What is a mistake organizations make when establishing privacy settings during the development of applications?