# Data Protection by Default Standards and References

## Primary GDPR Articles

### Article 25(2) — Data Protection by Default
The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. In particular, such measures shall ensure that by default personal data are not made accessible without the individual's intervention to an indefinite number of natural persons.

### Article 25(1) — Data Protection by Design
The controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data-protection principles, such as data minimisation, in an effective manner.

### Recital 78 — Technical Measures
The protection of the rights and freedoms of natural persons with regard to the processing of personal data require that appropriate technical and organisational measures be taken. Such measures could consist, inter alia, of minimising the processing of personal data, pseudonymising personal data as soon as possible, transparency with regard to the functions and processing of personal data, enabling the data subject to monitor the data processing.

## Regulatory Guidance

### EDPB Guidelines 4/2019 on Article 25 — Section 3
Provides detailed guidance on data protection by default across four dimensions:
- Amount: Only data necessary for each specific purpose shall be processed
- Extent: Processing operations shall be limited to what is necessary
- Period: Storage shall be limited to what is necessary (with default deletion)
- Accessibility: Data shall not be accessible to an indefinite number of persons without intervention

The guidelines clarify that "by default" means the strictest privacy settings automatically apply. Data subjects should not need to take affirmative action to obtain privacy protection.

### CJEU C-673/17 (Planet49, 2019)
The Court ruled that pre-ticked checkboxes do not constitute valid consent. This directly informs the "by default" requirement: opt-in mechanisms must start in the OFF state.

### EDPB Guidelines 05/2020 on Consent
Clarifies that consent must be given by a clear affirmative act. Default settings, pre-ticked boxes, inactivity, and silence do not meet this standard.

## Technical Standards

### WCAG 2.1 — Web Content Accessibility Guidelines
Privacy controls must be accessible to all users, including those with disabilities. WCAG 2.1 AA compliance ensures privacy preference controls are perceivable, operable, understandable, and robust.

### Dark Patterns Regulation
The EU Digital Services Act (DSA) Article 25 prohibits dark patterns that manipulate users into giving up privacy. By-default settings must not use deceptive design to encourage data sharing.