Report: Many Failures: A Brief History of Privacy Self-Regulation | Section: Combination Self-Regulatory Efforts

You are reading section IV., Combination Self-Regulatory Efforts, of the report Many Failures: A Brief History of Privacy Self-Regulation.

Report Links:

 

IV. Combination Self-Regulatory Efforts

The self-regulatory efforts in this category include projects that have many components, including input from government, industry, academia, and civil society.

Platform for Privacy Preferences Project (P3P)

The Platform for Privacy Preferences Project (P3P) is a technical standard for communicating the privacy policies of a website to those who use the website. A user can retrieve a standardized machine-readable privacy policy from a website and use the information to make a decision about how to interact with the website. Each user can match the privacy policy against the user’s individual privacy preferences.

P3P allows a browser to understand a website privacy policy in a simplified and organized manner, without the need for a user to find and read a lengthy privacy policy. With the proper browser settings, P3P will automatically block any cookies from a website with a privacy policy that the user determined to be objectionable.

The Center for Democracy and Technology (CDT) supported the early work that eventually resulted in P3P. [88] CDT convened an Internet Privacy Working Group that drafted a mission statement, with companies, trade associations, and consumer groups participating. A presentation of a prototype was presented at an FTC Workshop in 1997. [89]

Later in the same year, P3P became a project of the World Wide Web Consortium (W3C), the main international standards organization for the World Wide Web. The working group included representatives of companies, academia, and government. [90] The work of drafting the formal specification took some time, and version 1.0 was finally published at the end of 2000. [91] A later specification was published in 2006. [92]

Microsoft included some support for P3P in its browser, Internet Explorer. [93] The Firefox browser from Mozilla also provides some support. [94] The E-Government Act of 2002 [95] included a requirement that federal agency websites translate privacy policies into a standardized machine- readable format, [96] and P3P is the only specification that meets the requirements. [97] It was a promising start.

However, the extent to which commercial websites and even government websites attempted to implement P3P or succeeded in doing so in the long term is highly uncertain. A 2008 published review of P3P by Professor Lorrie Faith Cranor found P3P adoption increasing overall but that P3P adoption rates greatly vary across industries. Other findings are that P3P had been deployed on 10% of the sites returned in the top-20 results of typical searches, and on 21% of the sites in the top-20 results of e-commerce searches. Review of over 5,000 web sites in both 2003 and 2006 found that P3P deployment increased over that period, although there were decreases in some sectors. The review also found high rates of syntax errors among P3P policies, but much lower rates of critical errors that prevent a P3P user agent from interpreting them. Privacy policies of P3P-enabled popular websites were found to be similar to the privacy policies of popular websites that do not use P3P. [98]

An analysis published two years later by the CyLab at Carnegie Mellon University looked at over 33,000 websites using P3P compact policies and “detected errors on 11,176 of them, including 134 TRUSTe-certified websites and 21 of the top 100 most-visited sites.” [99] The study also found thousands of sites using identical invalid compact policies (CP) that had been recommended as workarounds for Internet Explorer cookie blocking. Other sites had CPs with typos in their tokens, or other errors. Fully 98% of invalid CPs resulted in cookies remaining unblocked by Internet Explorer under its default cookie settings. The analysis concluded that it “appears that large numbers of websites that use [compact policies] are misrepresenting their privacy practices, thus misleading users and rendering privacy protection tools ineffective.” [100] The study concluded that companies do not have sufficient incentives to provide accurate machine-readable privacy policies. [101]

In other words, the self-regulatory aspects of P3P do not appear to be working, with the CyLab study suggesting that lack of enforcement by regulators is a problem. [102] Neither P3P nor any industry trade association offers a P3P enforcement method.

P3P has some of the indicia of industry self-regulation in that it was inspired in part by FTC interest and motivated in part by an industry interest in avoiding legislation or regulation. [103] The involvement in P3P’s development and promotion by consumer groups and the White House together with industry representatives differentiates P3P from the other industry efforts discussed earlier in this report. Another differentiator is the legislative requirement that federal agencies use P3P or similar technology. P3P shares sufficient characteristics with the self-regulatory programs discussed in this report to warrant its inclusion here.

Some privacy groups opposed P3P from the beginning, largely because of concerns that it would prevent privacy legislation from passing. Company views of the project also varied. [104] It is not clear how much attention P3P has received in recent years from companies or privacy groups.

Unlike some of the self-regulatory activities discussed in Part II of this analysis, P3P remains in use. However, given the findings of the 2010 study of widespread misrepresentation of privacy policies by those using P3P, it is hard to call P3P any kind of success. Further, the study provides strong evidence of deliberate deception in implementation of P3P at some websites. Internet users appear to have little knowledge of P3P, although public awareness may not be essential since the controls are built into browsers and users appear to be concerned about the privacy policies that P3P is designed to convey. [105] Like the Commerce Department’s Safe Harbor Framework, P3P continues to exist, but both programs are so lacking in rigor and compliance that neither is fulfilling its original purpose.

 

 

 

_____________________________________

Endnotes

[88] For a fuller history of P3P and details on the actual technical standard, see Lorrie Faith Cranor, Web Privacy with P3P (2002).

[89] Id. at 45.

[90] Id. at 46.

[91] Id. at 53.

[92] http://www.w3.org/TR/P3P11 (last visited 9/20/11).

[93] See http://msdn.microsoft.com/en-us/library/ms537343%28VS.85%29.aspx (last visited 9/20/11).

[94] See http://www-archive.mozilla.org/projects/p3p (last visited 9/20/11).

[95] Public Law 107-347.

[96] See Office of Management and Budget, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002 (2003) (M-03-22), http://www.whitehouse.gov/omb/memoranda_m03-22 (last visited 9/20/11).

[97] See, e.g., Department of Health and Human Services, HHS-OCIO Policy for Machine-Readable Privacy Policies at 4.2 (Policy 2010-0001, 2010), http://www.hhs.gov/ocio/policy/hhs-ocio-2010_0001_policy_for_machine- readable_privacy_policies.html (last visited 9/20/11).

[98] Lorrie Faith Cranor et al., P3P Deployment on Websites, 7 Electronic Commerce Research and Applications 274- 293 (2008).

[99] Pedro Giovanni Leon et al, Token Attempt: The Misrepresentation of Website Privacy Policies through the Misuse of P3P Compact Policy Tokens (CMU-CyLab-10-014 2010), http://www.cylab.cmu.edu/files/pdfs/tech_reports/CMUCyLab10014.pdf (last visited 9/20/11).

[100] Id.

[101] Id. at 9.

[102] Id.

[103] See, e.g., Simson Garfinkel, Can a labeling system protect your privacy?, Salon (July 11, 2000), http://www.salon.com/technology/col/garf/2000/07/11/p3p (last visited 9/20/11) (“But P3P isn’t technology, it’s politics. The Clinton administration and companies such as Microsoft are all set to use P3P as the latest excuse to promote their campaign of “industry self-regulation” and delay meaningful legislation on Internet privacy.”).

[104] Lorrie Faith Cranor, Web Privacy with P3P 56 (2002).

[105] See Serge Egelman et al., Timing Is Everything? The Effects of Timing and Placement of Online Privacy Indicators (2009), http://www.guanotronic.com/~serge/papers/chi09a.pdf (last visited 9/20/11).

 

 

Roadmap: Many Failures – A Brief History of Privacy Self-Regulation in the United States: IV. Discussion: Combination Self-Regulatory Efforts

 

Report home | Read the report (PDF) | Previous section | Next section