The Default Setting Has Become a Policy

The preferences menu was not built for this

There is a particular kind of screen nobody reads: the one that appears after installation, offering choices about browsers, telemetry, location and notifications. It is designed the way theatre foyers are designed — you are meant to keep moving. That screen has quietly become one of the most consequential documents in consumer technology, and the reason is not that users started reading it. The reason is that legislators and courts did.

Software defaults have always been political in the loose sense: whoever sets the starting position shapes the outcome. What changed over the past three years is that the starting position stopped being a business tactic and started being a regulated artifact — drafted, contested, and in some cases fined.

What is actually on the books

Fact. The European Commission designated a cohort of gatekeepers under the Digital Markets Act in September 2023, and from March 2024 those companies had to present users with choice screens for default browsers, search engines, assistants and marketplaces. Apple shipped a default-browser selection during its iOS 17.4 compliance release in the EU, alongside alternative app distribution. Microsoft has run a browser choice screen for Windows in the EU since 2010 and extended the mechanic to Windows 11.

Fact. The United Kingdom's Digital Markets, Competition and Consumers Act 2024 gave its competition authority direct powers over designated firms, including the ability to mandate choice mechanisms without first proving a full abuse case. The United States has no federal equivalent, but California and Colorado now require businesses to honour universal opt-out signals sent by browsers and extensions, which effectively makes a third-party browser setting binding on a website's data practices. Illinois and Massachusetts prohibit geofencing around health facilities, which turns a location-radius configuration into a matter of state law.

Fact. In United States v. Google, a federal court found the company's default-search arrangements anticompetitive and, in the 2025 remedies phase, imposed limits on exclusive default contracts rather than ordering a break-up. And in May 2025 the European Commission opened proceedings against Google over the design of its DMA choice screens, alleging the presentation nudged users toward its own services. A screen built to satisfy a regulation became, itself, the subject of enforcement.

A default is a policy because it has consequences at scale

Interpretation. The honest reason regulators reached for settings menus is that defaults are the cheapest lever with the widest reach. A statute that asks a billion devices to behave differently cannot inspect each device; it can only specify what the device does when nobody has decided anything yet. The default is where private code answers a public question — who gets the first call on a user's attention, location and history — and it answers it for everyone simultaneously.

There is an asymmetry worth naming. A privacy policy is written to be read by nobody and enforced by somebody. A default is written to be changed by anybody and noticed by nobody, which is precisely why it works. Regulation moved from the document people ignore to the mechanism people ignore, on the theory that the second one actually determines behaviour. Whether that theory holds is an empirical question, and the choice-screen rollout is the largest uncontrolled experiment in it that we are likely to get.

Interpretation. The second shift is evidentiary. A configuration is now a record. If a browser signal must be honoured, then the state of that signal at a given moment becomes discoverable — a timestamped statement of what a person did or did not permit. Settings screens have acquired the tone of contracts without acquiring the typography. They are drafted by product teams, reviewed by competition lawyers, and presented in the visual language of a two-option toggle, which is roughly as adequate as presenting a trade agreement as a checkbox.

Expect companies to treat compliance screens as a design discipline of their own. The interesting work is no longer in the dark pattern; it is in the nominally bright one — ordering, spacing, preselected categories within an allowed list, the wording of a decline button. The EU's proceedings against Google suggest regulators have arrived at the same conclusion from the other direction.

What follows from legislating the out-of-the-box state

Prediction. Configurations will become auditable objects. Once a default carries legal weight, enterprises procuring devices and platforms will ask for the default-configuration manifest the way they now ask for a data-processing agreement: what does this ship as, who changed it, and when. Vendors already version their software; they will start versioning their starting positions, because the starting position is now the part that gets subpoenaed.

Prediction. Consent will acquire an agent. As assistants take over routine configuration — moving your settings, consolidating accounts, opting into or out of services on request — the question of who is entitled to flip a switch on your behalf stops being hypothetical. The industry will need a vocabulary for delegated preference the way it once needed one for delegated authentication, and it will invent that vocabulary badly, in a hurry, probably as a dropdown.

Prediction. Settings churn will become a consumer grievance. Every major release will re-litigate a decision you made two years ago under a new menu with new defaults and a new legal justification, and the accumulated fatigue of re-asserting yourself will be the tax paid for living in software that treats consent as renewable. The decline screen nobody asked for is coming; it will be worded carefully.

The mundane wins again

Technology policy usually announces itself with hearings and slogans. This time it arrived as a checkbox about your browser. That is not a humiliation for anyone involved — it is a fairly accurate admission of how the medium works. Power in software was never in the grand gesture. It was in what the machine did before you touched it, and for once, the paperwork has caught up to the mechanism. Whether anybody reads the screen is still an open question. Whether the screen now matters is not.