The privacy settings are not in the menu. They are in the architecture.
Literal meaning: “By design” means built into the system from the start — not applied as a layer afterwards. Privacy by design requires that data minimisation, user control, and confidentiality are structural features of a system, present before the first user arrives, not added in response to complaints or regulation.
Origin: The framework was developed by Ann Cavoukian, Information and Privacy Commissioner of Ontario, in the 1990s. Her seven foundational principles — proactive not reactive, privacy as the default, privacy embedded into design — were published in full in 2009 and adopted by international data protection authorities. The EU’s GDPR (2018) incorporated the principle as a legal requirement under Article 25, making it enforceable rather than voluntary.
A design framework requiring that privacy protections are embedded in systems from the outset, structurally and by default — not added later in response to complaints.
The Appeal: Privacy by design changes the burden of proof. Instead of requiring users to actively protect their privacy — finding settings, opting out, understanding data flows — the system is engineered so that the private option is the default. This matters especially for users who do not know what they do not know. The strongest possible privacy protection requires no action from the user at all.
The Friction: Privacy Washing — the use of privacy rhetoric without substantive privacy practice — is privacy by design’s shadow. The principle is now widely cited by platforms that simultaneously extract behavioural data at scale. Surveillance Capitalism operates through systems that may technically comply with privacy regulations while structurally depending on data collection. “Privacy by design” as a label can perform the protection it does not provide. The seven principles are demanding; compliance is audited inconsistently.
Why This Matters: Privacy by design shifts the question from “did the user consent?” to “did the system protect by default?” Once you ask that question, the gap between the rhetoric and the practice becomes measurable — not just felt.
Related terms: Fair Patterns · VSD (Value Sensitive Design) · Deceptive Design · Surveillance Capitalism · Unblackboxing · Privacy Washing · Dark Patterns
Read more:
- Privacy by Design: The 7 Foundational Principles — Cavoukian, A. (2011). Information and Privacy Commissioner of Ontario
- Privacy by Design: The 7 Foundational Principles (Extended Version) — Cavoukian, A. (2011). Simon Fraser University