Recital 43i

The principles of data protection by design and by default should be taken into consideration regarding software placed on the market to enable electronic communication or to allow for the retrieval of information on the internet. This should entail that the most privacy protective settings should be enabled by default in accordance with Article 25 of this regulation to prevent the processing, including the storing, transmission and transfer of information already stored on the terminal equipment of a user, except where otherwise provided in Article 91c. At the time of installing the software the user should be offered different options allowing them to consent or to change the default privacy settings of the terminal equipment. Furthermore, the user should be offered different options to choose from to enable them to make an informed decision on whether or not to allow different processing activities, including but not limited to the storing and transmission of data. The user should be provided with understandable and easily to navigate language and settings, that should be adaptable and permit the user to revise the settings of their terminal equipment at any time. The user's choice should be communicated to other parties that should implement and enforce the user's choices and any updates thereof. Controllers should not design consent interfaces that could lead to the systematic overriding, undermining, or circumvention of automated and machine-readable indications. In the absence of an explicit affirmative action, consent should not be inferred from the default configuration of a browser or operating system, nor from the user’s practice of use of such tools.