P3P - Platform for Privacy Preferences

The idea behind the system is that sites create P3P files describing their privacy policies, which can easily be read by browser software. Visitors set their own privacy preferences on their browsers, and if those preferences and the policies of visited sites match up, everybody is happy and the system stays in the background. If they don't match, the browser can point this out and ask the user what to do. It can also prevent actions that would otherwise happen automatically, for example it can block cookies if the user's preferences don't match the site's cookie policy.

P3P stands for Platform for Privacy Preferences, and version 1.0 is a W3C recommendation, which is as official as anything on the Internet gets (there is an earlier version that is best ignored). Some well-known sites use P3P, for example Yahoo!, About, Angelfire and Dell. Their sites include a P3P file written in XML that is effectively a quantitative version of their privacy policy. And if they use cookies they also include a second element, a compact file of abbreviations corresponding to their policies, that is delivered with HTTP cookie headers.

On the browser side, Netscape 7 is compliant with P3P, and IE6 is compliant with the cookie element of the platform, though not the other parts. This means that IE6 users (around 30% of Internet users at the time of writing) can set their own privacy preferences for cookies and the browser will automatically block those that don't match up.

Sounds wonderful. So why aren't privacy advocates dancing in the streets and telling everybody this was exactly what they've been waiting for? Perhaps because the system has no legislative consequence or method of enforcement. In short, it's a bit toothless. If a site wants to say one thing but actually do another, it can do that in machine-readable form just as easily as it previously could in words. It's ironic to note that one or two of the early adopters of P3P (not those listed above) are the very sites that privacy campaigners have been battling for years.

Yet some privacy groups were involved in the creation of the platform and support it. You can read more details about them here, in a piece by Lorrie Faith Cranor, a prime-mover in the P3P project.

Whatever the pros and cons and whatever its level of effectiveness, it's a system that many webmasters are likely to come across in the near future. If your site sets cookies then they could be rejected by some users with IE6 if you don't follow the P3P system.

In this article we'll examine what goes inside the XML file, where it resides, how it's linked, and what goes inside the corresponding compact file. This is an introduction to the subject and not a reference guide. If you want to create your own P3P files you'll need to look at the W3C specification and it's highly likely that you'll also need to download helper software to deal with the complicated process of creating the files themselves (links are given at the end of this article). But if that's your aim, it's still likely that you'll find this introduction useful, because the W3C specification is a tricky one to follow.

Contents:

A sample P3P file
A sample P3P file (Cont.)
Policy Reference File
Compact Policy

A sample P3P file - Page 2