“changing a default setting involves three steps: new exposures, reflection, and commitment to change.”