Activity status can be disabled; excluded from API responses when off

Activity status — 'last seen 3 minutes ago', 'currently online', 'typing' — reveals real-time behavioral patterns that users may want to keep private for safety or personal reasons. Domestic abuse victims, people avoiding specific contacts, and users who want to read messages without triggering social pressure are all impacted by forced activity disclosure. GDPR Art. 25 (privacy by design) requires that data minimization be the default: broadcast activity only when users have affirmatively chosen to share it. CWE-200 captures the information exposure when status fields are included in API responses regardless of user preference.

Check the activityStatusVisible setting before including any lastSeen, isOnline, or typing indicators in API responses or WebSocket broadcasts. Apply the check server-side — omitting the field from the response is more reliable than frontend suppression. In your user profile serializer:

// src/lib/users/serialize.ts
export async function serializeUser(user: User, viewerId: string): Promise<PublicUser> {
  const settings = await db.userSettings.findUnique({ where: { userId: user.id } });

  return {
    id: user.id,
    name: user.name,
    // conditionally include activity
    ...(settings?.activityStatusVisible && {
      lastSeen: user.lastSeen,
      isOnline: isUserOnline(user.id)
    })
  };
}

Also gate the WebSocket presence broadcast: skip emitting user:online and user:typing events for users with activity status disabled.