What Is Fairness-By-Default? Definition & Examples

Fairness-by-default means the initial settings of a digital service should favour the user, not the business. In practice, that usually means strict privacy settings, no preselected consent boxes, and no automatic renewal or hidden opt-ins. It is a control principle for baseline configuration before any user action is taken.

What Fairness-By-Default Means in Digital Product Design

Fairness-by-default is a baseline design principle, not a feature toggle. It asks product teams to make the starting state of a service protective of user interests, so the user must actively choose more permissive or business-favourable settings.

That framing matters because defaults shape real behaviour. Most people accept the preselected path, so the default setting often determines whether privacy, consent, subscription, and renewal outcomes are genuinely user-led or quietly vendor-led.

How Fairness-By-Default Shows Up in Practice

In practice, fairness-by-default usually means privacy-preserving defaults, no pre-checked consent boxes, and no hidden opt-ins for marketing, data sharing, or automated renewal. It is strongest when the user can still make a different choice, but only after an informed, deliberate action.

The principle is closely related to product governance and secure-by-design thinking. CISA’s Secure by Design guidance reinforces the idea that the safest and least exploitable state should be the starting point, not an advanced setting.

Fairness-by-default is also common in privacy regulation and consumer protection practice, where informed consent and clear choice are expected rather than implied. That is why the design of the first-run experience, consent flow, and account preferences can matter as much as the underlying feature set.

Why Defaults Matter for Trust and User Autonomy

Defaults are powerful because they do most of the behavioural work. A service can be technically “optional” yet still steer users toward data collection, tracking, or recurring payment if the safer choice is buried behind friction or ambiguity.

Fairness-by-default helps reduce dark-pattern pressure, improves transparency, and lowers the chance that users unknowingly accept terms they would not choose with a clean decision point. It also supports trust: users are more likely to rely on a service when the initial configuration is visibly aligned with their interests.

In security and governance terms, it is the difference between asking users to opt out of exposure and asking them to opt into it. That distinction often determines whether the control is meaningful or merely cosmetic.

Common Failure Modes and What Makes the Principle Hard

The principle fails when product teams optimise for conversion, retention, or data collection first and treat user protection as an exception path. Common problems include bundled consent, unclear language, default enrolment in add-on services, and renewal settings that are easy to accept but hard to reverse.

It is also undermined when one setting controls multiple outcomes, such as privacy, sharing, and monetisation at once. In those cases, the default can look neutral while still creating a material imbalance in practice.

For governance teams, the key challenge is that fairness-by-default is not proven by intention. It has to be visible in the actual starting state, the user journey, and the ease of reversing the choice.

Risk and Threat Considerations

Weak defaults can create real exposure even when no attacker is involved. If a service ships with permissive privacy, preselected consent, or automatic renewal, the user may silently lose control over data sharing, billing, or account behaviour before making any informed decision.

Failure mechanism: The service places business-favourable settings ahead of user choice, then relies on friction, ambiguity, or inertia to preserve them. That turns the default into a control failure, not just a design preference.

Impact: Users may suffer unwanted disclosure, subscription lock-in, regulatory complaint, or loss of trust, while the organisation inherits reputational and compliance risk from a baseline configuration that is hard to defend.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-16 — Application Software Security	Fairness-by-default depends on secure product behavior in the shipped application.
Recommendation — Build safe default states into application design and release criteria.
ISO/IEC 27001:2022	A.5.15 — Access Control	Default settings govern who can access data and which choices are pre-enabled.
	A.5.34 — Privacy and Protection of PII	User-favouring defaults support privacy-by-design and reduce unnecessary disclosure.
Recommendation — Set defaults so access and sharing are restricted until explicitly approved. Configure privacy-oriented defaults that minimize personal data exposure.
NIST CSF 2.0	GV.OV-01 — Oversight of risk and controls	Fairness-by-default is a governance choice that should be reviewed as a control outcome.
	PR.AA-01 — Identities and credentials are managed	Default consent and enrolment choices affect how users are enrolled into services and data-sharing states.
Recommendation — Review default settings as part of governance over user-impacting controls. Require explicit user action before enabling additional service permissions.

Practitioner Guidance

What practitioners should watch for: The most important test is whether a user must actively opt into exposure, rather than actively opt out of protection. If the answer is no, the default is probably doing too much work for the business and not enough for the user.

Practitioner takeaway: Treat fairness-by-default as a product-control decision, not a copywriting issue, because the first configuration state often defines the real user experience.

Fairness-By-Default