Privacy settings grouped by functional area with plain-language descriptions
Why it matters
Privacy settings that users cannot find or understand are functionally absent. GDPR Art. 7(3) requires withdrawal of consent to be straightforward — a single flat list of 40 settings with technical labels like 'behavioral_targeting_v2' does not meet that standard. Poorly organized settings also increase support burden and erode trust: users who cannot find a control assume the platform is hiding it. GDPR Art. 25 (privacy by design) requires that controls be accessible and meaningful, not merely present.
Severity rationale
Low because disorganized settings don't expose data directly, but they systematically prevent users from exercising rights they are legally entitled to exercise, compounding every other privacy control gap.
Remediation
Group privacy settings into functional sections — Profile Visibility, Communication, Data & Analytics — and write plain-language descriptions for each toggle. Avoid technical labels in the UI. In src/app/settings/privacy/page.tsx:
<section aria-labelledby="profile-visibility-heading">
<h2 id="profile-visibility-heading">Profile Visibility</h2>
<p>Control who can see your profile and posts.</p>
<SettingToggle
id="profileVisibility"
label="Profile visible to"
options={['Everyone', 'Followers only', 'Only me']}
description="Who can view your profile page and basic information."
/>
</section>
<section aria-labelledby="data-heading">
<h2 id="data-heading">Data & Analytics</h2>
<p>Control how your usage data is collected and used.</p>
<SettingToggle
id="analyticsOptIn"
label="Send anonymous usage analytics"
description="Helps us improve the platform. No personal data is shared."
/>
</section>
Test the settings page with actual users unfamiliar with the platform — if they cannot find a specific control within 30 seconds, the organization needs revision.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Community Privacy & Controls Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- gdpr · Art. 7(3) — Right to withdraw consent — accessible settings required
- gdpr · Art. 25 — Data protection by design and by default — usable privacy controls
Taxons
History
- 2026-04-18·v1.0.0·Initial import from community-privacy-controls·automated