diff --git a/Documentation/config-gerrit.txt b/Documentation/config-gerrit.txt
index 02787a389c..2b934b8221 100644
--- a/Documentation/config-gerrit.txt
+++ b/Documentation/config-gerrit.txt
@@ -1152,6 +1152,16 @@ Zero or negative values allow robot comments of unlimited size.
 +
 The default limit is 1024kB.
 
+[[change.privateByDefault]]change.privateByDefault::
++
+If set to true, every change created will be private by default.
++
+Note that the newly created change will be public if the `is_private` field in
+link:rest-api-changes.html#change-input[ChangeInput] is set to `false` explicitly
+or the `remove-private` link:user-upload.html#private[PushOption] is used in the push.
++
+The default is false.
+
 [[changeCleanup]]
 === Section changeCleanup
 
diff --git a/gerrit-acceptance-tests/src/test/java/com/google/gerrit/acceptance/rest/change/PrivateByDefaultIT.java b/gerrit-acceptance-tests/src/test/java/com/google/gerrit/acceptance/rest/change/PrivateByDefaultIT.java
new file mode 100644
index 0000000000..b880152da7
--- /dev/null
+++ b/gerrit-acceptance-tests/src/test/java/com/google/gerrit/acceptance/rest/change/PrivateByDefaultIT.java
@@ -0,0 +1,65 @@
+// Copyright (C) 2017 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.gerrit.acceptance.rest.change;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import com.google.gerrit.acceptance.AbstractDaemonTest;
+import com.google.gerrit.acceptance.GerritConfig;
+import com.google.gerrit.extensions.common.ChangeInfo;
+import com.google.gerrit.extensions.common.ChangeInput;
+import org.junit.Test;
+
+public class PrivateByDefaultIT extends AbstractDaemonTest {
+  @Test
+  @GerritConfig(name = "change.privateByDefault", value = "true")
+  public void createChangeWithPrivateByDefaultEnabled() throws Exception {
+    ChangeInput input = new ChangeInput(project.get(), "master", "empty change");
+    assertThat(gApi.changes().create(input).get().isPrivate).isEqualTo(true);
+  }
+
+  @Test
+  @GerritConfig(name = "change.privateByDefault", value = "true")
+  public void createChangeBypassPrivateByDefaultEnabled() throws Exception {
+    ChangeInput input = new ChangeInput(project.get(), "master", "empty change");
+    input.isPrivate = false;
+    assertThat(gApi.changes().create(input).get().isPrivate).isNull();
+  }
+
+  @Test
+  public void createChangeWithPrivateByDefaultDisabled() throws Exception {
+    ChangeInfo info =
+        gApi.changes().create(new ChangeInput(project.get(), "master", "empty change")).get();
+    assertThat(info.isPrivate).isNull();
+  }
+
+  @Test
+  @GerritConfig(name = "change.privateByDefault", value = "true")
+  public void pushWithPrivateByDefaultEnabled() throws Exception {
+    assertThat(createChange().getChange().change().isPrivate()).isEqualTo(true);
+  }
+
+  @Test
+  @GerritConfig(name = "change.privateByDefault", value = "true")
+  public void pushBypassPrivateByDefaultEnabled() throws Exception {
+    assertThat(createChange("refs/for/master%remove-private").getChange().change().isPrivate())
+        .isEqualTo(false);
+  }
+
+  @Test
+  public void pushWithPrivateByDefaultDisabled() throws Exception {
+    assertThat(createChange().getChange().change().isPrivate()).isEqualTo(false);
+  }
+}
diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/change/CreateChange.java b/gerrit-server/src/main/java/com/google/gerrit/server/change/CreateChange.java
index bbe04f54f0..92ad46db59 100644
--- a/gerrit-server/src/main/java/com/google/gerrit/server/change/CreateChange.java
+++ b/gerrit-server/src/main/java/com/google/gerrit/server/change/CreateChange.java
@@ -105,6 +105,7 @@ public class CreateChange
   private final ChangeFinder changeFinder;
   private final PatchSetUtil psUtil;
   private final boolean allowDrafts;
+  private final boolean privateByDefault;
   private final MergeUtil.Factory mergeUtilFactory;
   private final SubmitType submitType;
   private final NotifyUtil notifyUtil;
@@ -143,6 +144,7 @@ public class CreateChange
     this.changeFinder = changeFinder;
     this.psUtil = psUtil;
     this.allowDrafts = config.getBoolean("change", "allowDrafts", true);
+    this.privateByDefault = config.getBoolean("change", "privateByDefault", false);
     this.submitType = config.getEnum("project", null, "submitType", SubmitType.MERGE_IF_NECESSARY);
     this.mergeUtilFactory = mergeUtilFactory;
     this.notifyUtil = notifyUtil;
@@ -258,7 +260,7 @@ public class CreateChange
       }
       ins.setTopic(topic);
       ins.setDraft(input.status == ChangeStatus.DRAFT);
-      ins.setPrivate(input.isPrivate != null && input.isPrivate);
+      ins.setPrivate(input.isPrivate == null ? privateByDefault : input.isPrivate);
       ins.setWorkInProgress(input.workInProgress != null && input.workInProgress);
       ins.setGroups(groups);
       ins.setNotify(input.notify);
diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/git/ReceiveCommits.java b/gerrit-server/src/main/java/com/google/gerrit/server/git/ReceiveCommits.java
index 5cd2184325..42fb1b317b 100644
--- a/gerrit-server/src/main/java/com/google/gerrit/server/git/ReceiveCommits.java
+++ b/gerrit-server/src/main/java/com/google/gerrit/server/git/ReceiveCommits.java
@@ -2177,7 +2177,9 @@ public class ReceiveCommits {
           changeInserterFactory
               .create(changeId, commit, refName)
               .setTopic(magicBranch.topic)
-              .setPrivate(magicBranch.isPrivate)
+              .setPrivate(
+                  magicBranch.isPrivate
+                      || (receiveConfig.privateByDefault && !magicBranch.removePrivate))
               .setWorkInProgress(magicBranch.workInProgress)
               // Changes already validated in validateNewCommits.
               .setValidate(false);
diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/git/ReceiveConfig.java b/gerrit-server/src/main/java/com/google/gerrit/server/git/ReceiveConfig.java
index 2b9f5941d6..a3f2a31075 100644
--- a/gerrit-server/src/main/java/com/google/gerrit/server/git/ReceiveConfig.java
+++ b/gerrit-server/src/main/java/com/google/gerrit/server/git/ReceiveConfig.java
@@ -28,6 +28,7 @@ class ReceiveConfig {
   final boolean checkMagicRefs;
   final boolean checkReferencedObjectsAreReachable;
   final boolean allowDrafts;
+  final boolean privateByDefault;
   private final int systemMaxBatchChanges;
   private final AccountLimits.Factory limitsFactory;
 
@@ -37,6 +38,7 @@ class ReceiveConfig {
     checkReferencedObjectsAreReachable =
         config.getBoolean("receive", null, "checkReferencedObjectsAreReachable", true);
     allowDrafts = config.getBoolean("change", null, "allowDrafts", true);
+    privateByDefault = config.getBoolean("change", null, "privateByDefault", false);
     systemMaxBatchChanges = config.getInt("receive", "maxBatchChanges", 0);
     this.limitsFactory = limitsFactory;
   }