@SychO , I just noticed that on my forum when I open it in an incognito window (hence not even logged and no cookies), I can see the online widget and what users are online.
However in the permissions settings I have:
Always view user last seen time - admins and mods
Search users - admins, mods and members
This is really surprising since I wanted to limit this functionality to admins and mods only. Or even if it's to registered members but not to anybody.
Is that by design or is it a bug?