We sometimes get the question if it's possible to turn on whois privacy by default?
The answer in short is: yes, it's always the default.
Registrars may use the <contact:disclose> element to enable display of contact attributes in whois and RDAP records. By default, all contact attributes are opted-out of display*.
When performing a <create> or <update> command, the <contact:disclose> element may be used to enable disclosure of specific contact attributes, as per RFC 5733 Section 2.9:
An <update> command which contains a <contact:disclose> with a “flag” attribute of “0” or “false” will remove the specified attributes from display.
* Note: prior to July 22, 2018, the default was for all contact attributes to be opted-in to display by default.