Worked example: Auditing App Permissions and Targeted Adverts on a Teen Phone

What this is

A secure Year 9 response annotated against the lesson success criteria, doubling as the supply teacher’s complete answer key. Key numerical answers: Category A = 35% (28/80), Category B = 25% (20/80), Category C = 20% (16/80), Category D = 15% (12/80), Category E = 5% (4/80). Late-night adverts: 60% (48/80); Daytime adverts: 40% (32/80). Combined impulse-spending adverts (A + B): 48 adverts = 60%.

Step 1: Audit the 6 apps on Ieuan’s phone

App name	Permissions to KEEP	Permissions to REVOKE (turn off)	Why? (Link to the app’s job and privacy risk)
1. BrightBeam Torch	Camera LED flash only (or uninstall app and use built-in phone torch)	Contacts list, Microphone (Always On), Precise Location (Always)	A torch only needs the LED light. It has no genuine reason to listen to audio, read contacts or track GPS, which it sells to 42 ad brokers.
2. ValleysStep Counter	Motion & Fitness sensor	Precise Location (24-hour Always On), Cross-App Ad Tracking	The built-in motion sensor counts steps without needing 24-hour GPS coordinates that reveal Ieuan’s home, school and high-street stops.
3. GlowSnap AI Filter	Camera (While Using) or Selected Photos only	Full Photo Library (all 1,400 photos), Biometric Face-Tag Sharing	Uploading all 1,400 photos and scanning faces harvests biometric data and triggers targeted beauty adverts that target body image.
4. BusCymru Live	Precise Location (While Using the App only), Mobile Data	None (permissions are already proportionate)	The app genuinely needs live data and location while open to find the nearest bus stop, and its policy states no data is sold.
5. WordBlitz Free Puzzle	None (offline word puzzle needs no special access)	Contacts, Clipboard, Cross-App Ad Tracking, Push Notifications (24 hours)	An offline game does not need contacts or clipboard text (which can expose copied passwords), and 24-hour notifications disturb sleep.
6. SchoolStudy Planner	Calendar, Notifications (08:00 to 18:00 only)	None (permissions are already proportionate)	Needs calendar access to store homework deadlines and only sends reminders during daytime hours with no third-party tracking.

Applies data minimisation accurately across all 6 apps, separating the 2 proportionate apps (Apps 4 and 6) from the 4 data-harvesting apps (Apps 1, 2, 3 and 5). Evidences criterion 1.

Step 2: Calculate percentages from the 7-day log of 80 adverts

Advert category	Daytime	Late-night	Total	Working and percentage of all 80 ads
A. Fast-fashion trainers & flash sales	8	20	28	(28 ÷ 80) × 100 = 35%
B. In-game loot boxes & coin packs	6	14	20	(20 ÷ 80) × 100 = 25%
C. Skin-clear & face-shaping creams	6	10	16	(16 ÷ 80) × 100 = 20%
D. Local fast-food & energy drinks	8	4	12	(12 ÷ 80) × 100 = 15%
E. General sports & cinema trailers	4	0	4	(4 ÷ 80) × 100 = 5%
Column totals	32	48	80	35% + 25% + 20% + 15% + 5% = 100%

(a) Late-night vs daytime percentages:

Late-night (22:00 to 01:30): (48 ÷ 80) × 100 = 60%.
Daytime (07:00 to 21:59): (32 ÷ 80) × 100 = 40%.

(b) Combined impulse-spending adverts (Categories A and B):

Combined total: 28 + 20 = 48 adverts → (48 ÷ 80) × 100 = 60% of all adverts shown to Ieuan.

(c) Why 20 out of 28 Category A flash-sale adverts appeared after 22:00:

Advertisers know from cross-app tracking that Ieuan is scrolling in bed after 22:00 when he is tired and less guarded. Combining late-night fatigue with countdown flash sales increases the chance that he will make an impulse purchase without thinking through the cost.

All five category percentages and the time-of-day percentages are calculated accurately, verified to total 100%, and interpreted to explain late-night targeting. Evidences criteria 2 and 3.

Step 3: Write a 5-point digital privacy and well-being action plan

1. Location settings: Turn off 24-hour “Always On” GPS location for ValleysStep Counter and BrightBeam Torch (keep location as “While Using the App” only for BusCymru Live). This stops brokers tracking Ieuan’s daily route and cuts the 15% (12/80) of adverts pushing fast-food and energy drink deals.
2. Camera roll and biometric face tags: Change GlowSnap AI Filter from “Full Photo Library” to “Selected Photos Only” and revoke Biometric Face-Tag Sharing. This stops the app scanning 1,400 photos and reduces the 20% (16/80) of appearance and skin-cream adverts that harm self-esteem.
3. Microphone, contacts and clipboard access: Delete BrightBeam Torch (using the phone’s built-in control-centre torch instead) and revoke Contacts and Clipboard access from WordBlitz Free Puzzle so private conversations, phone numbers and copied passwords cannot be harvested.
4. Cross-app advert tracking: Switch off “Allow Apps to Request to Track” (Cross-App Ad Tracking) in the phone’s main privacy settings so WordBlitz and ValleysStep cannot share browsing history with shopping companies.
5. Late-night notifications and impulse spending: Turn off 24-hour notifications on WordBlitz and set a Scheduled Sleep Focus from 21:30 to 07:00. Because 60% (48/80) of Ieuan’s adverts appeared after 22:00 and 60% pushed impulse spending (flash sales and loot boxes), blocking late-night alerts protects both his sleep and his savings.

Each of the 5 action points names specific apps and settings and uses the calculated percentages (15%, 20%, 60%) to justify the change. Evidences criterion 4.

Step 4: Why your app permissions affect other people’s privacy

Ieuan is wrong because his phone stores data about dozens of other people who never agreed to those app terms. When he gave GlowSnap AI Filter access to all 1,400 photos and biometric face-tagging, the app uploaded pictures of his friends, classmates and family members, scanning their faces and locations without their consent. In the same way, allowing BrightBeam Torch and WordBlitz to read his contacts list handed over the names, phone numbers and email addresses of his friends and relatives to 42 advertising brokers. Good digital citizenship means protecting other people’s privacy and digital reputation as well as your own.

Explains third-party consent clearly using both the 1,400-photo camera roll and the contacts list. Evidences criterion 5.

If you finish early: answers

Category C late-night fraction and percentage: 10 out of 16 adverts = 10/16 (which simplifies to 5/8). As a percentage: (10 ÷ 16) × 100 = 62.5% of all beauty and skin-cream adverts were shown after 22:00.
Why clipboard access is dangerous: People regularly copy and paste passwords from password managers, one-time bank security codes, home addresses and private messages onto their phone’s clipboard. Any app with clipboard permission can silently read whatever text was most recently copied.

Why this response is secure

Applies data minimisation consistently across all 6 apps, identifying both excessive permissions and proportionate ones.
Calculates every percentage out of 80 accurately and links the figures to time-of-night vulnerability.
Produces a specific, evidence-backed 5-point privacy plan and explains third-party privacy responsibilities for friends and family.