Ask HN: How to teach kids about privacy on the internet

In light of the recent TikTok privacy discussion I had a conversation with my kids about privacy where they said, basically, 'we don't care, we want shiny' (they are 9 and 11). They know to not reveal their location, age or send private / embarrasing pictures to anyone, but the finer details of privacy are completely lost on them. So I have been pondering about how to make them really experience the hazards online that arise simply by not taking care of where you click, what you download, what information you share actively and passively and so on. My best plan so far is to make a fake website (with credible name and content, but accessible only from our public IP), send the oldest an email supposedly originating from the site and promising free tickets to their favorite band concert. Then go from there, asking them to create accounts (to log passwords), answer all common bank security questions and maybe upload a picture with location data in it, all in the name of getting the free ticket. I observe if any of this ever gets discussed with me and then have a reveal where I show what data I have gotten from them and what i can do with it, as well as discuss telltale signs of scams / unsafe online environments, alternatively reward them for bringing it to my attention in time. It feels a bit a-holeish, but I think it will be illuminating. What do you think? How do you educate your kids about privacy and taking care online (if you let them online unsupervised at all)?