Clarke, Roger --- "The Platform for Privacy Preferences: An overview" [1998] PrivLawPRpr 44; (1998) 5(2) Privacy Law & Policy Reporter 35

• Internet protocols and risks
• P3P and W3C
• Background to P3P
• Context
• Purpose
• The P3P architecture and process
• Technical mechanisms
• Appendices
• Further reading

---

The Platform for Privacy Preferences: An overview

Roger Clarke

(This paper is a revised version of notes prepared to accompany a panel presentation at WWW7 in Brisbane in April 1998. A copy is available at http://www.anu.edu.au/people/Roger.Clarke/DV/P3POview.html. Roger Clarke’s critique of P3P will follow in the next issue of PLPR — General Editor)

Internet protocols and risks

The Internet is a set of inter-connected networks, all of which use the same underlying standards or ‘protocols’ (TCP/IP, or, more generally, the Internet Protocol Suite — IPS).[1] There are many service that are available over the Internet. Commonly-used services include email (using the SMTP and MIME protocols), file transfer (using the FTP protocol), and terminal emulation (using the telnet facility, whereby a remote PC behaves as though it were a terminal directly connected to a distant computer).

The most explosive growth in the history of the Internet was spawned by the world-wide web. Since 1993, this service, based on the HTTP protocol, has enabled the publication of documents as ‘web-pages’, making them available to anyone in the world with an Internet-connection and a piece of software called a ‘web-browser’. One of the strengths of the HTTP protocol is that it not only supports its own native document-format (HTML), but can also be used as a vehicle to transfer, process and display many other formats, including images, sounds and video. The web exploits the Internet to produce a virtual playground, a virtual library, and a virtual marketspace.

Any new technology that offers power brings with it risks. One of the risks inherent in the world wide web is that users will inadvertantly disclosure information that they would prefer not to. Another is that organisations may develop software which actively extracts personal data, and use it to exercise control over the behaviour of their clients.[2] This paper describes a particular technology that has recently been specified, whose purpose is to establish a fair balance between the interests of web-marketers and web-consumers, and the following paper provides a critique.

P3P and W3C

Quite a lot of people are actively doing something about Internet privacy. Their actions range from assaults on privacy-invaders, through responsible net-activist activities, privacy-sensitive architectures and services, and privacy-enhancing technology development, to actions in legislatures. This Overview provides background to one particular initiative, the Platform for Privacy Preferences (P3P) protocol developed by the World Wide Web Consortium (W3C).

W3C is a foundation charged with maintenance and enhancement of the web. Despite being funded almost exclusively by IT providers, W3C retains a remarkably close affinity with the mainstream of the Internet-public. It seeks to enable web-based electronic commerce, without in the process undermining the web-based electronic community ethos. For the last couple of years, I’ve been cautiously optimistic about that aspiration being able to be sustained, and I continue to be positive about it.

Background to P3P

In 1996-1997, the World Wide Web Consortium (W3C) recognised the importance of establishing a framework within which trust can be achieved between web services providers and consumers. It launched an initiative entitled Platform for Privacy Preferences (P3P) at http://www.w3c.org/P3P/. A Public Working Draft of the syntax specification was published on 19 May 1998.[3]

Major providers, including Engage Technologies, Firefly, Microsoft, Netscape, Open Sesame and Microsystems Software have announced plans to implement the P3P protocol within their products.

This unofficial Overview of P3P is based on the information provided by W3C P3P pages, in particular the FAQ, a presentation, and the architecture, grammar, and harmonisation drafts. These will be revised and consolidated in the coming months.

Context

The P3P protocol is intended to support negotiations in a wide variety of contexts, including the following:

• implicit data provision (in particular the ‘click stream’, or series of pages visited at a web-site);
• explicit data provision (for example, answers provided by web-users in web-forms); and
• explicit data provision from an established web-user profile (such as a set of terms that reflect a person’s interests and are commonly used in searching, and consumer-related information, such as food-preferences, and shoe- and clothing-sizes). Such a profile might be stored on the client-workstation, the web-server, or an intermediate service. P3P architecture envisages a data repository, for storing data under the control of P3P preferences over a period of time.

P3P explicitly recognises the need to support multiple personae per web-user. Personae allow the web-user to create different views of themselves by changing the data given to a service. A persona may be based upon the service’s purpose (for example,business, gaming, home, etc), credentials (for example, level of associated trust), consequences and practices (for example, personalisation, shipping, mailing list), or any user defined rationale (for example, time-of-day, phase-of-moon, etc). Hence a web-user might decline to enter a web-site under their ‘normal’ persona, which might have a substantial amount of personal data associated with it; but might switch personae to a pseudonymous, or data-poor persona, and enter the site while making little about themselves available to it.

P3P is intended to support interactions involving basic HTTP. It is as yet precisely how it will be applied to interactions involving enhancements to basic HTTP, such as cookies, Javascript, Java and ActiveX.

Purpose

The purpose of the P3P specification is to enable:

• web-sites to specify their personal data use and disclosure practices;
• web-users to specify their expectations concerning personal data disclosure practices; and
• software agents to undertake negotiation, on behalf of the parties, in order to reach an agreement concerning the exchange of data between them.

In effect, it is to provide means whereby an individual can have sufficient information that he or she can make an informed decision on whether to permit further use of the data, or decline further use of the data. Moreover, that decision is to be able to be delegated to a software agent acting on behalf of the individual.

If the individual denies access to data, or denies the service-provider authority to use the data, the web-site operator might provide a degraded service, or might provide no service at all. In either case, this may be by choice (for example, because the web-site operator places a high value on collecting such data, or wishes to discourage the denial of data), or by necessity (for example, because it is not feasible to provide the service in the absence of the data, such as the delivery address for physical goods, or a means of ensuring receipt of payment).

P3P is also intended to make a major contribution (but not to provide a complete solution) to the following, more abstract objectives:

• to establish trust on the part of web-users that their personal data will only be provided to web-sites whose personal data use and disclosure practices are in accordance with their expectations; and
• to contribute to and encourage assurance that any use or disclosure of data is in accordance with that agreement. Elements of such an environment might include, depending on the context:
• auditing services to ensure that privacy statements are conformed with;
• brandnames associated with such assurance schemes, for example, TRUSTe;[4] and
• legal sanctions for non-compliance.

The P3P architecture and process

The elements of a P3P-enabled web-context are as follows:

• personal data use and disclosure preferences expressed by web-users. A preference is a rule, or set of rules, expressed by a web-user, that determines what action(s) a user agent will take or allow when involved in a conversation or negotiation with a service. A preference might be expressed in conventional text, or as a formally defined machine-processable statement;
• personal data use and disclosure practices expressed by web-sites. A practice is a P3P clause expressed by a web-site that describes what it plans to do with data;
• the P3P protocol, which provides a framework for a market in such information. It involves a web-browser issuing a request for practices, and a web-site replying with a proposal. A proposal is a series of statements. A statement is a description of the data a web-site will request, what the web-site will do with it, and the consequence to the user; and
• P3P-compliance embedded within web-browsers and web-servers, and, as appropriate, also web-server proxies.

A simplified description of the basic process is as follows:

• a P3P-compliant web-browser acquires from a P3P-compliant web-server a web-site’s proposal, that is,its statements of its practices, for example, as a result of a request issued by the web-browser;
• the web-browser compares the proposal with the web-user’s preferences;
• if the proposal satisfies the preferences, the web-browser and web-server proceed, transparently to the web-user, to communicate as per the HTTP protocol (as extended by tools such as Javascript, Java and cookies);
• if the practices statement does not satisfy the preferences statement, then, depending on the web-browser implementation and/or the web-user’s parameter-settings, the web-browser may:
• attempt negotiation with the web-server, in order to achieve an outcome consistent with the preferences statement;
• notify the web-user (for example, of the nature of the mis-match, and/or of the site’s explanation why the practice is as it is), enabling the web-user to:
• provide informed consent to provision of the data, despite the mis-match;
• attempt negotiation manually; or
• withdraw from further interaction with the web-site.

The effect of the scheme is to achieve what W3C refers to as ‘informed consent through user choice’.

P3P assumes that some external mechanism exists to provide assurance that the practice will be conformed with. This assurance may come from the web-site or an independent assuring party. Ideally, the assuring party would digitally sign proposals, and would be financially liable for breach.

Technical mechanisms

The manner of implementation in web-browsers and web-servers, including user-interface aspects, is not specified in the P3P protocol, because this is an appropriate domain for competitive marketplace behaviour.

To enable the uttering of privacy statements, and the exchange of data under user control, the P3P protocol is built over the emergent W3C standards for:

• eXtensible Markup Language (XML)[5]; and
• Resource Description Framework (RDF)[6].

It is intended that P3P support future digital certificate and digital signature capabilities as they become available. P3P is being designed to be able to be incorporated into browsers, and servers, and proxy servers that sit between a client and server.

The P3P Grammar is a set of rules that defines the structure of P3P clauses used to make a valid P3P statement. The following example structures clauses (in the parentheses) to make a simple privacy practice statement:

• for (these URIs)
• the following (practices) apply
• to this (set of data)

Appendices

The Appendices (reprinted pp38-39) provide the following further information:

• Appendix 1 provides further detail on the format of proposals and statements;
• Appendix 2 identifies the Data Categories that are distinguished within the P3P protocol
• Appendix 3 identifies the Purposes that are distinguished within the P3P protocol;
• Appendix 4 identifies the Purpose Qualifiers that are distinguished within the P3P protocol;
• Appendix 5 identifies the General Disclosures that are distinguished within the P3P protocol.

Further reading

The primary document that defines P3P is:

• Public Working Draft of the Syntax Specification (19 May 1998) — http://www.w3.org/TR/WD-P3P10-syntax.

The P3P Syntax Specification was based on other documents, specifically the

• P3P Protocol White Paper — http://www.w3.org/TR/1998/NOTE-P3P10-Protocols-19980324.html;
• P3P Harmonized Vocabulary Specification — http://www.w3.org/TR/1998/WD-P3P10-harmonization;

as well as the:

• P3P Grammatical Model and Data Design Model Working Draft — http://www.w3.org/TR/WD-P3P-grammar.html;
• P3P Architecture Working Draft — http://www.w3.org/TR/WD-P3P-arch.html

Roger Clarke, Principal, XamaX Consultancy Pty Ltd.

---

1. See http://www.anu.edu.au/people/Roger.Clarke/II/IPrimer.html for a primer on Internet technology.
2. Privacy impacts of the Internet generally are examined in http://www.anu.edu.au/people/Roger.Clarke/DV/IPrivacy.html, and the papers it references.
3. http://www.w3.org/TR/WD-P3P10-syntax
4. http://www.truste.org/
5. http://www.w3.org/XML/
6. http://www.w3.org/RDF/