Is W3C's P3P Good Privacy?

nileshch asks: "A very important development in recent times with regards to website users' privacy has happened with the W3C introducing the Platform for Privacy Preferences(P3P). P3P allows websites to create and maintain XML-based privacy policies for the entire website or sub sections of the site. These machine readable policies document what information is collected from users and how it is going to be used. Today, a few browsers like Mozilla/Netscape & Internet Explorer are committed to giving support for P3P (Mozilla here, IE here) . Although that support seems only skin-deep. I also find very few big sites adopting P3P seriously. Isn't it like the classic chicken-and-egg situation? Websites wait for full P3P support on browsers, browsers go slow on development because there isn't much feature demand happening on this front. Do you have P3P policies for your website? If not, what stops you from creating one? We all create hoopla over tiny privacy issues, user profiling and doubleclick.net . Then why isn't there much enthusiasm for P3P support in browsers?"

Comments

Why?

[NineNine]

We all create hoopla over tiny privacy issues, user profiling and doubleclick.net . Then why isn't there much enthusiasm for P3P support in browsers?"

Why? It's simple. Users don't care. Geeks do, but geeks don't make up a large percentage of the general population. The general population of Web users aren't nearly as paranoid.

Re:Why?

[Angry White Guy]

You mean nearly as informed.
A lot of people don't understand the tracking that goes on. They still see the internet as everyone being anonymous, just because they don't understand the technology.

Re:Why?

[dolo666]

Agreed. Most un-geek people know there are dangers that go with the internet, and most of those people have a very superstition-based understanding of computers.

You should see how superstitious the people I know are when it comes to computers. I can't count the number of times someone has donned a panic-stricken look on their face when I told them something was wrong with their computer, the network or servers. They don't understand that it's my job to FIX the problem. Instead they panic, thinking the sky is falling.

You have to be soooo careful when you talk about computer problems with some people.

Re:Why?

[md17]

Users may not care, but businesses care when people can not use their web site, because someone has their browser privacy setting high and they are not accepting cookies without P3P. The first time I implemented P3P it increased online ordering by about 5%. Most end users don't realize that a shopping cart doesn't work correctly because their browser is denying cookies. They simply get frustrated and go to another site. But when businesses realize that P3P is an easy fix, there is really no question about whether or not to use P3P.

<rant>
It really bugs me when people start bagging on P3P and saying how crappy it is. Why don't you do something about it? Right now P3P is the best privacy standard out there. Until someone comes up with something better, lets use it!
</rant>

Re:Why?

[koreth]

No, they just don't care. I'm a geek who understands the tracking that goes on (I've written Web tracking software in the past) and for the most part, I don't care. If Joe's Bait & Tackle Shop can make an extra buck with the knowledge that I visit the Psychology Today website, more power to 'em. I see that as a slippery slope leading nowhere. I don't see it as worth my energy to object to data collection just for the sake of objecting to data collection, if no harm can come to me as a result.

I suppose I see the Internet as being inherently non-anonymous (a sufficiently interested party could be tapping my cable modem, either by court order or surreptitiously) because I do understand the technology, so the fact that it's not anonymous isn't an issue I feel it's really fruitful to worry about. I'd far rather get worked up about things I have a nonzero probability of actually changing, or at least that do me harm. Mind you, my definition of "harm" includes things like sending me spam, but I see little evidence that web site information sharing will ever be responsible for more than a fraction of a percent of the mountains of spam that already hit my filters.

In the instances when I really do want to resist observation by a third party, e.g. working from home which means I'm dealing with my company's trade secrets, I take care to encrypt everything I send. Even then, though, a sufficiently interested corporate spy or government agent could break into my house and install keyboard-monitoring software without my knowledge, or could be watching my monitor using a spy cam from the neighbor's roof. At some point you either have to go completely off the deep end with privacy paranoia or conclude that as an individual there's a point beyond which it's impossible to keep secrets from the world. From there it's a matter of figuring out where you think it's reasonable for that point to be, and it's on that score that well-informed people can disagree.

Sun's Scott McNealy summed it up pretty well, I think ("You have zero privacy anyway. Get over it.") Obviously I'm in the minority here on Slashdot, but I think he's pretty much right.

The deal with cookies

[stevejsmith]

Not really on topic at all, but I was always wondering, what's the big deal with cookies!? All they can do is store information THAT YOU GIVE THEM (or that they arbitrarily assign to you)! In fact, you don't even need cookies to do that. You can just do it with Perl or PHP. Yeah, sure, there are some flaws with cookies in IE, but there are flaws with everything in IE! Hell, Slashdot uses them! The media has somehow given them a bad name. Most sites require cookies, and they work quite well, actually. Would you really want to enter your user name and password for every like you click? No, I don't think so. I'll never understand...

Re:The deal with cookies

[Fweeky]

The problem is they can be used to track you across websites, remember?

Then deny cookies from third parties. Even IE can do that.

You can even use IE's P3P support to check their privacy policy and allow them to set cookies if you agree to it.

Cookies are fine. Cookies are the only sensible method of tracking state across the web, be that simple user logins to web applications. The alternative is just as easily leaked URL-encoded session information, and you can't reject that automatically.

good privacy...

[Anonymous Coward]

...comes with good ethics.... good ethics comes with good motives... good motives comes with epathy and understanding. All branches are limbs of the same tree - problems within a society are the dysfunction of that society. Change the society and things like this would not need to be discussed; they'd be a forgone conclusion.

Well, Slashdot's not using it...

[NineNine]

As far as I can tell, even Slashdot, the bastion of privacy (paranoi) isn't using it either. Tough to advocate something that you don't do yourself, huh?

Useless idea

[woogieoogieboogie]

The flaw in P3P is that it assumes people have preferences in these matters. Most people simply do not care. For those who do care, it is even more flawed because nobody has the will power to avoid their favorite websites because of disagreements over the sites privacy policies. How many Slashdotters would quit using Slashdot if Slashdot needed to sell some customer information to stay afloat?

It is a solution looking for a problem

Too Complex?

[smd4985]

i'm not overly familiar with p3p (p2p i understand ;) ), but my ex-girlfriend has a website devoted to viewpoints on p3p (http://www.p3p-viewpoints.org/). from what i understand, the major issue with p3p is that it is overly complex. some user studies have shown that users don't effectively understand what p3p means or how it affects them. more info at the website...

P3P is flawed

[zachlipton]

Part of the reason why the adoption of P3P has been so slow is that it may actually make privacy problems worse.

The problem is that users (and perl programmers) tend to be lazy. And lazy users check the little "this is the default setting so stop showing me dialog boxes" checkboxes in order to make things easier for them. The problem with this is that with P3P, a website can "claim" to not sell/rent your email address, but because the user set their default options to accept that, their address is automatically sent to the website and they don't have the opportunity to consider the implications and evaluate it themselves.

Also, P3P is a total PITA to write and the one editor that I know of (free from ibm) seems to be long since dead (and downright confusing too). It can also open companies up to legal trouble since a discrepency between a P3P file and the actual practices of the website could be grounds for a lawsuit (IANAL).

Re:P3P is flawed

[Jon Peterson]

That pretty much sums it up. It's a complete pain to implement. Getting your management to sit down and write (and sign off on) a decent privacy policy is hard enough, but to then translate that into some arcane XML format both difficult and pointless.

"So, remind me why our extremely clear and readable privacy policy that explains the nuances of medical ethics and the Internet has to be re-hashed into someone elses over-complex set of quasi-technical categories?"

"It's so that users can simply select from a small number of generic pre-set privacy levels, and let their browser manufacturer tell them whether we take good care of their data!"

It's a dumb idea. It's a miss-appliance of technology.

Re:We have it, but...

[error0x100]

On the other hand, I don't see what stops the sleazier companies from simply lying about privacy via P3P

This seems to me to be THE major flaw in this idea. The sort of companies who want to gather your personal information and sell it to third parties without your consent are, in most cases, PRECISELY those companies who are are not going to tell they are doing it. If they were at all ethical (*), they wouldn't gather and sell your info to begin with.

(*) Apart from unethical, in many countries other than the US, it is also outright illegal to do so.

P3P not that hard

[Anonymous Coward]

I implemented P3P support for our web site at a previous company I worked for.
P3P isn't that hard to figure out... Anyone who actually reads the W3C docs, and Microsoft's docs on how IE implements P3P, can easily support P3P. And it wasn't a "surprise", Microsoft had been telling the world that IE6 would support P3P from about a year before IE6 came out.
It took about 1 day to set up and implement P3P on our web sites (some IIS, some Apache/PHP).

How useful is it? It depends on web sites honestly reporting their information in the P3P info. I'm sure most big legit companies accuratly report their privacy policy in the P3P info.

But what's to stop some unscrupulous Web site from lying? It's not like it's against the law to lie in your P3P info... Nobody is going to punish you for doing it. So, does it really make the web safer?

What stops me?

[Afty0r]

"Do you have P3P policies for your website? If not, what stops you from creating one?"

Return on investment.

Creating a P3P policy would take alot of my time - I would have to research and learn the format and possiblities of the language, then write the policy, reconcile it with various departments within the company, then finally integrate into the site, and potentially have to deal with questions from confused visitors.

Implementing P3P on my site would cost me no money, but a great deal of time.

TIME IS MONEY