The 4Cs of online risk: Content, Contact, Conduct, Contract

Every organisation that talks to parents about online safety uses the same four boxes.

eSafety in Australia, UK Safer Internet Centre, jugendschutz.net in Germany, and the EU BIK+ programme all draw on the same classification, even when they phrase it differently [source: doi-core-4cs].

This wiki uses it too. The 4Cs frame every article that touches risk.

A topic-led taxonomy (porn, grooming, scams) repeats itself across categories. A platform-led taxonomy (Snapchat, TikTok, Roblox) goes out of date the next time the app store shuffles its charts.

The 4Cs classify risk by role — what the child is doing when the risk shows up — not by topic.

A single app can show up under all four boxes at once. The same incident (a coerced image that gets forwarded and sold) can move across boxes as it develops [source: doi-core-4cs].

Definition

The 4C model classifies online risk to children into four role-based categories — Content, Contact, Conduct, Contract — and a fifth “cross-cutting” layer that covers risks that span all four [source: doi-core-4cs].

The CO:RE classification, published by Livingstone and Stoilova in 2021, is the anchor this wiki cites.

It expands a framework that EU Kids Online has used since 2010 [source: researchonline-eukids-2020].

The four Cs, with the role of the child in each:

• Content — the child as recipient. The risk is something the child sees, watches or reads. Violent material, hate content, self-harm imagery, pornography, misinformation.
• Contact — the child as participant. The risk comes from someone else reaching the child. Grooming, cyberbullying, unwanted sexual messages, scams that begin with contact.
• Conduct — the child as actor. The child does something that creates a risk for themselves or for others. Sexting, bullying other children, harassment in group chats.
• Contract — the child as consumer. The risk is commercial: in-app purchases, loot boxes, scams that involve money or data, hidden terms, influencer marketing aimed at minors.

A fifth category, cross-cutting, covers risks that affect the child in any of the four roles: privacy and data trade, health consequences, and discrimination [source: doi-core-4cs].

Each of the four Cs splits further into aggressive, sexual and values sub-types.

The cross-cutting layer carries privacy, health and discrimination as its own row [source: betterinternetforkids-bik-guide].

Scope

What the 4Cs cover

The framework covers every online risk documented in this wiki.

Every article that names a risk — glossary, reporting-illegal-content, talking-about-it — names it under one of the four Cs or under cross-cutting.

The framework also gives the wiki a way to talk about prevalence without averaging incompatible surveys.

Cyberbullying, for example, is reported at 6% in the 2010 EU Kids Online baseline [source: tsalikiliza-eukids-2010], at 46% in the 2022 US Pew study [source: www-pew-cyber-2022], and at 53% in the 2024/25 eSafety Australia survey [source: esafety-2025].

The three numbers are not contradictions. They are different instruments and reference periods against different definitions [source: doi-core-4cs].

What the 4Cs do not cover

The 4Cs do not rank risks by severity. The framework is a classification, not a triage scale.

A piece of content can be less harmful than a contact event, or vice versa, depending on the child, the context and the response available [source: doi-core-4cs].

The 4Cs do not assign blame. “Conduct” includes everything a child does online that creates risk, including acts the child is the victim of (such as being pressured to send an image).

The category names the child’s position in the event, not the child’s moral role [source: betterinternetforkids-bik-guide].

The 4Cs do not prescribe interventions. A risk under Contact does not automatically require a contact-blocking tool.

A risk under Content does not automatically require a content filter.

The wiki’s does-any-of-this-work article documents what the evidence says about controls. The what-parental-control-apps-can-do article covers the tool layer separately.

How the wiki uses the 4Cs in practice

Every Wiki article carries a risk: field in its frontmatter.

The field lists one or more of the five categories. A single article can list several, because most risks span categories.

A trick record that defeats a single control affects one C at a time.

The relational advice in fix_relational addresses the C the trick is exploiting, not the surface category of the trick itself.

A VPN that bypasses a network filter looks like a “network” issue. Under the 4Cs it is content exposure, because the bypass lets the child reach material the filter would have blocked.

The framework is also the basis for the wiki’s distinction between incidents and pipelines.

A coerced image is Contact at the moment of capture, Content at the moment of sharing, and Contract at the moment it is sold or extorted with [source: doi-core-4cs] [source: www-ncmec-2024].

The wiki names the pipeline rather than treating it as four separate incidents.

Why the 4Cs, not a competing framework

Several organisations extend or modify the 4Cs. The CO:RE project itself sometimes adds a fifth “Commerce” box.

The EU BIK guide splits Contract and Commerce into the same joint cell [source: doi-core-4cs] [source: betterinternetforkids-bik-guide].

This wiki keeps the four-C plus cross-cutting form because every organisation cited elsewhere in the wiki recognises it.

A parent who reads the eSafety parent resources and then opens this wiki should not have to re-learn the framework [source: esafety-resources].

The extension to “Commerce” is mentioned where it adds clarity, and otherwise folded into Contract.

Limits of the framework for parents

The 4Cs are a research and policy tool, not a parental one.

A parent trying to decide what to do about a specific incident will not reach for the taxonomy. They will reach for the specific article that covers the incident.

The framework’s strength is also its limit. It organises what organisations see.

It is less useful for the messy, individual moments a parent lives through.

A 10-year-old who hides a phone under the pillow is doing Conduct. The parent’s question is not “which C is this”. It is “what do I do tomorrow morning” [source: doi-core-4cs].

The wiki’s other articles answer the second question. This one explains the framework that organises the answer.

Sources

Each marker resolves to a stub under Wiki/sources/ with the URL, the retrieval date and the licence.

• doi-core-4cs — Livingstone and Stoilova, “The 4Cs — Classifying online risk to children” (CO:RE Short Report, 2021). The taxonomy anchor this article is built on [source: doi-core-4cs].
• betterinternetforkids-bik-guide — Stoilova and colleagues, “Classifying and responding to online risk to children” (EU BIK good-practice guide, 2023). The EU BIK application of the 4Cs to per-risk response [source: betterinternetforkids-bik-guide].
• researchonline-eukids-2020 — Smahel and colleagues, “EU Kids Online 2020: Survey results from 19 countries” (2020). The 19-country survey that uses the 4C framework [source: researchonline-eukids-2020].
• esafety-2025 — eSafety Commissioner, “The online experiences of children in Australia” (2025). The Australian survey that applies the 4C framework to national prevalence [source: esafety-2025].
• www-pew-cyber-2022 — Pew Research Center, “Teens and Cyberbullying 2022” (2022). The US 13–17 survey that documents cyberbullying conduct and contact [source: www-pew-cyber-2022].
• jamanetwork-jama-sexting-2018 — Madigan and colleagues, “Prevalence of multiple forms of sexting behavior among youth” (JAMA Pediatrics, 2018). The meta-analysis on youth-produced sexual content [source: jamanetwork-jama-sexting-2018].
• www-ncmec-2024 — NCMEC, “2024 in Numbers” (2025). The US reporting data on online enticement and financial sextortion [source: www-ncmec-2024].
• pubmed-stevens-2021 — Stevens and colleagues, “Global prevalence of gaming disorder” (meta-analysis, 2021). The cross-cutting health evidence on excessive use [source: pubmed-stevens-2021].
• who-hbsc-2024 — WHO Europe/HBSC, “Teens, screens and mental health” (2024). The 11/13/15-year-old data on problematic social-media use [source: who-hbsc-2024].
• www-hrw-edtech-2022 — Human Rights Watch, “How Dare They Peep into My Private Life?” — reported via ABC News (2022). The cross-cutting privacy evidence on EdTech data flows [source: www-hrw-edtech-2022].
• ico-code — Information Commissioner’s Office, “Age appropriate design: a code of practice for online services” (2021). The UK 15-standard code that governs the cross-cutting privacy layer [source: ico-code].
• ofcom-spend-2025 — 5Rights Foundation summary of Ofcom-commissioned research on persuasive design and child financial harms (2025). The Contract evidence on in-game and social spending [source: ofcom-spend-2025].
• tsalikiliza-eukids-2010 — EU Kids Online II, “Risks and safety on the internet” (2010). The historical baseline for cyberbullying prevalence under the 4C frame [source: tsalikiliza-eukids-2010].
• www-oxwell-2026 — University of Oxford, “Self-harm content study” (OxWell 2025, published 2026). The 11–18-year-old evidence on passive content exposure [source: www-oxwell-2026].
• esafety-resources — eSafety Commissioner, “Parent resources” (AU). The Australian government parent hub that applies the 4C frame to parent-facing advice [source: esafety-resources].