve understanding, we presented the data in a tabular format [52], including the store's location, most popular items, most popular colors, items frequently bought together, and clientele demographics (see table 7. Students worked in groups of 3, analyzing the data to recommend apparel customers are most likely to purchase.(hoodies, hats, shirts, or something else they think is a better ft).Students drew the fnal product on paper and presented their product to the class, where they used the data table to explain their recommendation decisions.
Math Class.The 5 th graders interpreted the line plots they generated in activity 2 in a "gallery walk"-style activity.For each line plot, students worked through two problems: in problem 1, students compared the line plots to fnd out how many more people watch videos on Instagram than on YouTube.In problem 2, students applied the recommendation process they learned in the Computer Science activity in a mathematical context to explain which social media platform they think would most likely be recommended to someone based on these line plots.The teachers suggested limiting this activity to the 7 th and 8 th -grade students, given its complexity and required programming knowledge.Students apply the theoretical concepts to implement a tourist recommender system programmatically.
Computer Science Class.Students wrote a tourist recommender system in the web-based Scratch platform.The recommender is connected to a back-end algorithm we set up on machinelearning.cothat is powered by IBM [42].First, students familiarized themselves with the pre-programmed system -both the implementation and the Scratch code.Students could update inputs, add new recommended sites for each input, and delete recommendation availability for specifc inputs.Then, students built their tourist recommendation app in Scratch.Students frst wrote dialogue to prompt users to enter some of their favorite things to do at a funfair.This step serves to help the algorithm learn and infer preferences, as well as demonstrate data collection to students.Then, using a simple block-code-based logic implementation, students developed their tourist recommender app by applying the concepts they learned in this module about how data is used to make inferences.
Math Class.Since only 7 th and 8 th graders participated in this activity, the related math lesson was designed only for these two grade levels.Since students implement a tourist recommender system that makes personalized recommendations based on interest, in the math classroom, 7 th and 8 th graders model recommendations using mathematical equations.7 th graders' worked on multi-step equations where they solved the DV for diferent IV values.This variation illustrates how the IV (for example, user data) infuences the DV (for example, recommendations).8 th graders also model recommendations using mathematical equations, but they use algebraic and geometric solutions to systems of equations.
E SAMPLE LESSON PLAN FOR GRADES 5 AND 6 E.1 Lesson Plan for Grades 5 and 6 Purple boxes refer to research componentsOrange box refer to design components

Figure 1 :
Figure 1: Design-based Research Steps Experienced in Iterative Cycles

4. 1 . 2
Interview Findings.Our analysis uncovered four themes about AI (AI perception, AI recognition, How AI works, and Engagement with AI ), and two themes about privacy (Privacy practices and Privacy concerns).
(a) Participatory design session: with two (b) Example of Design outcomes: Data collection and inferences, product/ad recommendations, and personalization (c) Example of Design outcomes: teaching strategy, schedule, resources for teachers, and teaching materials.PIs, one Math teacher, one Computer Science teacher, three PhD students, and three REUs

Figure 2 :
Figure 2: Participatory Design session and outcomes

( 1 )( 2 )( 3 )
Please Identify the Dependent and Independent Variables ____________________________________________________________________________ ____________________________________________________________________________ Plot the ordered pair (x,y) in a line plot ____________________________________________________________________________ ____________________________________________________________________________ What can you tell us about the relationship between the number of videos watched versus the number of ads.____________________________________________________________________________ ____________________________________________________________________________ (a) In example 1, students identify IV (user interaction) and DV (number of ads).They use their TaPP knowledge to analyze and explain the relationship between IV and DV.

Example 2 :( 1 )( 2 )Example 3 :( 1 )( 2 )
Relationship between videos watched and adsFor every 10 game videos, the hypothetical app shows a PS5 advertisement.A user watched 75 game videos on the app.Write an equation to model how many PS5 ads the user saw ____________________________________________________________________________ ____________________________________________________________________________ Solve the equation ____________________________________________________________________________ ____________________________________________________________________________ Relationship between videos watched and income For each educational video users watch, the hypothetical app earns $5.The educational videos have a total of x views and have earned $3500.Write an equation to model their income ____________________________________________________________________________ ____________________________________________________________________________ Calculate the value of x ____________________________________________________________________________ ____________________________________________________________________________ (b) In examples 2 and 3, students algebraically model the relationship between IV (user interaction) and DV (number of ads/income).Students solve the equation for the DV with a diferent value for IV.

Figure 3 :Figure 4 :
Figure 3: Example of learning activities facilitating understanding of how algorithmic decisions are made and infuenced by user interaction data

Figure 5 :
Figure 5: Histogram of the number of correct answers in pre-and post-test

7. 2
Fostering a Deep and Transferable Understanding of AI-related Privacy Threats among Students [80].Students completed pre-and post-tests, in-class discussion activities with peers led by their teacher, and a post-module conversation with the chatbot refecting on the lesson.B.2 Main Study Activities: Privacy threats of TaPP B.2.1 Activity 1.

Table 2 :
Pilot Study: Learning Outcomes and ActivitiesEssential Question: What are the privacy implications of data tracking and use for algorithmic decision-making?Privacy implica-Building mental models of the relationship between tracking, Implement privacy measures to prevent tions and measures to personalization, and privacy violation; Developing actionable novel scenarios of data tracking protect personal data skills to limit data tracking [49]BuildActivities.Similar to Kumar et al.[49], to make sure that the learning activities presented in table 4 would teach a deep level of understanding of the learning outcomes, we designed them in reverse order of Bloom's Revised Taxonomy.Bloom's taxonomy

Table 3 :
Privacy Threats of Tracking and Pervasive Personalization: Identifying Learning Outcome and Assessment Criteria

Table 4 :
Learning activities and related Bloom's categories of the TaPP module

•
Our post-test concluded with three open-ended survey questions to evaluate changes in attitude and behavior following the completion of the module.

Table 5 :
Assessment Questions

Table 6 :
6 th graders were tasked to Internet Use and Privacy AI Familiarity 1. Please tell me about your school and friends 2. How is your personal data used?3. Do you use any internet communication tools to communicate with your friends? 4. Please tell me more about the tool(s) you use, how frequently you use them, who you communicate with the most, etc. 5. What other kinds of websites do you visit if any? 6.What would you describe an "unsafe" or "bad" online encounter to be? 7. How do you decide to add friends and respond to messages if/when a stranger messages/messages you?What privacy measures (if at all) do you employ to maintain privacy and safety?8. If/Have you encountered any threats or untoward events online?Please tell us what measures you took/can take to protect yourself in such an instance 9. Have you heard of the term AI?If yes, please tell me where you heard about it.10.What does the term AI mean to you? 11.Can you tell me what are some of the AI devices/applications you use? 12. Do AI devices play a role in your life?Please tell me how.13.What do you typically use AI for?14.Tell me about your interaction with Artifcial Intelligence -it can be a fun encounter or anything you found interesting.15.How do you think Artifcial Intelligence works?Do you think learning Math can help you understand Artifcial Intelligence?Semi-structured Interview Questions: Identifying Learning Needs Data Summary Most customers come to the Store to buy hoodies Many customers also shop for hats, face masks, and bags Most hoodies are purchased in colors of the local sports team The majority of customers support the local sports team Draw recommended product.Please explain why you recommended the product with respect to the data table

Table 7 :
Activity 3: Consumer data summary relate tables to graphs and equations, working through several word problems and an associated data table to plot graphs, model equations, and solve the equations for the DV.7 th and 8 th graders modeled 1-step and 2-step equations based on word problems and an associated data table to calculate the ad revenue apps make and the cost of posting advertisements on social media platforms based on the type of content (text or video).7 th graders worked on inequality problems where they had to model and solve 1-and 2-step inequalities from the data table.In contrast, 8 th graders worked on multi-step equations to solve a given equation for the DV, to model equations to predict how several views vary by diferent criteria, and to determine how recommended videos vary by users' online interactions.

Table 10 :
5 th and 6 th graders had three 45 minutes class per week in the Spring of 2022 Interact with personalized data dashboard 5 Minutes There are three tabs: Helper, Makers, and Achievers.Navigate to a tab of your 25 Minutes choice and interact with the visualization.Some example interactions you can try: (a) Hover your mouse over the bar chart to study it; (b) Deselect all the subjects.After that, select one subject at a time and look at how the numbers change; (c) Repeat for the other two tabs Lesson Plan for Grades 5 and 6 CHI '24, May 11-16, 2024, Honolulu, HI, USA Khan et al.E.2 Lesson Plan for Grades 7 and 8 7 th and 8 th graders had fve 37-minute classes per week in the Spring of 2022.Interact with personalized data dashboard 5 Minutes There are three tabs: Helper, Makers, and Achievers.Navigate to a 25 Minutes tab of your choice and interact with the visualization.Some example interactions you can try: (a) Hover your mouse over the bar chart to study it; (b) Deselect all the subjects.After that, select one subject at a time and look at how the numbers change; (c) Repeat for the other Make a tourist recommender system in Scratch 10 minutes Distribute the Username and Password of machinelearning.coaccounts 10 minutes for each group Allocate time for students to get familiar with the system Rest of Class time

Table 11 :
Lesson Plan for Grades 7 and 8