Privacy by design
Privacy by design is the obligation to build data protection into a product or process from the start, and privacy by default is the rule that only the personal data necessary for each purpose is processed unless the person chooses otherwise.The idea was popularized by Ann Cavoukian when she was Information and Privacy Commissioner of Ontario, and the GDPR turned it into law. Article 25(1) requires the controller, both when deciding the means of processing and during the processing, to implement appropriate technical and organizational measures, such as pseudonymisation, that put the data protection principles into practice, data minimization among them. Article 25(2) requires that, by default, only the personal data necessary for each specific purpose is processed, with regard to the amount collected, the extent of processing, the storage period and accessibility. The EDPB's Guidelines 4/2019 explain how to apply it.
Cookie consent is one of the clearest applications. A banner designed by default has every optional category switched off, loads no tracker before the choice, and stores the shortest identifier that does the job. A site designed for privacy loads fonts and scripts from its own domain where it can, chooses analytics configured to collect less, sets short cookie lifetimes, and keeps proof of consent without the full IP address.
Article 25 has its own fine tier under Article 83(4), up to 10 million euros or 2% of worldwide annual turnover, and authorities often cite it next to other breaches. The GDPR page covers the rest of the controller's duties, and granular consent shows the default-off rule in practice.