Privacy by Default

Overview

Privacy by Default means individuals receive privacy-protective settings without needing to find controls or opt out. Default collection, visibility, sharing, retention, permissions, and personalization should be limited to what the stated purpose requires.

Defaults strongly influence behavior, especially when interfaces are complex or consent is bundled. A privacy-friendly label is insufficient when optional data collection remains preselected, difficult to reverse, or necessary to access unrelated functionality.

Teams should document necessary data, test initial settings, minimize permissions, separate optional features, and make changes understandable and reversible. Product updates should preserve user choices rather than silently expanding collection or exposure. Teams should verify defaults after localization, platform migration, and account restoration.

Privacy by Default configures products and services so the initial settings collect, expose, retain, and share only what is necessary. Privacy by Default makes the safest reasonable setting automatic, while optional data use requires clear, separate, and reversible choice.

Implementation of Privacy by Default should map Privacy by Default configures products and services so the initial settings collect, expose, retain, and share only what is necessary to the applicable entity, product, customer, transaction, and jurisdictional scope. Evidence for data relationships and observable activity should preserve the governing requirement, policy version, control execution, exception decision, owner, and review date. Material changes affecting the Privacy by Default context and data relationships and observable activity should trigger reassessment instead of silent reuse of an outdated conclusion.

Assurance work for Privacy by Default should sample records involving data relationships and observable activity, test whether stated procedures operated in practice, and keep corrective actions open until a qualified reviewer verifies closure.