W3C Approves Web Privacy Standard

jbc writes: "The World Wide Web Consortium has approved the Platform for Privacy Preferences, or P3P, a standard that would allow browser software to automatically compare a user's privacy preferences with the privacy policies of a visited web site."

A Mixed blessing

[Jon Peterson]

I was looking at implementing this. It's a big old PITA. Enough of a PITA that I doubt 'amateur' sites will bother doing it - after all, it's not like they've been the ones abusing privacy, right?

I think it will end up being just like those commercial 'approval stamps' like TrustE. It looks great, but doesn't mean too much. Almost the opposite - any site that's gone to the trouble of filling out the damn XML file that's required probably has something to hide.

I'm not wholly against it, but I just have to ask why? Create a lot of unecessary standards and technical specs and formats, get poor old webmasters to support it and keep up to date with it and tolerate browser bugs with it, and why? Because ppl are too dumb to read a privacy policy and want their web browser to auto-read an XML version of it and auto-tell them how good it is?

Sorry, but it's a standard that we don't need. Already there are commercial tools out there to generate the damn file, because the format is so verbose. Only big corporate sites are going to bother with it, so 99% of the web sites you read simply won't activate the feature, meaning users don't get into the habit of paying attention.

Maybe I'm just overworked :-).

This about sums it up:

[quantax]

From the article: "Regardless of whether a site uses P3P, the system won't prevent sites from collecting data or sharing the information with marketers, nor would it let users negotiate with sites on how information gets used." Though this is a nice idea and all, I highly doubt its going to accomplish anything. Websites will continue to violate your privacy for marketing purposes whether P3P is installed or not. Next time perhaps they could do something to actually help consumers in a more aggressive fashion.

Re:This about sums it up:

[D.A. Zollinger]

I disagree. I think that when it comes time to choose which web sites to visit, or which portals to make your home page, people may make their choice by who follows P3P, and who doesn't. After all, if I have the choice of visiting Fox News [foxnews.com] or Cable News Network [cnn.com] or USA Today [usatoday.com], and each of which provide pretty much the same information, this could be the deciding factor.

Gee, I go to MSN [msn.com] and they protect my privacy, vs. Yahoo [yahoo.com] who will sell my information first chance they get, I think I would rather visit the site that has the better privacy policy, and thanks to P3P I know who that is!

Re:This about sums it up:

[jo42]

And there is nothing from stopping a web site putting up a bogus security policy.

Re:This about sums it up:

[KjetilK]

Obviously, you need laws too, like we have in Europe.

See it in action...

[mrpull]

here [microsoft.com]. I don't know how good the implementation is, but IE6 has supported P3P for a few months now.
mr.

So... (Idle Question)

[great throwdini]

When will we see Slashdot implement P3P?

Legality and XML

[Nyarly]

There doesn't seem to be any required correlation between my XML description of my site's privacy policy and my actualy privacy policy.

For that matter, can anyone comment on the following questions:

• How actionabile is violating my site's privacy policy?
• What about if the policy is described in XML instead of English?
• What if both are used, but the descriptions differ? (i.e., the XML says "We'll keep it all secret," but the English says "We're telling everyone.")

As an aside, wouldn't it be useful to keep a authenticated cache (somewhere other than in dreamland) of the P3P contracts I've agreed to? So that a site can't arbitrarily modify their contract and release my information in accordance with the new contract?

My P3P's different

[satanami69]

It involves me swapping files with two chicks at once. Oh yeah.

This is also very bad

[WillSeattle]

In that sites without a privacy "rating" are automatically rated as failing your listed privacy rating.

So most homepages fail. And many .org sites fail - unless they have full-time professional webmasters.

Only the commercial sites .com and government sites .gov gain from this implementation.

-