Internet Explorer 6 beta clamps down on privacy

Internet ad companies are racing to conform with Microsoft's new P3P privacy standard that lets users know who's grabbing their information and also allows an opt-out option.

As Microsoft puts the finishing touches on an upgrade to its popular browser, Internet advertising companies are racing to ensure that their ads and cookies are compatible with it.

Internet Explorer 6, scheduled to be released in August, will be the first browser to support a new privacy standard called Platform Privacy Preferences, or P3P.

With P3P, Web surfers can configure their browsers to automatically determine whether a Web site collects personally identifiable information, uses that information to create user profiles, or allows visitors to opt out of the data collection.

Ad networks also must post privacy policies that can be read by the browser. Sites and ads that are not compliant with the standards being included in IE 6 may not be able to place cookies on PC users' hard drives.

"In order for ad networks to continue to set cookies on people's computers, they'll have to create a P3P privacy policy--many haven't done that yet," said Richard Smith, chief technology officer at the Privacy Foundation, a Denver-based watchdog group and research foundation. Smith said that by his count, about 50 to 100 marketers and ad networks set third-party cookies, many of which could be blocked by users of IE 6.

"All those guys are going to have to hustle to get a P3P privacy policy in place or their cookies won't work," Smith said.

The issue recently came to light when some of the 500,000 beta testers of Windows XP noticed that some ads were not being displayed while surfing the Web. Windows XP, an upgrade to the Windows operating system that will be released in October, includes IE 6.

Because cookies are an important component of online advertising, leading ad networks such as DoubleClick and Engage are working to ensure compatibility with IE 6.

DoubleClick, for example, uses cookies to create anonymous profiles on consumers who visit specific sites or content areas, such as sports pages or financial sites. With this information, the company might target a Nike ad to a consumer surfing a retail site who regularly visits sports Web sites.

Engage, which serves ads for about 3,400 Web sites, is installing headers so that the browser will be able to read Engage cookies. Complying with P3P is a "fairly significant expenditure of a couple of people's time but it's not overly burdensome", said Engage spokesman Mark Horan.

"Our site will be P3P-compliant within the next three weeks," he added. "Much more important, our cookies will be P3P-compliant before IE 6 launches this fall."

Jules Polonetsky, DoubleClick's privacy chief, said his company also will have its privacy policy and cookie headers ready before the launch of IE 6.

Meanwhile, the default privacy controls for IE 6 could spell trouble for some companies that are late in meeting P3P compliance.

The default setting in IE 6 allows a "first-party" cookie to be set, meaning that if a person visits Yahoo the browser will accept a cookie from Yahoo.

However, "third-party" cookies--most often set by marketers or ad networks to track consumer response to promotions--will be allowed through IE 6 default settings only if the third party allows consumers to opt out of data-collection practices. If the company doesn't give consumers an option, the cookie will be blocked.

DoubleClick's Polonetsky noted the company does not collect personally identifiable information with its cookies and does offer consumers an opt out, so its cookies will be accepted under IE 6 default settings.

"This is a great step for protecting consumers' privacy on the Web," said Rick Miller, a Microsoft spokesman. "Consumers will be able to control what personal information they give out to marketers."

DoubleClick's Polonetsky, who helped to develop the P3P standard, said that although his company will be prepared for the new settings, many online companies may run into trouble come August.

"Here's the surprise: Many Web sites, especially complicated ones with third-party content provided by their affiliates, may discover that they are third parties on their own sites," Polonetsky said. This would create a situation where their cookies would not be accepted on their own properties.

However, Smith said that this will not likely be a problem for many sites because they work fine without cookies, which makes targeting ads more difficult but not impossible.

Lisa M. Bowman contributed to this report.