Default privacy is a product setting that keeps accounts, posts, messages, or contact options private unless the user actively changes them. In practice, it can mean a new account starts with limited discoverability, restricted messaging, or tighter visibility of profile data. This is a safety-by-default control: the secure or least-exposed option is chosen automatically, instead of relying on users to find and enable it.
In cyber security, default privacy matters because many harms come from exposure, not just malware. Public-by-default settings can help attackers harvest profiles, target phishing, map relationships, or contact minors and other vulnerable users. Private-by-default settings reduce that attack surface by limiting who can view, search, or message an account. Defenders use them as a baseline control, then add age checks, permission prompts, and audit logs to make sure sensitive interactions stay constrained even if a user misses a setting or an attacker tries to abuse discovery features.