Question

A social networking platform is designing a new feature that lets users share posts publicly or with a limited audience. During privacy engineering review, the team must decide how the audience-selection control should behave when a user creates their first post and has not yet set any preference. Which configuration best satisfies the privacy by default principle?

Accepted Answer

Set the initial audience to the most restrictive option (e.g., 'Only me' or a limited connection list) until the user explicitly chooses to broaden it

Answer

Set the initial audience to 'Public' so users experience the platform's full network effect and can restrict later if desired

Answer

Present a mandatory blocking dialog requiring the user to accept a public-sharing default before the first post can be created

Answer

Randomly assign an audience setting per user to prevent predictable defaults that could be exploited by attackers