P3P privacy technology slammed

Privacy advocates Wednesday said an emerging technology aimed at enhancing privacy on the Internet does just the opposite.

Known as the Platform for Privacy Preferences Project, or more commonly as P3P, the technology has been in development by the World Wide Web Consortium for more than three years and promises to allow consumers to choose what level of privacy they want when visiting a Web site that supports the standard.

The reality is very different, according to a report released by the Electronic Privacy Information Centre and pro-privacy software maker Junkbusters on Wednesday.

"The incredible complexity of P3P, combined with the way that popular browsers are likely to implement the protocol would seem to preclude it as a privacy-protective technology," the report states. "Rather, P3P may actually strengthen the monopoly position over personal information that US data marketers now enjoy."

The same day, W3C members demonstrated the technology at the World Wide Web Consortium's P3P Interoperability Session in New York. Among the members, Microsoft pledged to include the protocol in its next version of Internet Explorer and Windows.

The Web organization has pushed P3P as a solution for consumers worried about losing their privacy on the Internet.

The lure: companies can essentially code -- using extensible markup language, or XML -- their privacy policies into their Web sites, providing consumers a choice on how much private information to release.

Web surfers can set their own privacy comfort level and be alerted via a 'user's agent' when a site's privacy policy exceeds a certain level.

Ten other companies at the interoperability meeting in New York showed off their implementation of the policy generator and the user agents as well.

"Now you have some legitimate basis to decide whether you want to surf on that Web site rather than parsing through the entire privacy policy," said Greg Hampson, product manager for P3P with Microsoft's corporate privacy group, who showed off Microsoft's version at the New York meeting on Wednesday.

"While it's not a complete answer it is a step in the right direction. Frankly, I'm confused why privacy groups are so against this."

But critics said the P3P standard has a fatal flaw: it assumes the user will give up at least some privacy.

"Many in the industry believe that the P3P standard will help solve the privacy problem because it will facilitate choice about privacy practices," the report by the privacy group stated. "But the real choice offered is not how to protect privacy, but how much privacy to give up."

Karen Coyle, a spokeswoman for Computer Professionals for Social Responsibility and a librarian by trade, agreed in a Wednesday conference call. "There are some assumptions built-in that are not well-founded," she said.

"One of them is that consumers will have a choice. Consumer data is the coin of the realm, and that means there won't be a lot of sites that offer great privacy."

Jason Catlett, president of Junkbusters and one of the authors of the report, said that the ultimate choice consumers may face is between receiving a service or giving up their information -- the same choice they have today.

"If an alert comes up when you are trying to get your online email, what are you going to do? Will consumers say forget Hotmail because it's a privacy-free zone?" he said.

"We want real privacy-enhancing technology that removes identifying information, provides people access to their own data and truly enhances privacy."

The White House lauded the private sector's initiative in the P3P plan, saying it hopes this will make legislation in this area unnecessary.

"Today, the White House is pleased to advance these goals by supporting an initiative that harnesses technology to protect privacy on the Internet," President Clinton's spokesman, Joe Lockhart, said in a statement.

The home page of the White House Web site will be among the first locations demonstrating the new P3P standard, along with that of the Department of Commerce and 35 or so other sites.

Reuters contributed to this report

What do you think? Tell the Mailroom. And read what others have said.