A privacy engineer is reviewing the design of a new fitness mobile app before launch. During onboarding, the app presents a screen where the 'Share my workout data with third-party wellness partners' toggle is pre-set to ON, and a 'Receive personalized marketing based on activity' checkbox is pre-checked. The product team argues these settings maximize engagement and users can change them later in settings. Applying privacy by default principles, what should the engineer recommend?