§6.3.1 Default settings

57. Default settings are an important tool that providers of online platforms accessible to minors may use to mitigate risks to minors’ privacy, safety and security, such as, for example, the risk of unwanted contact by individuals seeking to harm minors. Evidence suggests that users tend not to change their default settings, which means that the default settings remain for most users and thus become crucial in driving behaviour (57). The Commission therefore considers that providers of online platforms accessible to minors should: (a) Ensure that privacy, safety and security by design principles are consistently applied to all account settings for minors. (b) Set accounts for minors to the highest level of privacy, safety and security by default. This includes designing default settings in such a way as to ensure safe and age-appropriate settings for minors, taking into account their evolving capacities. These settings should ensure that by default for all minors, as a minimum: (i) accounts only allow interaction such as likes, tags, comments, direct messages, reposts and mentions by accounts they have previously accepted. (ii) no account can download or take screenshots of contact, location or account information, or content uploaded or shared by minors to the platform. (iii) only accounts that the minor has previously accepted can see their content, posts and account information. (iv) no one can see the minor’s activities such as ‘liking’ content or ‘following’ another user. (v) geolocation, microphone, photo access and camera, contact synchronisation as well as all not-strictly necessary tracking features are turned off. (vi) the default autoplay of videos and hosting live streams are turned off. (vii) push notifications are turned off by default and are always off during core sleep hours, adapting the core sleep hours to the age of the minor. When push notifications are actively enabled by the user, they should only notify the user about interactions arising from the user’s direct contacts and content from accounts or channels that the user actively follows or engages with (for example, push notifications should never be inauthentic and always mentions precisely the user or creator the notification comes from). (viii) features that may contribute to excessive use, such as the number of ‘likes’ or ‘reactions’, “streaks’, the”... is typing’ function and ‘read receipts’ are turned off. (ix) any functionalities that increase users' agency over their interactions are enabled. This might include, for example, information or friction that slows down content display, posting and user interaction, giving users an opportunity to think before they decide if they want to see more content, or to think before they post. (x) recommendations of other accounts are turned off. (xi) filters that can be associated to negative effects on body image, self-esteem and mental health are turned off. (c) Consider whether, depending on minors’ ages and evolving capacities and the outcome of a provider’s risk review, it is necessary to go beyond the minimum standard for default settings set out in this Section 6.3.1, and design and implement default settings that are more restrictive. For example, by designing default settings for younger minors where no other user is allowed to engage in certain types of interactions. (d) Regularly test and update default settings, ensuring that they remain effective after all updates, and against emerging online risks and trends, including any risks to minors’ privacy, safety and security identified by the provider in the course of their review of risks (see Section 5 on Risk review). (e) Ensure that minors are not in any way encouraged or enticed to change their settings to lower levels of privacy, safety and security, and that any options to change default settings are presented in a neutral way. (f) Ensure that minors are provided with incremental degrees of control over their settings, according to their age, evolving capacities and needs, to support their growing autonomy and provide them with more agency (58). (g) Ensure that settings are explained to minors in a child-friendly and accessible way (see Section 6.4 on Online interface and other tools). 58. Where minors change their default settings or opt into features that put their privacy, safety or security at risk, the Commission considers that the provider of online platform should: (a) Empower minors with the ability to choose between temporarily changing their default settings, for example for a period of time or for current use in that session and permanently changing their default settings. (b) Enable easy return to default settings, such as a one-click reset or a history-based undo feature for settings that have been changed. (c) Present warning signals at the point at which the minor changes their settings, clearly explaining the potential consequences of their changes. (d) Periodically provide reminders to minors about the potential consequences of their change and periodically provide them with the opportunity to return to their default settings. (e) Automatically turn off geolocation, microphone and camera as well as not strictly necessary tracking features after the session ends, if a minor turns them on. (f) When geolocation, microphone and camera are switched on, make this obvious to minors throughout the period during which they are switched on.

← 6.3 · All articles · 6.3.2 →

Source: EUR-Lex (Cellar) · retrieved 2026-09-07