an internet that plays fair.

Nine in ten Brazilian homes have internet. In them, the child does homework on the phone, the grandmother receives her benefit through an app, the young person looks for a first job on a website, and the mother finds out from the street’s group chat that school let out early. The square, the counter, the notice board and the post office all ended up in the same device.

Nobody taught anybody how to live there. The TIC Kids Online survey, by Cetic.br, shows that more than two thirds of children and teenagers aged 9 to 17 already use social media, and that three in four use the internet for schoolwork. Almost half admit they can’t tell whether a piece of information found online is true. The adults who look after these children are not much better off: they learned on their own, in a panic, one scam at a time.

The internet is not a dangerous place

It’s worth saying this right away, because it’s the first thing the conversation about safety tends to forget. The internet is fantastic. It shortened the line at the health clinic, put the world’s library in your pocket and gave a voice to people who never had a microphone. Casa Hacker exists so that the periferia, Brazil’s working-class outskirts, gets to be in charge of this technology, and not the other way around.

Digital safety is not a list of fears. It’s the set of habits that lets a person use the internet with autonomy: knowing what is yours, knowing what you hand over in exchange, recognizing bait, checking before sharing, and knowing who to turn to when something goes wrong. People who know this browse more, not less.

Fear freezes. Know-how frees.

Why those who educate are the ones to teach this

The law has already answered. The Marco Civil da Internet, Brazil’s internet bill of rights (Law 12,965/2014), says in Article 26 that the State’s duty to education includes training for the safe, conscious and responsible use of the internet as a tool for citizenship. The Estatuto da Criança e do Adolescente (ECA), Brazil’s Child and Adolescent Statute, applies on and off the internet. Law 13,185/2015 requires the prevention of bullying, including the kind that happens through a screen. And Law 15,211/2025, the ECA Digital, now requires platforms to verify age and provide for supervision by parents and guardians.

But the law doesn’t reach the territory on its own. What reaches it is the teacher, the neighborhood leader, the social educator, the collective’s facilitator, the member of the Conselho Tutelar, Brazil’s local child-protection council. These are people who already have the community’s trust and who see the problem before it becomes a police matter: the girl who stopped coming to the meetings, the boy who fell for a scam with his mother’s money, the WhatsApp group that spread a lie about a neighbor.

This kit was written for these people. You don’t need to be technical. You need to know how to talk.

Nobody’s job is a job nobody does. This one belongs to those who educate.

Banning doesn’t educate. Educating protects.

Taking away the phone, blocking the app and shutting down the network solves things for an afternoon. The next day the child is on a classmate’s phone, and now with nobody to ask. Strict control without conversation teaches kids to get around the rules, not to take care of themselves.

The path Casa Hacker learned over more than seven hundred people trained is a different one: first, listen to what worries that territory; then open a dialogue circle with those who educate and those who care; then train in person; and finally, leave in each person’s hands a material to carry on with. This kit is that material.

How to use this kit

The chapters follow an order, but they don’t need to be read in sequence. The first three deal with what belongs to the adult: privacy, passwords and scams. It’s worth starting with them, because nobody teaches what they don’t practice. The next two, disinformation and well-being, are the ones that work best in a conversation circle. The chapters on cyberbullying, violence and what to do are there to consult when the problem shows up, and to read beforehand, so you’re not caught off guard. At the end come the law on one page, the activity plans by age, and the resources.

Each chapter closes with two blocks. To take to the community brings ready-made activities, tested in Casa Hacker’s trainings. To go deeper brings a few links, all checked. If one of them breaks, let us know at falae@casahacker.org.

This material belongs to Casa Hacker and is licensed under Creative Commons BY-SA 4.0: you may copy, print, adapt and redistribute it, as long as you credit the source and keep the same license. It was made to be multiplied.

Privacy is a right. It’s in the Constitution, in the Marco Civil da Internet, Brazil’s internet bill of rights (Law 12,965/2014), and in the Lei Geral de Proteção de Dados (LGPD), Brazil’s general data protection law. It’s also a culture: every family, every territory and every generation has a different idea of what you tell and what you keep. Security is something else. Security is the means, the set of tools and habits that guarantees the right. Mixing the two up makes the conversation start with the password and never get to the question that matters: what is mine, and what do I want other people to know?

Public, private and intimate

In Casa Hacker’s trainings we use three boxes. Public is what poses no risk if everyone knows it: your name, your team, your city. Private is what needs care and choice: your address, your routine, the children’s school, the photo of Sunday lunch with the car’s license plate in the background. Intimate is what must stay protected, always: your body, your health, your password, the secret someone confided in you.

The same piece of information changes boxes depending on the person and the context. The time you leave the house is public to your neighbor and private to someone you don’t know. A bikini photo belongs in whichever box its owner decides, and nobody else gets a say. Teaching people to choose the box is more useful than teaching a list of prohibitions.

Privacy isn’t hiding. It’s choosing.

The footprint that stays

Everything you do online leaves a record. What you search for, how long you linger on a video, what you like at two in the morning, where your phone has been. That trail is your digital footprint, and it tells a story about you that is more complete than the one you would tell yourself.

For adults, this becomes digital reputation: the photo from ten years ago that shows up at the job interview, the angry comment the hiring process dug up. For children, it’s even more delicate, because they didn’t choose any of it. The photos parents have posted since the maternity ward, the report card celebrated in the family group, the funny video of the tantrum at the supermarket. The Sociedade Brasileira de Pediatria, Brazil’s pediatric society, has already called the excessive exposure of children by their own parents a form of abuse. That’s no exaggeration. That child will grow up and find all of it, and people with bad intentions may find it first.

This applies to educators too. Posting a photo of a student on a field trip, at recess or at a party, without the express permission of their parents or guardians, violates that child’s right to their own image. It’s common, it’s well-meaning, and it’s wrong.

What you post today is what someone finds tomorrow. Post for tomorrow.

There is no free lunch

A simple survey, done in every group: how many apps do you have on your phone? Most people guess thirty. The real count is over sixty. And how many of them did you pay for? None.

If the app is free, it makes money some other way, and that way is you. Every gesture on the screen becomes a data point. The data of millions of people becomes a detailed profile of what each one likes, fears, buys and intends. That profile is what gets sold: to whoever wants to sell you sneakers, and to whoever wants to sell you an idea. On broadcast TV, the commercials paid for the soap opera. Today, your data pays for the app.

The name for this is digital listening. Social networks are the best place in the world to listen, because there we only interact with what we like. Every like teaches the machine. After a while it knows how to suggest the product, the video and the course you didn’t yet know you wanted. It isn’t magic. It’s your own history handed back to you as an ad.

And it isn’t only ads. Political campaigns use the same data to decide what each person will see. The Data Detox Kit sums it up: the more a campaign knows about you, the more it can influence you, whether to donate, to change your vote or to stay home on election day. That’s how the Cambridge Analytica case worked, where a personality quiz on Facebook became a tool for targeted propaganda. Thinking as a collective, that is more serious than one more pair of sneakers in the cart.

What you can do today

Privacy isn’t solved in one go, but it gets better in ten minutes:

• Review who sees what you post. On every network, the option exists. Friends, followers, everyone: choose.
• Turn off location in apps that don’t need it to work. The map needs it. The flashlight doesn’t.
• Delete what you don’t use. An idle app keeps collecting.
• See what Google has kept at myactivity.google.com. You can delete it and turn off collection.
• Rename your Wi-Fi and Bluetooth if they carry your name or your family’s.
• Don’t tag yourself in every post, and talk to the people who tag you.
• Before posting a photo of a child, ask: will they be glad to find this when they’re fifteen?

Each of these is a ten-second gesture. In a training, have the group do one of them right there, on their phones. One changed setting is worth more than an hour of warnings.

What you never hand over, nobody can leak.

If privacy is choosing what goes out, account security is making sure nobody gets in. And the door to everything is email: whoever gets into it clicks “forgot my password” on every other service and changes everything in five minutes. Then comes WhatsApp, which today is a person’s identity in the eyes of their whole family, and the bank.

What’s behind those doors is what scammers want: credentials, card numbers, CPF (Brazil’s taxpayer ID number), address, phone number, email. With that, they open accounts, take out loans, ask relatives for money pretending to be you. This isn’t a problem for careless people. It’s a problem for everyone who has an account somewhere, which is to say, everyone.

The worst password in the world

In its trainings, Casa Hacker runs a contest: whoever builds the worst password in the world wins. Each person has fifteen points. Your own name is worth four. CPF or RG, two. The pet’s name, six. Date of birth, eight. Whoever spends all fifteen points wins. The room laughs, and then someone asks what all these pieces of information have in common. They are all on almost everyone’s public profile.

A weak password isn’t one with few letters. It’s one that can be guessed by someone who knows you, or by a program that tests the hundred thousand most common passwords in the country in under a minute. “123456”, “senha” (Portuguese for “password”), the name of your team, your child’s name followed by the year. All of them fall in the first second.

A strong password, in one line

Long, unique and unexpected. That’s it.

• Long: twelve characters or more. Length matters more than symbols.
• Unique: one password for each account. If you use the same one everywhere, a leak at a small website opens your bank.
• Unexpected: unrelated words strung together beat any “Name@2024”. Something like “brick-popcorn-fog-42” is easy to remember and almost impossible to guess.
• Nothing that’s on your profile. No team, no pet, no date.

Changing your password from time to time only makes sense when there’s a reason: a leak, a lost device, someone who had access. Changing for the sake of changing leads people to create predictable variations, and that’s worse.

One password, one door. One leaks, they all leak.

The second key

Two-step verification, or 2FA, asks for a second code in addition to the password: a number that arrives on your phone or that an authenticator app generates. With it turned on, whoever discovers your password is still locked out.

Turn it on for your email, your bank, your social networks and, first of all, WhatsApp. The cloned-WhatsApp scam is the most common in Brazil, and the app’s two-step verification stops it almost completely. It takes two minutes: Settings, Account, Two-step verification. In a training, have the group do it right there.

Prefer an authenticator app over a code by SMS whenever the service offers it. And keep the recovery codes on paper, at home. Without them, losing your phone can mean losing the account.

Take care of the recovery options too. Are the “recovery” email and phone number you registered years ago still yours? If not, whoever has them today can get into your account.

Has your email already leaked?

Almost certainly yes, and it’s nothing to be ashamed of. Big services leak lists of emails and passwords all the time. The site haveibeenpwned.com tells you which leaks your email has appeared in. It doesn’t keep what you type and is maintained by a respected security researcher.

If it shows up, change the password for that service and for any other where you used the same one. That’s why “unique” is the rule that matters most.

Password manager

Nobody remembers sixty different passwords. You don’t have to. A password manager is a vault with a single strong master password; it creates and remembers the others for you, and fills them in when you log in. Bitwarden is free, open source and available in Portuguese, for phone and computer. KeePassXC keeps the vault on your own device, no internet needed.

For older people or anyone not at ease with apps, the little notebook kept in a drawer at home is an honest password manager. It’s far safer than the same password everywhere, which is the real alternative. The password thief is on the other side of the world, not in your drawer.

The rest that guards the door

• Update your phone and your apps. Updates close holes that scammers already know about.
• Be wary of public Wi-Fi for banking and shopping. Prefer your phone’s mobile data.
• Back up your photos and documents somewhere else, whether in the cloud or on a USB stick. Phones break, get stolen, fall in the water.
• Antivirus helps on the computer. On the phone, the best protection is downloading apps only from the official store and reading the permissions they ask for.

Security isn’t distrusting everything. It’s locking the door when you leave.

Nobody breaks into a bank. It’s hard, it’s expensive, and the security teams are big. It’s much easier to call a person saying you’re from the bank and ask them to confirm their password. The name for this is social engineering: manipulating people, not machines, to get information or money. Social engineering targets three things every human being has: haste, fear and goodwill.

That’s why nobody falls for a scam out of stupidity. They fall out of trust, on a busy day. Saying this at the start of the conversation takes the shame out of the room, and it’s shame that makes the victim hide the scam instead of telling someone, which only helps the scammer.

The bait always looks the same

Change the channel, change the story, the structure is the same. Learn the structure and you’ll recognize the scam they haven’t invented yet.

• Urgency. “Your account will be blocked today.” “Last chance.” “Confirm within ten minutes.” The rush stops you from thinking.
• Authority. It comes from the bank, the government, the boss, the power company, your son or daughter. Someone you wouldn’t question.
• A link or a file. There’s always something to click or download. That’s where the scam happens.
• A request. Password, code, card number, a payment “to release” something.
• A story. Too good (you won, you’re the millionth visitor) or too scary (your intimate photo is about to leak, your CPF was used in a crime).

The “virus that filmed you” scam is a perfect example: a message claims to have recorded the person on an adult website and threatens to send it to their contacts unless it gets paid. There is no video. There is fear, and fear pays.

Phishing and its cousins

Phishing comes from “fishing”: a fake email or website, looking like the real one, fishing for your data. When it arrives by SMS, it’s called smishing. By phone call, vishing: the “manager” who asks you to confirm a transaction, the “support” that needs to access your computer. When the scammer poses as the company director to fool an employee, whaling. You don’t need to memorize the names. You need to recognize that the bait is the same on any channel.

The WhatsApp scam

It’s the most common in Brazil and deserves its own section. It comes in three versions:

1. “Hi mom, I changed my number.” Someone writes from a new number, with your child’s photo, and asks for an urgent Pix (Brazil’s instant bank transfer). The defense is to call the old number, or ask a question only your child would know the answer to.
2. The six-digit code. A message says they sent a code by mistake and asks you to pass it on. That code is what activates your WhatsApp on the scammer’s phone. Never pass on any code.
3. The cloned profile. With your photo and your name, the scammer asks your contacts for money. The defense is WhatsApp’s own two-step verification, which prevents cloning, and warning your network as soon as you notice.

Seven questions before you click

1. Who really sent it? Look at the whole email address, not just the name. “banco-seguro@gmail.com” is not the bank.
2. Do I use this service? If you don’t have an account at that store, the invoice is fake.
3. Are there spelling mistakes, a crooked logo, odd formatting? Big companies proofread. Scammers don’t.
4. Where does the link go? On a computer, hover the mouse over it without clicking. On a phone, hold your finger on the link to see the address. If it isn’t the official domain, stop.
5. Are they asking for a password or a code? No bank, no serious company and no government asks for a password by message.
6. Can I confirm through another channel? Call the number on your card. Open the official app. Ask your relative on the old number.
7. Is there a rush? The rush is the bait. Whoever is in the right can wait.

Cloned websites

A fake site copies the look of the real one and changes one letter in the address. Before typing a password or card number, read the address in the browser bar, letter by letter. Prefer to reach the site by typing the address yourself, or through the official app, instead of clicking a link you received. A padlock next to the address means the connection is encrypted, not that the site is honest: scammers have padlocks too. And pay attention to the browser’s warnings about unsafe sites. That’s what they’re there for.

Deepfakes are scams too

Your child’s voice asking for money on a call, a video of the mayor announcing a fake benefit, the TV host selling a miracle cure. With artificial intelligence, the image and voice of any public figure can be imitated in minutes. The defense is the same as always: confirm through another channel, distrust urgency, and never make a decision about money in the heat of the moment.

When in doubt, don’t click. Type.

It can be hard to separate fact from fiction when a video, an image or a text shows up on your screen. Personality quizzes that profile you, shocking headlines, doctored photos that convince you of a reality that doesn’t exist. What you see is not always what it seems, and the problem is not a lack of schooling. Researchers, doctors and journalists share false things too. The difference is the habit of checking.

In the communities where Casa Hacker works, disinformation is not an abstraction. It is the miracle cure sold in the neighborhood group, the rumor about the neighbor, the lie about the vaccine, the government benefit that doesn’t exist and the Pix transfer that “secures your spot”. It costs money, health and community life.

What disinformation is

False or distorted information, produced or passed along with the purpose of confusing or misleading. It is not only fabricated “fake news”. Much of what circulates is half true: the real photo in a false context, the headline that doesn’t match the text, the satire taken seriously, the quote cut short. Researcher Claire Wardle organized it into seven types, and they are worth knowing because each one calls for a different check:

1. Satire or parody taken seriously.
2. Biased content: selects only what confirms a thesis.
3. Impostor content: uses the name of a trusted source that never said it.
4. Fabricated content: invented from scratch.
5. False connection: headline, photo and text that don’t go together.
6. Manipulated content: altered photo, audio or video.
7. Rumor: the “I heard that…” that grows with every retelling.

What they all have in common is the engine. Disinformation spreads because it stirs emotion, not because it is true. The more anger, fear or outrage a piece of content provokes, the faster it travels.

If you felt the urge to share it right away, that is your cue to wait.

Five questions before you believe

Casa Hacker’s 2021 booklet organized verification into five blocks. It is still the best material to print and stick on the wall.

• Author. Is it clear who wrote it? Is this person an expert on the subject? Do they have a reputation? Are the site’s contact channels real?
• Accuracy. Is the content true? Are there spelling or grammar mistakes? If there are photos, are they real and from that context? Do other reliable sources say the same?
• Objectivity. Is the information complete, or just a convenient piece of it?
• Currency. Can you tell when it was created and when it was updated? Do the links work? A true news story from 2019 becomes a lie when it is reposted as if it were from today.
• Coverage. Is the topic explained in depth? Do the links lead to good sources, or just to other catchy headlines?

None of these questions requires being a journalist. They require a minute.

Someone has already checked for you

Brazil has serious, free fact-checking agencies: Comprova, Aos Fatos, Agência Lupa, Estadão Verifica, Agência Pública, E-farsas. Before sharing, search for the content’s headline in quotation marks. If it has already been debunked, it will show up. Some agencies take content for checking over WhatsApp.

For images, there is reverse search: sites like TinEye or Google Images show where a photo has appeared before. The photo of “yesterday’s flood” is usually from another country, another year.

Fact-checking is an enormous job and the teams are small. They prioritize what is most likely to go viral or cause harm. In other words: not everything will be checked by them. The rest is up to us.

Clickbait and deepfakes

Clickbait is the sensationalist, dishonest or invented headline made to provoke a click. The more attention a piece of content gets, the more ad money it makes, so the incentive is to lie beautifully. A deepfake is a video, audio or image altered by artificial intelligence to put words in someone’s mouth or swap a person’s face. Today anyone can make one in minutes.

Against both, the same remedy: visit the original source, check the author, look at the type of content (opinion? ad? news?), cross-check with other sources before taking it as true, and only then share.

And beware of personality quizzes: “which character would you be?” may be a carefully built questionnaire to harvest psychometric data. It was exactly this kind of quiz that got Facebook and Cambridge Analytica into trouble for profiling and targeting voters without consent.

Burst your bubble

Apps show you what you already like. That is algorithmic curation: the machine recommends based on your likes, views and shares. Over time, you only see people who agree with you, and you start to think the whole world thinks the same. Then any lie that confirms what you already believe walks right in.

The way out is to choose, on purpose, sources from outside your circle. Subscribe to services that gather news from diverse perspectives; Global Voices in Portuguese is a good start. Follow people you respectfully disagree with. A bubble doesn’t burst on its own.

Sharing is publishing

If one person shares a piece of content with ten friends and each passes it on to ten more, in two steps it has reached a hundred people. In seconds. And there is no pulling it back or correcting it. Every person who shares is, in that instant, a newspaper editor with their own name on the front page. Worth asking first: would I put my name to this?

Whoever shares, publishes. And whoever publishes, answers for it.

According to studies, the average person looks at their phone more than 150 times a day. If we did anything else that often, we would see a doctor. Are we choosing to look that much? Or did someone choose for us?

Designed to seduce

The phone is fun and useful. It is also a powerful tool of seduction. Every feature, color and sound was optimized by teams of designers and psychologists to keep us connected and wanting more. It is not a conspiracy theory; it is the business model. The app is free and lives off ads. The longer you stay, the more ads you see. So everything in it is designed to make you stay.

Infinite scroll has no end because an end would be an invitation to leave. The little red notification dot uses the color of danger because danger is something we don’t ignore. The like and the “seen” work like a slot machine: an uncertain reward, sometimes it comes, sometimes it doesn’t, and it is precisely the uncertainty that brings you back. The next video starts on its own before you decide. The name for this is persuasive design, and there are very well-paid people working on it right now.

It is not a lack of discipline. It is design working against you.

Is it your fault for liking it?

In its trainings, Casa Hacker writes this question on a poster and lets the circle answer. The good answer is: no. Liking it is not a fault. The app was made to be likeable by people who understand the human brain. Feeling guilty only produces one more cycle of use: the person punishes themselves, gets distracted, goes back to the phone.

The question that sets you free is a different one: who profits from my time, and what do I want to do with it? When a person understands that their time is the product, the relationship changes. Not because they come to hate the phone, but because they start using it instead of being used.

Signs it has gone too far

Talk about this without judgment, because everyone in the circle will recognize themselves in at least one item. You included.

• Picking up the phone for no reason, “just to check”, and noticing half an hour later.
• Poor sleep, phone in bed until late, the first gesture of the day while still lying down.
• Irritation when the battery dies, the internet drops or someone asks you to put it away.
• Constant comparison with other people’s edited lives.
• Children who only calm down with a screen, and adults who can only calm them that way.
• The urge to record the moment before living it.

For children and adolescents, the subject has one more layer. The developing brain is more sensitive to uncertain reward, and social comparison on the networks weighs more. That is why the ECA Digital, Law 15,211/2025 (the digital update to Brazil’s Child and Adolescent Statute), now bans platforms from using minors’ profiles for targeted advertising and requires supervision mechanisms. The law recognizes what this chapter says: it is not just a matter of individual willpower.

What you can change today

Digital well-being is not throwing your phone away. It is taking back the choice. Each item below takes less than a minute:

• Turn off notifications from anything that isn’t a person. Messages from people, yes. Alerts from a store, a game, a social network, no. You open them when you want to.
• Black-and-white screen at night. In the accessibility settings. Without color, scrolling loses much of its appeal.
• Night light from late afternoon on, for your sleep.
• Phone out of the bedroom at bedtime. A bedside alarm clock costs little.
• A daily limit on one app, just to measure. The “Digital Wellbeing” or “Screen Time” dashboard shows how much you use and lets you set a reminder.
• One screen-free time in the household routine. Dinner, breakfast, the first hour after school. It applies to the adults first, because children copy what they see.

In a training, ask each person to pick one item and do it right there. Turning off one app’s notifications is the easiest, and the one you notice most. The following week, ask who missed it.

Well-being is a right

Having a healthy relationship with technology is not a privilege for those with time for detox retreats. It is a right of every person and every territory, and that is why it is treated here as part of digital security, not as self-help advice. Those who educate can do two things: give people the vocabulary to name what is happening to them, and show them that the settings exist.

Use your phone. Don’t let your phone use you.

Bullying comes from “bully”, the tough guy who picks on others. It is a relationship of repeated intimidation, control and humiliation by a person or group over someone, meant to create the idea that there is something wrong or inferior about the victim. It happens in the schoolyard, on the bus, on the football pitch. Cyberbullying is the same thing through a screen, and the screen makes everything worse: there is no going home, the humiliation becomes a thousand in minutes, it stays recorded forever, and the aggressor doesn’t see the face of the person they hurt.

Brazil has the world’s fourth-largest population of digital natives. For children and adolescents, the internet is the main space where they live their social lives. It is where they make friends, fight, date and suffer. Those who educate need to be there too, at least with their attention.

Teasing or violence?

The hardest question, and the most important. Children tease, adolescents roast each other, and not every joke is violence. Three criteria separate the two, and they apply to bullying and cyberbullying alike:

1. It is intentional. It means to disturb, intimidate or hurt.
2. It is repeated. It happens again and again, over time.
3. There is a power imbalance. One side has more strength, more people, more popularity or more reach.

All three together are bullying. A funny photo edit posted once and deleted when the person asked is not. A group created to talk trash about someone, with screenshots of private conversations, is. The nickname the person accepts is everyday life; the nickname they asked to stop and that kept going is violence. Teaching this distinction to the adolescents themselves is half the job, because they can regulate themselves when they have the words.

A joke ends when the other person says stop. If it goes on, it has changed its name.

Signs that show up before anyone reports it

The victim rarely tells. They are ashamed, afraid of making it worse, or think it is their fault. Those who educate usually see the signs before the family does, because they see the person in the group:

• Withdrawal; disappearing from gatherings, activities, snack time.
• Sudden change in phone use, either up or down.
• Drop in performance, trouble sleeping.
• Disproportionate anger and aggressiveness in situations that didn’t call for it.
• Fear of going to a certain place or being in a certain group.
• Sadness that won’t lift, talking about themselves as worthless.

No single sign proves anything. Several together call for a private conversation, without pressure: “I’ve noticed you seem different; I’m here.”

What the law requires of those who educate

Law 13,185/2015, Brazil’s anti-bullying law, created the Program to Combat Systematic Intimidation. It defines bullying and cyberbullying and says that preventing them is a legal duty, not a favor. It establishes that institutions must train their staff, promote discussion and awareness campaigns, provide psychological, social and legal assistance to victims and aggressors, and record the cases. Schools must produce reports every two months. The law speaks of schools, but its spirit applies to any space that brings children and adolescents together: social project, church, collective, sports court.

On liability: from age 18 there is criminal liability. Between 12 and 18, the conduct is not a crime but an ato infracional, an infraction under the ECA (Brazil’s Child and Adolescent Statute), subject to its measures, from a warning to detention. And under article 932 of the Civil Code, parents are civilly liable for their minor children: whoever creates a fake profile to attack a classmate can generate damages that the family will pay. The internet is not a lawless land, and digital traces allow the police, the Ministério Público (the public prosecutor’s office) and the courts to reach those responsible.

Mediate before litigating

Casa Hacker’s perspective, and that of the 2021 booklet this kit grew out of, is to prioritize mediation and social-emotional skills. Long before any report, and even during a legal process, the educational role is to prevent and mediate so that the harm is as small as possible.

In practice:

1. Safety first. Make sure the victim is supported and that the aggression has stopped or is about to (blocking, leaving the group, removing the content).
2. Separate conversations with each side, no audience. An audience is bullying’s fuel.
3. Families as allies, not defendants. The aggressor’s family usually doesn’t know; the victim’s is usually frightened.
4. Record everything, with dates: what happened, who was heard, what was agreed. That record is what the law asks for and what protects everyone if the case escalates.
5. Don’t treat it as an isolated case. After the episode, return to the topic with the whole group, without exposing anyone. One-off actions don’t change culture; actions across the year do.

Cases involving risk to life, threats or any kind of physical aggression call for immediate notice to the police, the Conselho Tutelar (the local child protection council) or the Ministério Público, as the case requires. The chapter What to do has the step by step for preserving evidence and reporting.

Nobody is just the audience

Most people in a cyberbullying situation are neither victim nor aggressor. They are the audience. And the audience is bullying’s strength: without those who laugh, those who pass it on and those who pretend not to see, it doesn’t work. Teaching young people what to do as bystanders is what they can do on their own, without an adult: don’t pass it on, leave the group, report it on the platform, send the victim a private message, tell someone they trust.

Those who see and stay silent take part. Those who see and act put an end to it.

Brazil has the world’s fourth-largest population of digital natives. For adolescents, the internet is the main public space of social life, and it is there that they live their first experiences, including romantic and sexual ones. Pretending otherwise protects nobody. What protects is the adult who knows what they are talking about and doesn’t judge before listening.

It is worth saying, first of all: exchanging intimate images can be a legitimate part of getting to know one’s own body, of exploring pleasure, of building trust between two people. That is not the subject of this chapter. The subject is what happens when that trust is broken, and what happens when an adult takes advantage of a child.

It is not pornography. It is a crime.

The most frequent case is intimate content leaked after a relationship ends. One of the parties, almost always the man or the boy, makes public images received in a relationship of trust. It is popularly called “revenge porn”, and the name hides what matters most: publishing intimate content without authorization is a crime, not a genre of pornography, even if the aggressor uses porn sites or pretends to offer sexual services in the victim’s name. Law 13,718/2018 made it a crime to share footage of sex or nudity without consent, and criminalized sexual harassment.

When it involves someone under 18, the act is even more serious: it is the production and sharing of images of a crime against the sexual dignity of a child or adolescent, a form of sexual violence. Pornography presumes voluntary participation between adults. Where there is a child or adolescent, there is abuse or exploitation, so these are not pornographic images; they are images of a crime.

The Child and Adolescent Statute (ECA), in articles 240 and 241, sets a sentence of four to eight years for whoever produces these images, three to six for whoever shares them, and one to three for whoever stores them, whether on a USB stick, a computer or a phone. Online harassment and luring can carry up to three years. This has a practical consequence many people ignore: receiving and keeping an adolescent’s intimate image, even “as evidence”, is also a crime. We will come back to this in the next chapter.

The victim is never to blame

No circumstance makes the victim responsible for the exposure. It doesn’t matter whether they sent the photo, trusted the wrong person, had been drinking, or “should have known”. The person who shared it without consent is the only one to blame. This sentence needs to be said out loud, because blaming is what makes the victim go silent, and silence is what allows the exposure to continue.

The aggressor is to blame. Always.

Risks with names

Naming helps you recognize. The main risks children and adolescents face online, in the list Casa Hacker uses with partners:

• Grooming: an adult who approaches a child on the internet, gains their trust and prepares the ground for abuse. It usually starts with attention, gifts, secrets.
• Sextortion: blackmail with an intimate image. “If you don’t send more, I’ll spread this one.”
• Sexting: exchanging intimate messages or images, which becomes a risk when it leaks or when an adult is involved.
• Exposure to inappropriate content, extreme violence, encouragement of self-harm.
• Luring, human trafficking, commercial sexual exploitation.
• Publication of private information (address, routine, school) that makes an in-person approach possible.

Most of it starts outside the walls of any institution, and reaches those who educate through a change in the child’s behavior or a peer’s account.

The duty of those who educate

Education and health professionals have a legal duty to report every case of violence or harm against children and adolescents, on or off the internet. Reporting is not “turning the adolescent in”. It is protecting them. The Statute is clear: it is everyone’s duty to watch over the dignity of children and adolescents, keeping them safe from inhuman, violent, humiliating or embarrassing treatment.

In practice, when a case comes in:

1. Welcome. “You did the right thing by telling.” No interrogation, no “why did you send it”.
2. Stop the exposure. Help request removal (below) and block the aggressors.
3. Guide the family on the paths available and stay with the victim; if the suffering is more than they can bear, refer them to professional help.
4. Report to the Conselho Tutelar (the local child protection council), the Ministério Público (the public prosecutor’s office) or the police station, depending on the severity. In cases involving an adult abuser, always.
5. Proportional intervention. Don’t expose the victim a second time “to set an example”. Don’t hold an assembly about the case. Work on the topic with the group, later, without names.
6. Watch for revictimization. Someone who suffered abuse and returns to the group needs protection from jokes, stares and stigma. Sensitizing the others is part of the job.

Sometimes, when the case involves two adolescents and there is no adult abuser, mediation and an educational resolution may be more effective than going to court. That assessment belongs to the team together with the families, never to the victim alone.

The platform has to take it down

The Marco Civil da Internet (Brazil’s Internet Bill of Rights), in article 21, says that in cases of nudity or sex without authorization the victim (or their representative) can request removal directly from the platform, with no court order needed. If the platform, once notified, fails to remove the content diligently, it becomes liable for it. It is the fastest way to stop the exposure. Before requesting removal, record the address and the evidence, as the next chapter explains.

Don’t be a bystander

Even if on a smaller scale, there are many serious cases involving boys and men. Regardless of the gender or sexual orientation of the person exposed, this violence against intimacy and the body cannot be allowed to become trivial. If you receive content of this kind: don’t share it, report the link on the platform and delete it from your device. Don’t comment, don’t ask, don’t laugh. If you know the person, talk to them in private and offer concrete help. Circulation depends on each person who passes it on.

Breaking the chain is the one thing everyone can do. And it is the one that matters most.

Anyone who has suffered cyberbullying, a scam or sexual violence online can report it and ask for help. The first piece of advice is the hardest to follow: don’t reply, don’t retaliate, don’t take justice into your own hands. That only escalates the violence and can turn the victim into a defendant. Victims under 18 need to be guided to ask a guardian or a trusted adult for help, and it is that adult who leads the steps below.

This chapter is meant to be consulted when the problem hits. Print it, stick it on the wall, save it on your phone.

1. Save the evidence

Don’t delete anything. Not the content, not the conversations, however much it hurts.

• Record the exact address of every post. Page, social media profile, blog, video, everything has an address (URL). Copy the whole thing, from “https” to the end, not just the site’s name. If an entire profile is dedicated to the attack, save the profile’s address and that of each offensive post.
• Take screenshots with date and time visible. Photograph the screen with another device if you need to.
• Keep e-mails and conversations from messaging apps. Export the conversation if the app allows it.
• Save the content itself: texts, images, videos.

These are the materials the authorities will have to move the report forward.

One exception almost nobody knows about, and it changes everything. When the content is sexual and involves someone under 18, only the victim or their legal guardians should hold those records. Possessing an intimate image of a child or teenager is the crime of storage, even if the intent is to “keep it as evidence”. The educator, however well-meaning, cannot save or forward that content without authorization. What the educator does is guide the family to keep it, and stay close.

2. Record it with a notary

With the evidence in hand, a notary’s office (cartório) can draw up an ata notarial, a notarized record: the notary checks the addresses and the content and certifies that the offense, intimidation or abuse existed, with that content, on that date. It is the notary’s official authority lending weight to the evidence, which counts for more than a loose screenshot when the case reaches court. It costs money; families without means can seek guidance on alternatives from the Defensoria Pública, the public defender’s office.

3. Block the aggressors

A simple and urgent step: the victim needs to stop receiving the abusive content. Block on every network and app, and leave the groups where the attack circulates.

4. Report to the platform itself

Every platform has a reporting mechanism, and cyberbullying, threats and non-consensual nudity break the rules of every one of them. Report the post and ask for its removal. It’s free, immediate and often enough to stop the spread.

The Marco Civil da Internet, Brazil’s internet bill of rights, gives the victim of intimate exposure the right, in article 21, to demand removal directly from the platform, no judge needed; a platform that is notified and fails to act becomes liable. If reporting through the button doesn’t solve it, a lawyer can send an extrajudicial notice so the company formally takes notice and acts.

5. File a police report

Depending on the severity, file a boletim de ocorrência, a police report. Children and teenagers can do so, accompanied, and so can anyone close to them. If your city has one, go to the police station specializing in cybercrime or the women’s police station; if not, any police station will take it. Many states have an online police station. Bring the evidence.

6. Ask search engines for removal

Google offers a form to ask that content stop appearing in search results tied to the victim’s name. This does not remove the content from the page where it is hosted, but it stops people searching for the person’s name from finding it. The form can be filled in by legal guardians, when the victim is a minor, or by lawyers. Google is not responsible for the content of websites, only for search, so it is essential to also try to contact whoever runs the page.

7. Support network

When guiding victims and families, insist on the support network: friends, family, the community itself and the spaces where the person spends their days. It helps them get through the moment and keeps worse situations, or tragic endings, from happening. If the victim shows that the suffering is more than they can bear, or struggles to get back into a routine, guide the guardians to seek professional help: psychologists, the local health service, the CAPS (Brazil’s community mental health centers).

When the case happens inside a group (a class, a collective, a project), it is vital to make the others aware of how serious it is, without exposing the victim, to avoid revictimization and stigma.

8. Who to turn to, and when

• Conselho Tutelar, the municipal child protection council of your city: every situation involving a child or teenager.
• Disque 100, the national human-rights hotline: human-rights violations, including against children and teenagers. Disque 180: violence against women.
• Safernet: anonymous reporting of online crimes (forwarded to the Ministério Público Federal, Brazil’s federal prosecution service) and a confidential helpline by chat.
• Ministério Público, the public prosecutor’s office, and Defensoria Pública, the public defender’s office: for accountability and redress; the Defensoria serves those who cannot afford a lawyer.
• 190: any immediate risk to life.

When the victim or the family wants to pursue legal action, gather all the documents above and go to the Defensoria or a lawyer. Sometimes, when the case involves only teenagers, mediation and an educational resolution can be more effective than a lawsuit; that is a decision for the family together with the team, with the victim heard.

Don’t be a bystander

If you receive content of this kind, don’t share it. Report the link and delete it from your device. Don’t ask the victim “why did you send it”. Under no circumstances should the victim be blamed.

The aggressor is to blame. Always.

The internet, like any other shared space, demands respect for human rights so that technology can help build a fairer society. These principles are written into law. Those who educate don’t need to be lawyers, but they do need to know that the law exists, what it asks and where to find it. That is what this page is for.

The laws, one by one

Marco Civil da Internet, Lei 12.965/2014. Brazil’s internet bill of rights, the “constitution” of the Brazilian internet. It guarantees privacy and freedom of expression, defines the responsibilities of platforms and, in article 26, states that the State’s duty regarding education includes building capacity for the safe, conscious and responsible use of the internet. It is the legal basis for this training. In article 21, it gives the victim of non-consensual intimate exposure the right to demand removal directly from the platform.

Estatuto da Criança e do Adolescente, Lei 8.069/1990. Brazil’s Child and Adolescent Statute, the ECA. All the rights and duties in the ECA apply online too. Children and teenagers have the right to the preservation of their image, privacy, identity, autonomy and ideas (article 17), and it is everyone’s duty to keep them safe from humiliating or embarrassing treatment (article 18). Since the 2008 reform, articles 240 and 241 criminalize producing, sharing and storing sexual images of children and teenagers. Teenagers who commit an act defined as a crime commit an ato infracional, a juvenile offense, and answer with socio-educational measures, from a warning to detention.

Lei 13.185/2015, the Program to Combat Systematic Intimidation. Defines bullying and cyberbullying and makes prevention a legal duty of institutions: train teams, promote discussion and campaigns, provide psychological, social and legal assistance to victims and aggressors, record cases and, in the case of schools, produce reports every two months.

Lei 13.718/2018. Amended the Penal Code to criminalize sexual harassment (importunação sexual) and the disclosure of scenes of rape, sex or nudity without consent. It is the law that answers the leaking of intimate images between adults.

Lei Geral de Proteção de Dados, Lei 13.709/2018. Brazil’s General Data Protection Law, the LGPD. Personal data may only be collected with a clear purpose and a legal basis, and people have the right to know, correct and delete. Children’s data requires a guardian’s specific consent. It applies to those who educate too: the attendance list with CPF numbers (the Brazilian taxpayer ID), the group photo, the project’s sign-up records are all personal data.

Código Civil, article 932. Parents are civilly liable for the minor children under their authority. Whoever creates a fake profile to humiliate a classmate can generate damages the family pays.

ECA Digital, Lei 15.211/2025. In force since March 2026, it creates specific rules to protect children and teenagers in the digital environment: age verification on platforms; guardian supervision, with linked accounts; immediate removal and notification of the authorities for content involving sexual exploitation, abuse, grooming and abduction; a ban on profiling minors and on directing commercial advertising at them.

Base Nacional Comum Curricular and Plano Nacional de Educação em Direitos Humanos. Brazil’s national core curriculum and its national plan for human-rights education. They are not criminal laws, but they guide the curriculum: critical thinking, responsibility, autonomy, respect for diversity, empathy and peaceful conflict resolution. Digital culture is a general competency of the BNCC. Anyone who needs to justify the training to management will find the argument here.

Until the ECA Digital is regulated

The law is in force, but much of its machinery depends on regulation by the ANPD (Autoridade Nacional de Proteção de Dados, Brazil’s data protection authority) and on implementation by the platforms. Casa Hacker’s recommendations for this period:

• Know the topics: cyberbullying, online harassment, sexual exploitation on platforms, online grooming and cybercrimes against children and teenagers.
• Ongoing training in internet safety for and with the whole territory: educators, managers, leaders and families.
• Guardian supervision as a practice of care, not surveillance. The law will offer tools; the conversation at home remains the main one.
• Follow the ANPD and understand the mechanisms that will be built into apps, so you can guide, report and refer cases with confidence.

To cite

You don’t need to memorize law numbers. You need to know that, for every situation that reaches an educator, there is a law that covers it, and that digital traces let the police, the Ministério Público (the public prosecutor’s office) and the courts reach those responsible. Say that to victims, so they know they have someone to turn to. Say it to potential aggressors, so they know the screen doesn’t hide them.

The internet is not a lawless land. It’s a land with laws few people have read.

A booklet teaches the reader. A kit teaches the one who will teach. That is the difference, and it lives here: ready-made activity plans, written for whoever will be standing in front of a group, with a goal, duration, materials, a timed step by step, opening questions and variations.

The plans were written by Casa Hacker for this kit, drawing on what worked in the organization’s own trainings and on what earlier scripts taught us. They don’t depend on a website or a platform: paper, pen and a phone are enough. They work for a small-group talking circle, a classroom, a collective, a community activity in the street and a forty-minute talk.

How the plans are organized

Each plan states the age group it was designed for and the formats it works in. There are six age groups: 6 to 8, 9 to 11, 12 to 14, 15 to 17, adults and families, and leaders who will multiply. There are five formats: small-group circle, classroom, collective, open community activity and talk.

Use the filter to find what fits your situation. Each plan says which chapter of the booklet it connects to, so you can read it beforehand.

Three golden rules

1. Nobody has to show their own screen. The phone is the activity’s tool, never evidence. When people know they won’t be exposed, they tell the truth, and it is the truth that teaches.
2. Start with the question, not the answer. Every plan opens with a question the group answers before you explain anything. The content comes afterwards, fitted into what the group has already said.
3. End with a gesture. A setting changed, a stop phrase agreed on, a list on the wall. A conversation that doesn’t become a gesture gets lost on the way home.

Adapt before you run it

No plan was written for your territory. Before running one, swap the examples for the ones your community recognizes: the scam that went around the neighborhood, the app young people there use, the fake news that split the street’s group chat. The plan gives the structure. The local example gives the truth.

And after you run it, tell us about it. Three lines to falae@casahacker.org: what worked, what got stuck, what they asked that you couldn’t answer. That is how the next version of this kit gets better.

A good plan is one that survives contact with real people.

Everything below was checked in September 2026. Whatever no longer responded was dropped. If a link breaks, let us know at falae@casahacker.org.

Kits and methodologies

• Data Detox Kit, by Tactical Tech, in Portuguese. Short steps for privacy, security, well-being and disinformation. It is the methodological foundation of this kit; Casa Hacker has been a Tactical Tech partner since 2018. There is a track for young people.
• The Glass Room, an exhibition on data and technology, with materials to print and set up a local version. Casa Hacker brought the exhibition to Rio de Janeiro and São Paulo in 2023.
• What The Future Wants, Tactical Tech’s exhibition for young people on technology and the future, translated and adapted by Casa Hacker.
• Security in a Box, digital security guides for people working in communities and defending rights.
• Holistic Security, Tactical Tech’s manual for organizations working in risky contexts (in English).
• Cartilha de Segurança para Internet, CERT.br’s internet security booklet, with short, illustrated installments on passwords, scams, two-step verification and social media.
• Internet Segura, from NIC.br, materials by audience, from children to older people.
• Privacidade Digital, guides in Portuguese on tools that respect privacy.
• NIC.br security videos, short, to open a conversation.

Tools

• Have I Been Pwned: type in your e-mail and find out which data breaches it has appeared in.
• Bitwarden: free, open-source password manager, in Portuguese. KeePassXC: a password manager that works without internet.
• My Google Activity: everything Google has kept about you, to view, delete and turn off.
• Facebook Privacy Checkup: review who sees what.
• TinEye: reverse image search, to find out where a photo has appeared before.
• This Person Does Not Exist: a new, computer-generated face on every reload. To open the conversation about fake profiles.
• Removing personal information from Google Search and reporting content to Google.
• Account of a deceased person on Google: how to request access or closure.

Who fact-checks

• Comprova, a coalition of news outlets that verifies viral content and takes suggestions.
• Aos Fatos, an independent agency, with the Fátima bot on WhatsApp.
• Agência Lupa, Brazil’s first fact-checking agency.
• Estadão Verifica, Agência Pública and E-farsas.
• EducaMídia, free media literacy lesson plans, by school stage.
• Global Voices in Portuguese, news from communities around the world, to burst the bubble.

Where to report and ask for help

• Safernet, report: anonymous reporting of human-rights crimes online, forwarded to the Ministério Público Federal, Brazil’s federal prosecution service. Helpline: confidential support by chat. Indicators: the numbers behind reports in Brazil.
• Conselho Tutelar, the municipal child protection council of your city, for any situation involving a child or teenager.
• Disque 100, the national human-rights hotline, and Disque 180 (violence against women). 190 for immediate risk.
• ANPD, Brazil’s data protection authority, which regulates the LGPD and the ECA Digital.
• Criança e Consumo, from Instituto Alana, on advertising aimed at children.

Data and research

• TIC Kids Online Brasil, by Cetic.br, the survey that measures how Brazilian children and teenagers use the internet, with publications by year.
• Base Nacional Comum Curricular, Brazil’s national core curriculum, to locate digital culture as a competency.

To watch and talk about

• The Social Dilemma (Netflix): persuasive design and disinformation, told by the people who built the networks.
• The Great Hack (Netflix): the Cambridge Analytica case.
• Coded Bias (Netflix): algorithms, facial recognition and racism.
• Mr. Robot (TV series): for older teenagers, on security, power and surveillance.
• Expresso Futuro (Globoplay): technology and society, with Ronaldo Lemos.

From Casa Hacker

• Digital security for children and teenagers, with Conselho Tutelar counselors: what we learned at Unicamp’s Escola de Conselhos.
• Disinformation and elections: Casa Hacker’s text on disinformation in election season.
• The booklet “Decifrando a Privacidade Digital” (Decoding Digital Privacy, 2021), by Casa Hacker with Proteka and support from the Fondo de Respuesta Rápida of Derechos Digitales, CC BY 4.0: the origin of much of this kit. Its content has been revised and updated in these pages.

Ideas for multiplying

The ways Casa Hacker uses to bring the topic to the territory, and that any group can copy: printed educational material (this booklet will do); an exhibition with posters in the square, at the school or at the community center; training other educators with this kit’s slides; one-on-one guidance and mentoring for whoever comes with a case; and debate circles through the lens and context of the territory itself.

This kit belongs to Casa Hacker and is licensed under Creative Commons BY-SA 4.0. Copy, print, adapt and redistribute. Credit the source and keep the license. It was made to be multiplied.