Default value of 10 days is too long in some market

[bigludo7]

Problem description
10 days is a bit too much for some legal officiers and for example in France in my company the DPO request was to reduce to 7.
So I have a trouble with a default max age that will trigger an error

Possible evolution

• Reduce the maxAge to a smaller value? 7? 3?

Alternative solution

• Remove the default value but I'm absolutely not fan of this as it is a breaking change

Additional context

[yyeAduna]

Smaller maxAge makes sense. It will reduce false positive rate significantly. When it is used for bank fraud prevention, the FIs are usually willing to sacrifice the detection rate to lower false positive rate. 4 (or 8) seem to be a good default number based on my experience that keeps a good balance between those two Key Performance Measurements.

[HuubAppelboom]

@bigludo7 @yyeAduna This is still a default value , not ? So a bank can always decide to deviate from this ?

I don't see how this will impact privacy significantly, btw. It has more impact on the number of false posities.

[bigludo7]

Thanks @yyeAduna and @HuubAppelboom for feedback

Yes Huub this is default value but my point was that I'm bit concerned that the default value was not allowed in some region... That why I proposed to reduce it to 3 days. Any objection from the team for a change from 10 to 3?

[HuubAppelboom]

@bigludo7 No problem here, most customers I see use 3 days anyway.