P3P: Encyclopedia II - P3P - Purpose

P3P - Purpose

As the World Wide Web became a genuine medium in which to sell products and services, Electronic commerce websites tried to collect more information about the people who purchased their merchandise. Some companies used controversial practices such as tracker cookies to ascertain the users' demographic information and buying habits, using this information to provide specifically targeted advertisements. Users who saw this as an invasion of privacy would sometimes turn off HTTP cookies or use proxy servers to keep their personal information secure. P3P is designed to give users a more precise control of the kind of information that they allow to release.

A P3P-compliant Website declares the kind of information it collects and its intended use as a privacy policy. A P3P enabled web browser can decide what to do by comparing this policy with the user's stored preferences. Alternatively, the browser can show the user a readable version of the policy and ask them how to proceed. As an example, a user may store in the browser preferences that information about their browsing habits should not be collected. If the policy of a Website states that a cookie is used for this purpose, the browser automatically rejects the cookie.

The main content of a privacy policy is the following:

• which information the server stores:
  • which kind of information is collected (identifying or not);
  • which particular information is collected (IP number, email address, name, etc.);
• use of the collected information:
  • how this information is used (for regular navigation, tracking, personalization, telemarketing, etc.);
  • who will receive this information (only the current company, third party, etc.);
• permanence and visibility:
  • how long information is stored;
  • whether and how the user can access the stored information (read-only, optin, optout).

The privacy policy can be retrieved as an XML file or can be included, in compact form, in the HTTP header. The location of the XML policy file that applies to a given document can be:

1. specified in the HTTP header of the document
2. specified in the HTML head of the document
3. if none of the above is specified, the well-known location /w3c/p3p.xml is used (for a similar location compare /favicon.ico)

P3P allows to specify a max-age for caching. A dummy /w3c/p3p.xml file could use this feature:

<META xmlns="http://www.w3.org/2002/01/P3Pv1">
  <POLICY-REFERENCES>
    <EXPIRY max-age="10000000"/><!-- about four months -->
  </POLICY-REFERENCES>
</META>

Adapted from the Wikipedia article "Purpose", under the G.N U Free Docmentation License. Please also see http://en.wikipedia.org/wiki