HookThe £500,000 fine that showed the law running years behind the code
In October 2018 the UK's Information Commissioner's Office fined Facebook £500,000 over the Cambridge Analytica scandal, in which the data of an estimated 87 million users had been harvested through a personality-quiz app and used to build political-advertising profiles. The striking part is the size of the fine: £500,000 was the maximum the ICO could impose, because the misuse happened under the old Data Protection Act 1998. Under the newer regime that came into force months earlier, the same breach could have cost Facebook up to 4% of global annual turnover — billions, not thousands. The gap between those two numbers is this whole section in miniature: technology moves faster than the law, the ethics and the culture that must catch up with it.
AQA asks you to weigh the consequences of computing across four overlapping lenses — moral (what an individual ought to do), ethical/social (what is right for society), legal (what the law actually permits and forbids), and cultural (how shared ways of living change) — and, crucially, to see both the opportunities and the harms of each development rather than moralising in one direction. This is not a memory test of laws; it is a reasoning test. The extended-response question is marked in levels, rewarding a balanced, structured argument that reaches a justified conclusion, so the skill to build here is arguing fairly about a real, named case from more than one side.
ModelThe four lenses, and why they overlap
AQA frames consequences through four categories, and the exam rewards you for keeping them distinct while showing how they interact. A moral issue is about individual conduct and conscience — should I download this film without paying, should I post that photo of someone else. An ethical or social issue widens the lens to society — is it right that an algorithm decides who gets a loan, what does automation do to employment as a whole. A legal issue asks the harder, sharper question of what the law actually allows: something can be legal but unethical (targeted advertising that exploits a known gambling addiction), or illegal but widely felt to be moral (whistle-blowing that breaches a computer-access rule). A cultural issue concerns how shared habits, values and access change across whole populations — how social media reshapes political discourse, or how a global platform flattens local languages and customs.
The single most important habit is balance. Every development in this topic carries opportunity and harm together: the same facial-recognition system that finds a missing child also enables mass surveillance; the same recommendation engine that surfaces a brilliant new artist also traps a user in a filter bubble. Examiners consistently report that one-sided answers — 'the internet is bad', 'AI is good' — are capped at the lower levels no matter how fluent, because they fail to weigh.
CaseIndividual (moral) issues and opportunities
At the individual level, computing hands each person real power and real exposure. On the harm side sit privacy and the surrender of personal data — most people accept terms and conditions unread and are tracked across the web by cookies and device fingerprinting; the moral question is whether meaningful consent can exist when the alternative is exclusion from ordinary life. There is the question of digital behaviour: cyberbullying, online harassment and the way anonymity can lower the moral brakes people apply face to face. There is intellectual property: the ease of copying a song, a film or an essay makes piracy and plagiarism a one-click temptation, and the individual's justification ('everyone does it', 'the artist is rich') is exactly the moral reasoning worth interrogating.
On the opportunity side, the same technologies are genuinely empowering. Accessibility tools — screen readers, speech-to-text, eye-tracking input — give disabled users independence that no previous era could offer. Individuals can educate themselves, build businesses, organise and find communities that simply did not exist locally. The mature answer holds both: the smartphone that enables a person with a visual impairment to read a menu is the same device that quietly logs their location all day.
CaseSocial (ethical) issues and opportunities
Zoom out to society and the stakes scale up. Automation and employment is the classic ethical debate: a widely cited 2013 Oxford study by Frey and Osborne estimated that around 47% of US jobs were at high risk of automation over the following two decades. The ethical question is not merely 'will jobs go' but 'who bears the cost and who captures the gain' — routine roles disappear while new technical roles appear, but rarely for the same people or in the same places. The digital divide is the ethical problem of unequal access: households without reliable broadband or devices were visibly disadvantaged when UK schooling moved online during the pandemic, so a tool that promises to democratise can instead widen a gap. Algorithmic bias is now a mainstream concern: systems trained on historical data can reproduce and amplify discrimination in policing, recruitment and credit, and because the model is opaque the unfairness is hard to see or challenge.
There are also environmental and informational costs. Data centres and cryptocurrency mining consume vast electricity; discarded devices create e-waste, much of it shipped to sites such as Agbogbloshie in Ghana. And misinformation spreads faster than correction on engagement-optimised platforms. Against all of this sit real social opportunities — telemedicine, open data, collaborative science, disaster response — which is why the ethical verdict is a weighing, not a verdict.
ModelLegal issues and the legislation of the digital age
The law is the concrete backbone of this topic, and you are expected to know the main UK statutes by name and purpose. The Computer Misuse Act 1990 created three offences — unauthorised access to computer material, unauthorised access with intent to commit a further offence, and unauthorised modification of material (which covers spreading malware); it was passed directly because the 1988 R v Gold and Schifreen case, in which two men accessed BT's Prestel system, collapsed for want of a law that fitted. The Data Protection Act 2018 (which implements the UK GDPR) governs how organisations collect, store and process personal data, setting principles such as lawful processing, data minimisation and accuracy, and granting individuals rights including access and erasure; it is enforced by the ICO. The Copyright, Designs and Patents Act 1988 protects creators' rights over software, music, images and text. The Regulation of Investigatory Powers Act 2000 (RIPA) governs state surveillance and interception of communications. The Freedom of Information Act 2000 gives the public a right to request information held by public bodies.
The examinable insight is the recurring lag: each of these laws was written to catch up with a technology already in use, and new developments — generative AI, biometric tracking, deepfakes — routinely sit in legal grey areas until legislation is updated. Knowing the name of the Act is AO1; explaining why a given scenario breaches it, or exposes a gap in it, is where the real marks are.
Apply the framework to a single scenario, the way the extended question demands. A UK secondary school installs live facial-recognition cameras in its canteen to speed up lunch payments by matching pupils' faces to their accounts.
Moral (individual): can a 12-year-old, or their parent, give genuine, free consent when refusing means queueing separately and standing out? Ethical (social): normalising biometric surveillance of children, and the risk that the same infrastructure creeps toward monitoring behaviour or attendance. Legal: biometric data is a special category of personal data under the Data Protection Act 2018, demanding a very high bar of justification and explicit consent — several real UK schools were challenged by the ICO on exactly this in 2021, and some suspended the systems. Cultural: children who grow up treating face scanning as an ordinary way to buy a sandwich carry a different baseline expectation of privacy into adulthood than their parents did. Reaching a justified conclusion — for instance, that the modest convenience gain does not outweigh the consent problem and legal risk for a minor's biometric data — is what lifts the answer into the top level.
CaseCultural issues and opportunities
The cultural lens is about how computing reshapes shared ways of living, and it is the category candidates handle least confidently because it is the least tangible. Computing has driven a genuine globalisation of culture: a creator in one country reaches a worldwide audience instantly, and global platforms spread language, music and ideas across borders — an opportunity for exchange, but also a homogenising force that can crowd out local languages and traditions. Social media has restructured public discourse: engagement-driven algorithms tend to reward outrage and confirmation, producing filter bubbles (a term coined by Eli Pariser in 2011) and echo chambers in which people meet only views they already hold, with real consequences for elections and social cohesion. The way work, relationships and even protest are organised has shifted onto digital platforms within a single generation.
The opportunities are equally real and worth naming for balance. Marginalised communities find each other and organise; creative industries are opened to people without gatekeepers or capital; knowledge that was once locked in libraries and institutions is a search away; and assistive and translation technologies let cultures communicate across language barriers. A strong cultural answer resists both techno-utopian and doom framings, and instead identifies a specific shift — say, the collapse of the traditional music-industry gatekeeper — and weighs who gains and who loses from it.
DataReading a real event through every lens
The best revision for this topic is to take one well-documented event and rehearse arguing it from all four angles, because that is precisely the muscle the levels-marked question exercises. Take the WannaCry ransomware attack of May 2017, which encrypted files on unpatched Windows machines worldwide and demanded a Bitcoin ransom. In the UK it hit the NHS hard: an estimated 19,000 appointments and operations were cancelled, ambulances were diverted, and the National Audit Office later put the cost to the NHS at around £92 million.
Legally, deploying the malware is a clear breach of the Computer Misuse Act 1990 (unauthorised modification), while the NHS's failure to patch raises Data Protection questions about safeguarding personal data. Ethically, it exposes the social cost of underfunded infrastructure and unsupported legacy systems, and the debate over whether governments should stockpile the security exploits (this one derived from a leaked NSA tool) that criminals later weaponise. Morally, it is a stark individual-conduct case about attackers knowingly endangering patients for money. Culturally, it shifted public and political expectations about cyber-resilience as critical national infrastructure. One event, four defensible arguments, a conclusion about where the greatest responsibility lies — that structure is transferable to any case the exam hands you.
A compact template you can deploy on any 'discuss the consequences' question. First, identify the development in one sentence (what the technology is and who uses it). Second, run the four lenses in turn, giving each a concrete point rather than a vague worry: moral (individual conduct), ethical/social (effect on society and groups), legal (name the relevant Act and state whether it is breached or outpaced), cultural (change to shared ways of living). Third, for at least two lenses, name the opportunity as well as the harm so the answer is balanced. Fourth, reach a justified conclusion — not 'there are pros and cons', but a weighed judgement such as 'the benefit to X does not outweigh the risk to Y because Z'. On WannaCry that conclusion might be that the primary responsibility is shared between the criminal attackers and the institutional failure to maintain supported, patched systems for critical services.
VocabularyKey terms the mark scheme pays for
TrapsMisconceptions that cost marks
ExamWhat examiners want
Consequences is assessed on the written Paper 2 (7517/2), typically including an extended-response question marked in levels of response rather than point-by-point. That changes how you write. Do not produce a list; produce a structured argument. Open by identifying the development in a sentence, then work the four lenses — moral, ethical/social, legal, cultural — giving each a concrete, named point rather than a general anxiety. For the legal lens, name the actual UK statute (Computer Misuse Act 1990, Data Protection Act 2018, Copyright Designs and Patents Act 1988, RIPA 2000, Freedom of Information Act 2000) and say precisely how the scenario engages it.
The two habits that lift the mark are balance and a justified conclusion. For at least two of your points, state the opportunity alongside the harm — the same system that harms in one way benefits in another — because examiners cap one-sided answers at the lower levels. Then finish with a genuine judgement: not 'there are advantages and disadvantages', but a weighed verdict of the form 'the benefit to X does not outweigh the risk to Y, because Z'. Anchor the whole thing in a real, named, dated example where you can (Cambridge Analytica 2018, WannaCry 2017, the schools facial-recognition challenges of 2021) — a specific case is worth far more than an abstract worry, and it is the surest signal to the examiner that you can reason about computing in the real world rather than recite a moral position.