P3P

The Platform for Privacy Preferences Project (P3P) is an obsolete protocol allowing websites to declare their intended use of information they collect about web browser users. Designed to give users more control of their personal information when browsing, P3P was developed by the World Wide Web Consortium (W3C) and officially recommended on April 16, 2002. Development ceased shortly thereafter and there have been very few implementations of P3P. Internet Explorer and Microsoft Edge Legacy were the only major browsers to support P3P. Microsoft has ended support from Windows 10 onwards. Internet Explorer and Edge [Legacy] on Windows 10 no longer support P3P as of 2016. W3C officially obsoleted P3P on 2018-08-30. The president of TRUSTe has stated that P3P has not been implemented widely due to the difficulty and lack of value.

As the World Wide Web became a genuine medium in which to sell products and services, electronic commerce websites tried to collect more information about the people who purchased their merchandise. Some companies used controversial practices such as tracker cookies to ascertain the users' demographic information and buying habits, using this information to provide specifically targeted advertisements. Users who saw this as an invasion of privacy would sometimes turn off HTTP cookies or use proxy servers to keep their personal information secure. P3P was designed to give users more precise control over the kind of information that they release. According to the W3C, the main goal of P3P "is to increase user trust and confidence in the Web through technical empowerment".

P3P is a machine-readable language that helps to express a website’s data management practices. P3P manages information through privacy policies. When a website used P3P, they set up a set of policies that allows them to state their intended uses of personal information that may be gathered from their site visitors. When a user decided to use P3P, they set their own set of policies and state what personal information they will allow to be seen by the sites that they visit. Then when a user visited a site, P3P will compare what personal information the user is willing to release, and what information the server wants to get – if the two do not match, P3P would inform the user and ask if he/she is willing to proceed to the site, and risk giving up more personal information. As an example, a user may store in the browser preferences that information about their browsing habits should not be collected. If the policy of a Website stated that a cookie is used for this purpose, the browser would automatically reject the cookie. The main content of a privacy policy is the following:

The privacy policy can be retrieved as an XML file or can be included, in compact form, in the HTTP header. The location of the XML policy file that applies to a given document can be:

P3P allows to specify a max-age for caching. A dummy /w3c/p3p.xml file could use this feature:

Microsoft's Internet Explorer and Edge [Legacy] were the only mainstream web browsers that supported P3P. Other browsers did not implemented it due to a perceived lack of value. IE provides the ability to display P3P privacy policies, and compare the P3P policy with the browser's settings to decide whether or not to allow cookies from a particular site. However, the P3P functionality in Internet Explorer extends only to cookie blocking, and will not alert the user to an entire web site that violates active privacy preferences. Microsoft considers the feature deprecated in its browsers and totally removed P3P support on Windows 10.

Mozilla supported some P3P features for a few years, but all P3P related source code was removed by 2007.

The Privacy Finder service was also created by Carnegie Mellon's Usable Privacy and Security Laboratory. It is a publicly available "P3P-enabled search engine." A user can enter a search term along with their stated privacy preferences, and is then presented with a list of search results which are ordered based on whether the sites comply with their preferences. This works by crawling the web and maintaining a P3P cache for every site that ever appears in a search query. The cache is updated every 24 hours so that every policy is guaranteed to be relatively up to date. The service also allows users to quickly determine why a site does not comply with their preferences, as well as allowing them to view a dynamically generated natural language privacy policy based on the P3P data. This is advantageous over simply reading the original natural language privacy policy on a web site because many privacy policies are written in legalese and are extremely convoluted. Additionally, in this case the user does not have to visit the web site to read its privacy policy.