P3P specification shows slow take-up

Take-up for the Platform for Privacy Preferences (P3P) specification released in April has slowed dramatically. Nearly 20% of the...

Take-up for the Platform for Privacy Preferences (P3P) specification released in April has slowed dramatically. Nearly 20% of the top 500 Web sites are using the specification but the rate of new adoptions has fallen to about 1% per month.

Moreover, the financial services industry, which handles sensitive personal data about customers, has a P3P adoption rate that is much lower than average, according to Ernst & Young.

Individuals and companies backing the online privacy standard developed by the World Wide Web Consortium (W3C) met last week to discuss whether a second version was needed. They instead chose to explore some of the issues that are keeping companies from adopting P3P.

"I think people want to focus on the things that have been raised as obstacles to implementation, rather than on new features," said Lorrie Cranor, a principal technician at AT&T Labs and chairman of the P3P specification working group.

A major concern is that the specification's "vocabulary" is not rich enough to allow exact translations of written data privacy policies into an XML-based format that can be read by Web browsers and compared against the preferences set by individual users.

As a result, the Financial Services Roundtable's technology group, the Banking Industry Technology Secretariat (BITS), said that it wanted the W3C "to state explicitly" that machine-readable P3P statements were not legally binding documents.

The legal uncertainty of P3P is a problem, Cranor said, but the W3C "can't give a definitive answer because we don't write the laws."

Only 11% of the top finance and investing Web sites have implemented P3P, said Ernst & Young, which began reporting on P3P adoption rates in August. In comparison, 18% of the 500 Web sites with the highest traffic among US Internet users are using P3P. At the current pace, it would take about eight years for all the top sites to adopt P3P, said Brian Tretick, a principal at Ernst & Young.

One reason for the sluggish rate of adoption is the economy. Another is uncertainty about how the legal system will enforce P3P-based privacy policies.

Over time, the P3P working group may look at the idea of adding "negotiation abilities" into P3P, Cranor said.

P3P-capable Web browsers react to policies on Web sites in a yes/no manner according to user preferences. A negotiation feature would let companies interact with users and, for instance, offer coupons in exchange for personal information. However, that would also require flexible privacy policies to handle any negotiation results.

Read more on IT risk management