Looking closely at what things leave behind¶
These four games are about noticing: what information hides in plain sight, what a message gives away without meaning to, and how quickly small pieces of information can add up to a surprisingly complete picture of someone.
They are quieter than the motion games. You need a table and some cards or paper, and most can be made from things you already have at home. They tend to produce the most conversation afterwards, because what they reveal is often genuinely uncomfortable in an interesting way.
Metadata Detective¶
Each player draws a picture of a person, place, photo, or thing on a card and keeps it face-down. On the back, they write three pieces of metadata: not what the picture shows, but information about it. A photograph of a cat taken in a kitchen on a Tuesday morning might have metadata like “taken at 7am”, “on an iPhone”, “in a kitchen”. Players swap cards. Using only the three clues on the back, each player tries to guess what the picture on the front shows.
The scoring works the other way round from most games. If you guess correctly, the person who drew the card loses a point, because their metadata gave too much away. If you guess wrong, the drawer wins a point: they protected their privacy successfully. This reversal is the whole point.
What tends to happen is that players discover they have written metadata that is far too revealing. The time of day, the device, and the location together tell you almost everything about the photograph. Then they start experimenting with what three pieces of metadata would give the least away, which is exactly the right question to be asking.
Metadata is the information about a file that travels with it everywhere, even after you have been careful about the content: who created it, when, on what device, and sometimes where. Most people have never looked at their own photographs’ metadata. After this game, they will.
The conversation about what makes metadata revealing tends to go on much longer than the game itself.
Phishing Fishing¶
Deal each player a hand of message cards. Some of the cards contain genuine messages: a receipt from an online shop, a reminder from a friend, a notification from a service they use. Others are phishing attempts, messages designed to look genuine but containing tells: an odd sender address, a link that goes somewhere unexpected, a request that feels slightly off. Players must identify and discard the phishing cards as quickly as possible to avoid losing points. Special Alert cards let you examine one extra card per turn.
The mild time pressure is what makes the game work. Most people can identify a phishing attempt easily when they are reading carefully and unhurried. The game creates just enough urgency to reproduce the conditions under which real mistakes actually happen: you are busy, you are skimming, and the message looks like most other messages at first glance.
The most useful moments are the near-misses: the card you almost kept because it was convincing in a specific way. Afterwards, go through the deck together and talk about which cards were hardest to sort, and what specifically made the phishing attempts almost believable. The answer is usually the same in real phishing too: a sense of urgency, a familiar-looking sender, and one small detail that is slightly wrong.
Younger players benefit from a simpler deck with more obvious tells; older players and adults will find the game most valuable with cards that require genuine close reading.
Social Media Maze¶
Lay out a network of account cards on the table, each one connected to a few others by lines or strings. Players move their information token across the network by jumping between connected accounts. Each jump reveals a new piece of personal data: a location, an interest, a friend connection, a piece of activity.
Privacy Settings cards can block a jump;
Anonymous Mode cards hide which account the token is coming from.
The goal is to reach certain milestones without triggering too many reveals.
The game’s most instructive moments tend not to involve the big reveals. They involve the small, incremental ones: the moment when you realise your token has made it three or four connections away from where you started and you cannot quite trace how it got there. Something you shared is now visible to someone you never intended it to reach, through a chain of connections that seemed reasonable at each individual step.
That feeling, losing track of something you thought you controlled, is what the game is designed to produce. Information on social media does not travel in single jumps. It propagates through networks of connections, and each person in the chain is making their own decisions about what to share further. Privacy settings help, but they act on the first jump. What happens after that is harder to predict.
It often sparks a useful conversation about what “private” actually means in a networked world.
Data Dumpster Dive¶
Before the game begins, someone prepares a set of cards representing fragments of a person’s data trail: an email address, a shopping receipt, a username from a forum, a photo with a location tag, a fitness tracker log, a booking confirmation. Scatter these around the room. Players have a few minutes to collect as many as they can, then sit down together and try to piece together who the person is: their name, where they live, what they do, what their daily routines look like.
Taken one by one, none of the cards seems like much. A username is just a username. A receipt tells you where someone shops sometimes. A fitness log tells you when they tend to leave the house. But together, these fragments tell a story that is surprisingly complete. In a well-prepared set of cards, it is usually possible to reconstruct a fairly detailed portrait of the fictional person from only eight or ten fragments.
This is the aggregation problem made physical. The term describes the way that combining individually unremarkable pieces of information can produce something far more revealing than any single piece on its own. It is the reason data brokers are valuable to advertisers: not because any one data point is significant, but because enough of them together build a profile. Understanding this through the experience of actually doing the aggregating tends to change how people think about what they share online.
Works well from age twelve upwards. It is particularly effective for anyone who has ever thought “well, it is just a username, why is it so important?” After this game, they will know exactly why it is important.