Roger Clarke's 'P3P Overview'

These notes were originally prepared to accompany a panel presentation at WWW7 in Brisbane in April 1998. They were re-published in Privacy Law & Policy Reporter 5, 2 (July 1998) at 35-39

This is the first of a family of three papers. The other two are A Critique (1998) and a Re-visit (2001)

This document is at http://www.rogerclarke.com/DV/P3POview.html

Introduction

Background

Context

Purpose

The P3P Architecture and Process

Technical Mechanisms

Introduction

Privacy is a very important public concern. My pages include an introduction to the topic; together with a vast array of relevant information.

Internet privacy is of particular, and rapidly increasing, concern. My pages include a substantial review. Quite a lot of people are actively doing something about Internet privacy. Their actions range from assaults on privacy-invaders, through responsible net-activist activities, privacy-sensitive architectures and services, and privacy-enhancing technology development, to actions in legislatures.

This document provides background to one particular initiative, the Platform for Privacy Preferences (P3P) protocol developed by the World Wide Web Consortium (W3C).

This overview document is complemented by a critique of P3P (which assumes that you've already read the document that is currently in front of you).

W3C is a foundation charged with maintenance and enhancement of the web. Despite being funded almost exclusively by IT providers, W3C retains a remarkably close affinity with the mainstream of the Internet-public. It seeks to enable web-based electronic commerce, without in the process undermining the web-based electronic community ethos. For the last couple of years, I've been cautiously optimistic about that aspiration being able to be sustained, and I continue to be positive about it.

Background

In 1996-97, the World Wide Web Consortium (W3C) recognised the importance of establishing a framework within which trust can be achieved between web services providers and consumers. It launched an initiative entitled Platform for Privacy Preferences (P3P).

A Public Working Draft of the syntax specification was published on 19 May 1998.

Major providers, including Engage Technologies, Firefly, Microsoft, Netscape, Open Sesame and Microsystems Software have announced plans to implement the P3P protocol within their products.

This document provides an (unofficial) overview of P3P. It is based on the information provided by W3C P3P, in particular the FAQ, a presentation, and the architecture, grammar, and harmonisation drafts. These will be revised and consolidated in the coming months.

Context

The P3P protocol is intended to support negotiations in a wide variety of contexts, including the following:

implicit data provision (in particular the 'click stream', or series of pages visited at a web-site);
explicit data provision (e.g, answers provided by web-users in web-forms); and
explicit data provision from an established web-user profile (such as a set of terms that reflect a person's interests and are commonly used in searching, and consumer-related information, such as food-preferences, and shoe- and clothing-sizes). Such a profile might be stored on the client-workstation, the web-server, or an intermediate service. P3P architecture envisages a data repository, for storing data under the control of P3P preferences over a period of time.

P3P explicitly recognises the need to support multiple personae per web-user. Personae allow the web-user to create different views of themselves by changing the data given to a service. A persona may be based upon the service's purpose (e.g. business, gaming, home, etc.), credentials (e.g. level of associated trust), consequences and practices (e.g. personalization, shipping, mailing list), or any user defined rationale (e.g. time of day, phase of moon, etc). Hence a web-user might decline to enter a web-site under their 'normal' persona, which might have a substantial amount of personal data associated with it; but might switch personae to a pseudonymous, or data-poor persona, and enter the site while making little about themselves available to it.

P3P is intended to support interactions involving basic HTTP. It is as yet precisely how it will be applied to interactions involving enhancements to basic HTTP, such as cookies, Javascript, Java and ActiveX.

Purpose

The purpose of the P3P specification is to enable:

web-sites to specify their personal data use and disclosure practices;
web-users to specify their expectations concerning personal data disclosure practices; and
software agents to undertake negotiation, on behalf of the parties, in order to reach an agreement concerning the exchange of data between them.

In effect, it is to provide means whereby an individual can have sufficient information that he or she can make an informed decision on whether to permit further use of the data, or decline further use of the data. Moreover, that decision is to be able to be delegated to a software agent acting on behalf of the individual.

If the individual denies access to data, or denies the service-provider authority to use the data, the web-site operator might provide a degraded service, or might provide no service at all. In either case, this may be by choice (e.g. because the web-site operator places a high value on collecting such data, or wishes to discourage the denial of data), or by necessity (e.g. because it is not feasible to provide the service in the absence of the data, such as the delivery address for physical goods, or a means of ensuring receipt of payment).

P3P is also intended to make a major contribution (but not to provide a complete solution) to the following, more abstract objectives:

to establish trust on the part of web-users that their personal data will only be provided to web-sites whose personal data use and disclosure practices are in accordance with their expectations; and
to contribute to and encourage assurance that any use or disclosure of data is in accordance with that agreement. Elements of such an environment might include, depending on the context:
- auditing services to ensure that privacy statements are conformed with;
- brandnames associated with such assurance schemes, e.g. TRUSTe; and
- legal sanctions for non-compliance.

The P3P Architecture and Process

The elements of a P3P-enabled web-context are as follows:

personal data use and disclosure preferences expressed by web-users. A preference is a rule, or set of rules, expressed by a web-user, that determines what action(s) a user agent will take or allow when involved in a conversation or negotiation with a service. A preference might be expressed in conventional text, or as a formally defined machine-processable statement;
personal data use and disclosure practices expressed by web-sites. A practice is a P3P clause expressed by a web-site that describes what it plans to do with data;
the P3P protocol, which provides a framework for a market in such information. It involves a web-browser issuing a request for practices, and a web-site replying with a proposal. A proposal is a series of statements. A statement is a description of the data a web-site will request, what the web-site will do with it, and the consequence to the user; and
P3P-compliance embedded within web-browsers and web-servers, and, as appropriate, also web-server proxies.

A simplified description of the basic process is as follows:

a P3P-compliant web-browser acquires from a P3P-compliant web-server a web-site's proposal, i.e. its statements of its practices, e.g. as a result of a request issued by the web-browser;
the web-browser compares the proposal with the web-user's preferences;
if the proposal satisfies the preferences, the web-browser and web-server proceed, transparently to the web-user, to communicate as per the HTTP protocol (as extended by tools such as Javascript, Java and cookies);
if the practices statement does not satisfy the preferences statement, then, depending on the web-browser implementation and/or the web-user's parameter-settings, the web-browser may:
- attempt negotiation with the web-server, in order to achieve an outcome consistent with the preferences statement;
- notify the web-user (e.g. of the nature of the mis-match, and/or of the site's explanation why the practice is as it is), enabling the web-user to:
  - provide informed consent to provision of the data, despite the mis-match;
  - attempt negotiation manually; or
  - withdraw from further interaction with the web-site.

The effect of the scheme is to achieve what W3C refers to as 'informed consent through user choice'.

P3P assumes that some external mechanism exists to provide assurance that the practice will be conformed with. This assurance may come from the web-site or an independent assuring party. Ideally, the assuring party would digitally sign proposals, and would be financially liable for breach.

Technical Mechanisms

The manner of implementation in web-browsers and web-servers, including user-interface aspects, is not specified in the P3P protocol, because this is an appropriate domain for competitive marketplace behaviour.

To enable the uttering of privacy statements, and the exchange of data under user control, the P3P protocol is built over the emergent W3C standards for:

It is intended that P3P support future digital certificate and digital signature capabilities as they become available. P3P is being designed to be able to be incorporated into browsers, and servers, and proxy servers that sit between a client and server.

The P3P Grammar is a set of rules that defines the structure of P3P clauses used to make a valid P3P statement. The following example structures clauses (in the parentheses) to make a simple privacy practice statement:

	for (these URIs)
	the following (practices) apply
	to this (set of data)

The Appendices provide the following further information:

1 provides further detail on the format of proposals and statements;
2 identifies the Data Categories that are distinguished within the P3P protocol
3 identifies the Purposes that are distinguished within the P3P protocol;
4 identifies the Purpose Qualifiers that are distinguished within the P3P protocol;
5 identifies the General Disclosures that are distinguished within the P3P protocol.

Appendix 1
General Form and Pseudocode Form of the P3P Grammatical Model

From http://www.w3c.org/TR/WD-P3P-grammar.html

Accessed on 9 April 1998

The general form of a proposal is:

       using schema
       (for some experience space)
       (you will enter an agreement with this entity)
       (Statement)+
       They will offer:
       (this access)
       (and this qualifier)
       (Accepting will give you this consequence)
       (for more information, contact)
       (Signature)

Statements are composed of the following mandatory clauses:

experience space, practice, qualified data set.

Statements might also include the following optional clauses:

qualifier, access, consequence, agreement_with, contact.

These clauses are further specified below.

The proposed protocols and negotiation working group will also determine any additional syntax that might be needed for combining statements into proposals.

The general form of a statement is:

       (for some experience space)
       (you will enter an agreement with this entity)
       who will apply this (practice to (qualified data set)+ 
          (with qualifier)* 
          (with access)
       )*
       (Accepting will give you this consequence)
       (for more information, contact)
       (Signature)

The general form of a qualified data set is:

       named set of data
       falling into this (category)+
       using data schema
       Apply the access permission restriction
       (and this qualifier)

Example

In an HTML-like pseudocode, this might look something like:

<ablock id="proposal">
        <namespace href="http://www.w3.org/P3_1.0/" as="P3"/>
        <p3::schema>"http://www.ipwg.org/P3_1.0/"</P3::schema>
        <P3::for_include>"http://www.w3.org"</P3::for_include>
        <P3::agreement>"http://www.w3.org/DSig/x509v3/","W3CCert"</P3::agreement>
        <P3::access>"http://www.w3.org/DataAboutYou"</P3::access>
        <P3::consequence>"http://www.w3.org/WhatYouGet"</P3::consequence>
        <P3::contact>"mailto:sally@w3.org"</P3::contact>
        <ablock id="statement1">
                <ablock id="data1"><P3::practice>3</P3::practice>
                        <P3::data_schema>"OPS2"</P3::data_schema>
                        <P3::named_data>"contact information"</P3::named_data>
                        <P3::permissions>"W3CCert","Read"
                        <P3::qualifier>"Required"</P3::qualifier></ablock>
                <ablock id="data2"><P3::practice>3</P3::practice>
                        <P3::data_schema>"OPS2"</P3::data_schema>
                        <P3::named_data>"computer information"</P3::named_data>
                        <P3::permissions>"W3CCert","Read"
                        <P3::qualifier>"Optional"</P3::qualifier></ablock>
                </ablock>
        </ablock>
<ablock href="#proposal1" id="signature">
        <namespace href="http:www.w3.org/PICS/DSig_Schema/pkcs7V2_0/" as="pkcs7">
        <pkcs7::key>.....</pkcs7::key>
        <pkcs7::sig>.....</pkcs7::sig>
        </ablock>

Appendix 2
P3P Data Categories

From http://www.w3.org/TR/1998/WD-P3P-harmonization#Data Categories

Accessed on 9 April 1998

0 Physical Contact Information

Information that allows an individual to be contacted or located in the physical world -- such as phone number or address.

1 Online Contact Information

Information that allows an individual to be contacted or located on the Internet -- such as email. Often, this information is independent of the specific computer used to access the network. (See Computer Information)

2 Unique Identifiers

Non-financial identifiers issued for purposes of consistently identifying the individual -- such as SSN or Web site IDs.

3 Financial Account Identifiers

Identifiers that tie an individual to a financial instrument, account, or payment system -- such as a credit card or bank account number.

4 Computer Information

Information about the computer system that the individual is using to access the network -- such as the IP number, domain name, browser type or operating system.

5 Navigation and Click-stream Data

Data passively generated by browsing the Web site -- such as which pages are visited, and how long users stay on each page.

6 Transaction Data

Data actively generated from or reflecting explicit interactions with a service provider through its site -- such as queries to a search engine, logs of account activity, or purchases made on the Web.

7 Demographic and Socio-economic Data

Data about an individual's characteristics -- such as gender, age, and income.

8 Preference Data

Data about an individual's likes and dislikes -- such as favorite color or musical tastes.

9 Content

The words and expressions contained in the body of a communication -- such as the text of email, bulletin board postings, or chat room communications.

Appendix 3
P3P Purposes

From http://www.w3.org/TR/1998/WD-P3P-harmonization#Purposes Defined

Accessed on 9 April 1998

0 Completion and Support of Current Activity

The use of information by the service provider to complete the activity for which it was provided, such as the provision of information, communications, or transaction services -- for example to return the results from a Web search, to forward email, or place an order.

1 Web Site and System Administration

The use of information solely for the technical support of the Web site and computer system. This would include processing computer account information, and information used in the course of securing, and maintaining the site.

2 Customization of Site to Individuals

The use of information to tailor or modify the content or design of the site to the particular individual.

3 Research and Development

The use of information to enhance, evaluate, or otherwise review the site, service, product, or market. This does not include personal information used to tailor or modify the content to the specific individual nor information used to evaluate, target, profile or contact the individual.

4 Contacting Visitors for Marketing of Services or Products

The use of information to contact the individual for the promotion of a product or service. This includes notifying visitors about updates to the Web site.

5 Other Uses

The use of information not captured by the above definitions. (A human readable explanation should be provided in these instances.)

Appendix 4
P3P Purpose Qualifiers

From http://www.w3.org/TR/1998/WD-P3P-harmonization#Purpose Qualifiers

Accessed on 9 April 1998

Identifiable Use

Is data used in a way that is personally identifiable -- including linking it with identifiable information about you from other sources? Examples: (full_name), but also other data, such as (zip_code, salary, birth_date), and even IP number.

       0 No 
       1 Yes

Recipients (Domain of Use)

This defines an organizational area, or domain, beyond the service provider and its agents where data may be distributed.

0 Only ourselves and our agents

Ourselves and our agents. We define an agent as a third party that processes data only on behalf of the service provider for the completion of the stated purposes. (e.g., a printing bureau that prints address labels and does nothing further with the information.)

1 Organizations following our practices

Organizations who use the data on their own behalf under equable practices. (e.g. data is shared with a partner who offers complementary products or accessories, but since they do not retain the data they consequently cannot provide access to it.)

2 Organizations following different practices

Organizations that are constrained by and accountable to the original service provider, but may use the data in a way not specified in the service provider's practices. (e.g. data is shared with a partner who may also use data for research and development.)

3 Unrelated third parties or public fora

Organizations or fora whose data usage practices are not known by the original service provider. (e.g. data is provided as part of a commercial CD-ROM directory, or it is posted on a public on-line Web directory.)

Appendix 5
General Disclosures

From http://www.w3.org/TR/1998/WD-P3P-harmonization#General Disclosures

Accessed on 9 April 1998

Access to Identifiable Information

The ability of the individual to view identifiable information and address questions or concerns to the service provider.

0 Identifiable Data is Not Used

[this should be consistent with the use of the identifiable qualifier]

1 Identifiable Contact Information

access is given to identifiable online and physical contact information (e.g., users can access things such as a postal address)

2 Other Identifiable Information

access is given to other information linked to an identifiable person. (e.g., users can access things such as a their online account charges)

3 None

no access to identifiable information is given.

Assurance (accountability)

Does the site have an assuring party that attests that the service will abide by its proposal, follows guidelines in the processing of data, or other relevant assertions. Assurance may come from the service provider or an independent assuring party.

 0 	No    there is no disclosure with respect to assurance.
 1 	Yes   there is an assurance mechanism, see our disclosure.

Other_Disclosures
0 Change_Agreement

Does the service provider make a disclosure regarding the capability for the user to cancel, or renegotiate the existing agreement at a future time?

1 Retention

Does the service provider make a disclosure on how long data is retained?

Personalia Photographs
Presentations
Videos Access
Statistics

The content and infrastructure for these community service pages are provided by Roger Clarke through his consultancy company, Xamax.

From the site's beginnings in August 1994 until February 2009, the infrastructure was provided by the Australian National University. During that time, the site accumulated close to 30 million hits. It passed 75 million in late 2024.

Sponsored by the Gallery, Bunhybee Grasslands, the extended Clarke Family, Knights of the Spatchcock and their drummer

Xamax Consultancy Pty Ltd
ACN: 002 360 456
78 Sidaway St, Chapman ACT 2611 AUSTRALIA
Tel: +61 2 6288 6916

Created: 16 April 1998 - Last Amended: 29 October 1999; addition of FfE licence 5 March 2004 by Roger Clarke - Site Last Verified: 15 February 2009
This document is at www.rogerclarke.com/DV/P3POview.html
Mail to Webmaster - © Xamax Consultancy Pty Ltd, 1995-2024 - Privacy Policy

Roger Clarke's Web-Site

© Xamax Consultancy Pty Ltd, 1995-2024

Introduction

Background

Context

Purpose

The P3P Architecture and Process

Technical Mechanisms

Further Reading

Appendix 1 General Form and Pseudocode Form of the P3P Grammatical Model

Appendix 2 P3P Data Categories

Appendix 3 P3P Purposes

Appendix 4 P3P Purpose Qualifiers

Appendix 5 General Disclosures

Appendix 1
General Form and Pseudocode Form of the P3P Grammatical Model

Appendix 2
P3P Data Categories

Appendix 3
P3P Purposes

Appendix 4
P3P Purpose Qualifiers

Appendix 5
General Disclosures