Privacy by Default Under GDPR Article 25(2): Implementing Default Privacy Settings

Article 25(2) GDPR requires controllers to implement technical and organisational measures ensuring that, by default, only personal data necessary for each specific processing purpose is processed. This obligation covers the amount of data collected, the extent of processing, the storage period and accessibility. In particular, data must not be made accessible to an indefinite number of persons without the data subject's intervention.

Typical measures include: opt-in rather than opt-out for marketing consent, minimal mandatory fields in forms, shortest retention period as default, restricted profile visibility, deactivated tracking cookies on first use, anonymous usage as standard, and automatic data deletion after purpose fulfilment. The EDPB Guidelines 4/2019 describe seven design principles as a binding reference framework.

Privacy by Design (Article 25(1) GDPR) requires integrating data protection into systems from the development stage, for example through pseudonymisation or data minimisation in the architecture. Privacy by Default (Article 25(2) GDPR) demands that default settings ensure only the data necessary for each specific purpose is processed. Design secures the architecture; Default protects users who do not actively change settings.

Data minimisation (Article 5(1)(c) GDPR) is the principle limiting collection to what is necessary. Privacy by Default is the technical tool to implement data minimisation in practice: default settings ensure only purpose-specific data is collected without requiring users to actively intervene. Together they form the foundation of a privacy-friendly system.

Article 25 GDPR applies to all processing operations, including legacy systems. Controllers must assess whether existing default settings meet the current state of the art and retrofit where necessary. Supervisory authorities expect continuous adaptation to new risks and technological capabilities. A one-time setup is not sufficient.

Violations of Article 25 GDPR can be sanctioned under Article 83(4) GDPR with fines of up to EUR 10 million or 2% of worldwide annual turnover. Supervisory authorities have imposed fines where software solutions lacked privacy-friendly default settings or personal data was collected without purpose limitation.

The seven principles developed by Ann Cavoukian are: (1) Proactive not reactive, (2) Privacy as the default setting, (3) Privacy embedded into design, (4) Full functionality with positive-sum approach, (5) End-to-end lifecycle security, (6) Visibility and transparency, (7) Respect for user privacy. These principles have been incorporated into the EDPB Guidelines 4/2019 on Article 25 GDPR.