Question

A streaming platform is building a new recommendation engine that will automatically profile users based on their viewing history to personalize content. The privacy engineer is engaged during design to embed privacy by default. Which design choice BEST reflects the privacy-by-default principle for this feature?

Accepted Answer

Ship the feature with profiling turned off by default, activating it only after the user affirmatively opts in

Answer

Enable behavioral profiling for all new accounts and provide an accessible setting for users to disable it later

Answer

Encrypt all viewing-history data used by the recommendation engine while keeping profiling active for everyone

Answer

Anonymize viewing history after 30 days but continue profiling using the most recent data by default