The principle
Article 25(2) of the GDPR requires that, by default, only personal data necessary for each specific purpose is processed, extending to the amount collected, the extent of processing, the storage period and accessibility. A collect-first, opt-out-later default needs to be assessed against that requirement.
Quebec has two related rules that should not be collapsed. Its general highest-privacy-default provision applies to covered technological products and services subject to the statute’s wording and exclusions. Separately, when technology includes functions that identify, locate or profile a person, those functions must be deactivated by default and the person must be informed in advance about their use and the means available to activate them.
What it looks like in a configuration
- A new property starts on the strictest region profile rather than the most permissive
- No optional loader is created until its category is granted
- Where location cannot be determined, the engine fails closed to opt-in rather than open
- Necessary is the only category that cannot be refused, and it is scoped to what is genuinely necessary
Common questions
Is privacy by default the same as privacy by design?
They are two parts of Article 25. By design concerns building protection into the system; by default concerns what is processed before a person changes any setting. Both require evidence, while default behavior is directly testable in a fresh session.
Sources and verification
Verified on . Product-behaviour statements were checked against the current implementation and tests. The links below are the verification basis recorded for this article. They support the stated facts, not a legal conclusion for every site or configuration; recheck changing vendor behaviour before relying on it in production.
- Regulation (EU) 2016/679 (GDPR)
Legislation
Checked
See what your own site is loading
A browser scan reports the requests and storage it observed during the sampled journey. Use configured workspace scans to compare the states and pages that matter to your implementation.