Privacy Preferences

A profile page headed "Your Profile" with a "View profile as: Public" selector, showing Jamie Rivera's profile with Phone number and Birthday listed as hidden, and Location visible A privacy mirror — seeing exactly what a chosen audience would see, before publishing anything, turns an abstract preference setting into something concrete enough to actually evaluate.

Background

Research by Alan Westin from the 1970s onward found U.S. customers split into three rough groups: privacy fundamentalists (~25%, favor strong government regulation), privacy pragmatists (~60%, weigh the cost and benefit of sharing case by case), and the privacy unconcerned (~15%). With a clear majority holding real concerns, defaulting to visible disclosure and genuine choice serves nearly everyone — the pragmatist majority responds to seeing the trade-off clearly, and the fundamentalist minority needs that visibility to participate at all. Convenience and personalization pull toward collecting and using more data; genuine privacy protection pulls the other way — the tension the rest of this page’s design guidance has to resolve.

Convenience and personalization pull toward collecting and using more data; genuine privacy protection pulls the other way — the tension the rest of this page’s design guidance has to resolve.

Problem

Sharing personal information can genuinely make a site better to use — stored payment and shipping details streamline checkout, taste data enables Personalized Recommendations, a filled-out profile builds a community presence — but most customers have well-founded concerns about how their information gets used, and need a straightforward way to see and change it.

Solution

This design freedom sits inside a legal floor, not above it: CCPA/CPRA and GDPR both require actually honoring an opt-out choice — including a browser- or device-level signal like Global Privacy Control — rather than treating it as pure UX polish a site can implement loosely, and COPPA (Children's Online Privacy Protection Act) removes the choice from a child under 13 entirely, reassigning it to a parent instead. The Cookie Consent Banner is the most standardized instance of this floor in practice — a specific, recurring consent mechanism with its own well-documented good- and bad-practice patterns.

The right design differs by who the information is shared with.

For e-commerce and personalization: default to opt-in rather than opt-out, and use a secure connection (see Trust and Credibility) so the transmission itself feels safe.

Let customers control what other community members see

On social or community sites, this is less about what the company knows and more about what other people can see — controlling a projected persona rather than protecting data from the business itself. Comfort ranges widely, from customers who want to share almost nothing to customers happy to publish everything; design has to accommodate the full range rather than assuming one comfort level for everyone (e.g. letting people choose who sees a profile, a wish list, or a set of photos — public, a defined group, or fully private).

Provide a privacy mirror

Just as a real mirror lets someone check their appearance before going out in public, a privacy mirror lets a customer see exactly what a specific audience (a stranger, an acquaintance, a close friend) would see of their shared information before it’s published — LinkedIn’s profile preview is the worked example, and the “View profile as” example at the top of this page shows the same idea: Phone number and Birthday held back, Location left visible. This turns an abstract preference setting into something concrete enough to actually evaluate.

This turns an abstract preference setting into something concrete enough to actually evaluate.

Offer the choice at the moment it’s most relevant

Not only buried in account settings. Amazon lets customers opt a completed purchase into their public profile right at the end of checkout — a good design because nothing is shared unless explicitly chosen, sharing takes one step instead of a trip through account settings, and the customer knows exactly what they’re sharing because it’s the purchase they just made. Craigslist similarly lets posters choose an anonymized email address at the moment of posting a message, and photo-sharing sites let customers select specific albums and specific recipients at the moment of sharing rather than through a global setting.

nothing is shared unless explicitly chosen, sharing takes one step instead of a trip through account settings, and the customer knows exactly what they’re sharing because it’s the purchase they just made.

Still make account-management-based editing available and easy to find

Usually near the top-level navigation — for the cases where a customer’s comfort level changes after the fact or they simply want to review what’s currently shared.

Patterns

Principles

Trust and Credibility

Standards

Sources

The Design of Sites: Pattern Group E — Building Trust and Credibility (E8 Privacy Preferences) Westin’s three-way privacy-attitude segmentation (fundamentalists/pragmatists/unconcerned), the privacy-mirror concept, and the company-facing-versus-community-facing distinction in Solution all come directly from that pattern.