P3P Supporters Struggle to Increase Adoption of Data Privacy Standard

Computerworld - The Platform for Privacy Preferences (P3P) specification was released in April, and so far nearly 20% of the top 500 Web sites are making use of it. But the rate of new adoptions is now moving glacially—about 1% per month among leading sites.

In addition, the financial services industry, which handles sensitive personal data about customers, has a P3P adoption rate that's much lower than average, according to Ernst & Young LLP.

Individuals and companies backing the online privacy standard developed by the World Wide Web Consortium (W3C) met last week at America Online Inc.'s offices in Dulles, Va., to talk about whether a second version is needed. But they decided instead to further explore some of the issues that are keeping companies from adopting P3P.

"I think people want to focus on the things that have been raised as obstacles to implementation, rather than on new features," said Lorrie Cranor, a principal technical staff member at AT&T Labs in Florham Park, N.J., and chairman of the W3C's P3P specification working group.

One concern is that the specification's "vocabulary" isn't rich enough to allow exact translations of written data privacy policies into an XML-based format that can be read by Web browsers and compared against the preferences set by individual users.

Because of that problem, the Financial Services Roundtable's technology group, the Banking Industry Technology Secretariat (BITS), said in a position paper that it wants the W3C "to state explicitly" that machine-readable P3P statements aren't meant to be legally binding documents. BITS is a Washington-based organization that represents large financial services firms on e-commerce matters.

The legal uncertainty of P3P is a problem, Cranor said, but the W3C "can't give a definitive answer because we don't write the laws."

Only 11% of the top finance and investing Web sites have implemented P3P, said New York-based Ernst & Young, which began reporting on P3P adoption rates in August. In comparison, the consulting firm said, 18% of the 500 Web sites with the highest traffic among U.S. Internet users are using P3P. At the current pace, it would take about eight years for all the top sites to adopt P3P, said Brian Tretick, a principal at Ernst & Young.

One reason for the sluggish rate of adoption is the economy, Tretick said. Another is uncertainty about how the legal system will enforce P3P-based privacy policies, he said.

Over time, the P3P working group may look at the idea of adding "negotiation abilities" into P3P, Cranor said. Currently, P3P-capable Web browsers react to policies on Web sites in a yes/no manner according to user preferences. A negotiation feature would let companies interact with users and, for instance, offer coupons in exchange for personal information. But that would also require flexible privacy policies to handle any negotiation results, Cranor said.