An organization has developed a way for customers to share information from their wearable devices with each other. Unfortunately, the users were not informed as to what information collected would be

Defaulting users to 'no sharing' implements the Privacy by Default principle, a core tenet of modern privacy frameworks like GDPR Article 25, which requires that only necessary data is processed without user intervention. This technical control remediates the lack of informed consent by ensuring no data is shared until the user actively chooses to participate, balancing privacy with the organization's goal of enabling sharing as an opt-in feature.

Informing users after implementation is a reactive and insufficient remediation; privacy regulations and ethical standards require informed consent before data collection and sharing begins, not after.

Allowing the organization to unilaterally decide what is shared without user consent still violates the principle of informed consent and user autonomy, which is central to privacy compliance.

Completely stopping data sharing eliminates the organization's business goal of enabling customers to share wearable device information, making it an overly restrictive solution that fails to balance privacy with functionality.