"Free domain privacy, forever", in GoDaddy's wording, seems fairly standard now. But really it's a spin: Since 2018, domain privacy is required by EU's GDPR in many instances. But pre-GDPR it was frequently an add-on, demanding additional payment. IIRC, there are some domains for which it is not available.

CA domains have had a privacy default for individuals since 2008. As someone who's received personal threats as a result of WHOIS info, I'd rather stick with the more certain option.