Web Privacy Standard: It's a Start

The World Wide Web Consortium (W3C) has given its official blessing to the Platform for Privacy Preferences (P3P) 1.0 specification, despite criticism from some privacy advocates who say the standard does little to protect consumer privacy.

P3P is designed to allow Web browsers to determine if a site meets users' privacy expectations. W3C, which worked on the development of P3P, has officially endorsed the current version as the standard that Web sites and users should adopt, said W3C spokesperson Janet Daly.

But some privacy experts scoffed at P3P.

"I think it is fair to say that consumer and privacy organizations have not been enthusiastic about P3P," said Marc Rotenberg, executive director of the Electronic Privacy Information Center. "I think it is certainly true that a lot of well-intentioned, smart people have been working on this for a long time. But to make it work for consumers, it has to be easy, effective and enforceable--three E's for the three P's. As P3P now stands, I don't think it passes that test."

Jason Catlett, president of Junkbusters, also criticized P3P.

"P3P is unlikely to cause any material improvement in privacy," he said.

P3P is simple to use: Users can install the technology on their computers and choose the level of privacy they want. As users surf the Web, sites that use P3P indicate to the Web browser what level of privacy protections they offer. If a Web site doesn't adhere to the level of protection already chosen by a user, P3P displays a warning and the user can either override the protection or move on to a different site.

Stronger Measures Sought

Both Catlett and Rotenberg said P3P doesn't prevent abuses by companies, and they called for legislation to codify privacy protections.

Daly said the W3C is aware of such criticism but added that P3P is just one part of a larger effort to ensure privacy on the Web. Privacy is going to be built and protected one step at a time, she said, and P3P is one of those steps.

That sentiment was shared by Ari Schwartz, associate director of the Center for Democracy and Technology. Schwartz noted that the center has worked on P3P in the past.

"This is the first iteration of the tools, and I think, from my viewpoint, the tools are much easier to use than other first-generation tools," Schwartz said.

This iteration of P3P, he said, is aimed at getting companies to build privacy protection into their Web sites in ways beyond simply posting a multipage privacy policy that no one can understand.

A number of companies have endorsed P3P and have begun to use it on their sites, Daly said. She pointed to Fidelity Investments, which has already posted its reasons for adopting P3P on its Web site.

Even so, Rotenberg said, many sites have yet to endorse P3P, and he predicted that users would probably end up disabling it out of frustration. He said he also fears that companies could use P3P as a way of fending off more-meaningful privacy legislation.

For P3P to really protect privacy, it has to be enforceable, Rotenberg said.