Playing for Privacy Awareness: Learning from a “Wow-Moment” with iBuddy Felipe Cardoso 1 , Davide Andreoletti 1 , Alessandro Ferrari 1 , Luca Botturi 2 , Tiffany Fioroni 2 , Chiara Beretta 2 , Anna Picco-Schwendener 3 , Suzanna Marazza 3 and Silvia Giordano 1 1 DTI, Scuola universitaria professionale della Svizzera italiana, Lugano, Switzerland 2 DFA, Scuola universitaria professionale della Svizzera italiana, Locarno, Switzerland 3 Competence Centre Digital Law, Università della Svizzera italiana, Lugano, Switzerland felipe.cardoso@supsi.ch davide.andreoletti@supsi.ch alessandro.ferrari@supsi.ch luca.botturi@supsi.ch tiffany.fioroni@supsi.ch chiara.beretta@supsi.ch anna.picco.schwendener@usi.ch suzanna.marazza@usi.ch silvia.giordano@supsi.ch Abstract: iBuddy is a narrative game-based simulation session inspired by research evidence and designed to enhance secondary school and higher education students’ privacy awareness. Students enter the simulation through storytelling and are asked to install the iBuddy app. Later in the simulation, students discover that some of their personal information have been extracted from their devices and manipulated – and this generates a wow-effect that sparks questions and discussions. The simulation is backed-up by a lively debriefing phase, supported by original animation videos, interactive activities, and small group games. To overcome privacy issues, iBuddy sessions are played on a local network and the collected data, which are anonymous, are deleted before the end of the session. iBuddy exploits an original software, released as open source, with a layered architecture composed by app, server and operator interface. The system also includes an Artificial Intelligence filter for inappropriate content. Multilingual class materials are published under a Creative Commons license and are available on the www.protectyourdata.ch platform. Post-session assessments collected from over 970 students indicate that they enjoy iBuddy sessions and learn from it. Follow-up assessment data, collected on a portion of the participants, also suggest that iBuddy sessions are effective and conducive to medium-term behavioral change. Keywords: Privacy education, privacy awareness, simulation, app, secondary education, higher education. 1. Introduction: the challenge of privacy awareness In the age of digitalization our personal information is continuously exposed on digital devices and networks: privacy concerns each of us. Data privacy is “the claim of individuals, groups, or institutions to determine for themselves when, how, and to what extent information about them is communicated to others” (Westin, 1967, p.7) Privacy is related with freedom and justice (Kimmel, 1988) and it is a central issue in the progressive digitalization of our society, balancing the power of the Big Tech and of platform capitalism (Srnicek, 2017). Formal education systems included privacy in most digital competence frameworks (e.g., Carretero, Vourikari and Punie, 2017; UK Dept. of Education, 2019). Personal data management, identity management and data protection are, under different names, constituents of active digital citizenship (Carretero, Vourikari and Punie, 2017; JISC, 2014; Guitert, Romeu and Baztan, 2017). Privacy education initiatives strive to make young people aware of the technical and financial processes that involve our personal data, of our digital traces and profiles (Andreoletti et al., 2020; Eke, Norman, Shuib and Nweke, 2019), and of their value as the “new oil” (Humby, 2006; Giordano et al., 2020). Nonetheless, scholars have identified the so-called privacy paradox: although users are generically worried about privacy, many tend to accept disclosure of personal data in exchange of services or popularity (Norberg et al.,2007; Kokolakis, 2017; Barnes, 2006). In this paper we present the design, development, delivery and assessment of iBuddy, a 2-hour interactive class simulation-based session developed to let young people wonder about personal data capture and storage and to stimulate privacy learning and awareness raising. 128