Minutes of the P3P Specification Working Group Face to Face Meeting 6-7 March 2003 Cambridge, MA

(thanks to Rigo Wenning and Ari Schwartz for contributing their notes)


  1. Lorrie Cranor, AT&T Labs-Research
  2. Jack Humphrey, Coremetrics
  3. Brooks Dobbs, Doubleclick
  4. Ari Schwartz, CDT
  5. Jeremy Epling, Microsoft
  6. Mathias Schunter, IBM
  7. Brian Zwit, Integrity Insurance, AOL
  8. Danny Weitzner, T-and-S Domain Leader, W3C
  9. Rigo Wenning, Privacy Activity Lead, W3C
  10. Helena Lindskog, Ericsson

March 6


All present introduced themselves. As part of his introduction, Mathias Schunter made the following announcement: We are pleased to announce the first public version of the IBM Enterprise Privacy Authorization Language (EPAL). You can find the language specification and XML schema at http://www.zurich.ibm.com/security/enterprise-privacy/epal We are working on WS-Privacy together with Microsoft, want to keep P3P out the B2B area. Want to have some enterprise language that should be compatible to P3P.

Danny gave some history related to the Liberty Alliance in preparation for our discussion with them later.


The P3P 1.1 charter is being voted on by the membership. We hope to hear that it is approved in the next few weeks. We are currently operating under the assumption that it is likely to be approved with minor changes.

The deliverables in the charter are based on the discussion at the workshop last fall. They include items that reflect a strong consensus that these are things we should do as well as items with less support where someone just said he would do it.

We will have task-forces. Those TF will bring up the first draft and it will be discussed in the WG. Timeline in the deliverable session: Lorrie announced that she will enforce the timeline strictly. Everything that doesn't make it in the timeline will be considered for P3P 2.0 (pending charter of that working group).

The W3C's public Bugzilla will be the thing to be used for for tracking issues instead of our old issues list. Please register with Bugzilla at http://www.w3.org/Bugs/

Spec clarifications and items not covered by a specific taskforce will be covered by the working group as a whole. An individual should raise the issue and make a specific proposal.

Brian was interested in working on clarifying what a P3P policy means in the spec. He and Danny volunteered to draft a proposal.

ACTION: Brian & Danny: Create a proposal for clarification of what a P3P policy means

If we have a lot of clarifications and corrections before we are ready to put out the p3p 1.1 spec we may put out a corrected version of the p3p 1.0 spec. In the mean time we will update the errata page.

P3P Beyond HTTP taskforce:

ACTION: Danny to ask Joseph Reagle if he will chair this taskforce

ACTION: Matthias to draft proposed modification to P3P Beyond HTTP taskforce description in draft charter and submit it with IBM ballot

User Agent Behavior taskforce

ACTION: Jeremy and Brian: deliver wording for P3P vocab elements from IE and Netscape

Compact Policies taskforce

Article 10 taskforce

Agent and Domain Relationships taskforce

Consent Choices taskforce

XML Schema taskforce

Signed P3P Policies taksforce

ACTION: Danny and Rigo, modify charter for this taskforce to require that TF first provide explanation of why signed policies are needed and motivation for this work


APPEL is not mentioned in charter despite strong interest from some. There was no consensus on how to move forward for P3P1.1... We don't have a TF but we will accept proposals, otherwise can be considered in P3P2.0 timeframe.

Regularly scheduled teleconference will be 11 am on Wednesdays. We probably will use this time slot every other week, but people are encouraged to reserve this time in their schedules every week and use it for taskforce meetings, etc. Conference calls will start in two weeks.

There will public mailing-list and public group-page. Contact info etc will be on the member-only page.


What do we want to discuss with Web Services Architecture Group tomorrow?

Lorrie gave an overview and history of our attempts to get the WS folks to pay attention to P3P.

P3P on other things than Web Services..

Lorrie explained the issue identified with XForms that we have not sufficient granularity like xml:lang


Accuracy/Expressiveness problems

*** Agreement if compact policies were as expressive as full policies, it would still not be expressive as some may like, but this should be expressive enough for our needs (Brian reserved the right to question this again down the road)... assuming that we want to keep compact policies

Required attributes

ACTION: Lorrie: add issue to Bugzilla to consider modifications to -- could be changed "MAY" to "SHOULD" in order to cover importance of replay -- this should be brought up with the whole group. It is larger than just a compact policy question.

ACTION: lorrie: add issue to Bugzilla on clarifying what we mean by data linked to a cookie

User Agent

ACTION: Lorrie: add Bugzilla issue for UA TF on guidelines for verification that CP site has full policy, complete CP, etc.

Performance issues

Scope problems


ACTION: Lorrie: add Bugzilla issue to consider standardizing STATEMENT name attribute based on IBM extension

ACTION: Lorrie: Specify version #s in Bugzilla



We met with about a dozen representatives from the Liberty Alliance. They presented their LAP P3P Adaptation proposal V01.

Use case

Privacy policies based on P3P compact policies

Policies describe restrictions related to the use of attribute data

Five different policies that reflect different degrees of strictness

Five elements

WSC = web services consumer

WSP = web services provider - previously collected information and user consent and privacy rules

privacy context = policy for a particular piece of data and transaction for a user = user privacy preference

Liberty folks think 5 levels are needed for interoperability, compact dataflows, etc.?

Lorrie argued that 5 levels are not needed and that idententy service providers could come up with whatever levels they want to offer their users

Joseph Reagle suggested that 5 levels help sites coalese and find a common level facilitating policy making in the market

There may be a potential collision problem when w3c gets around to defining P3P/soap bindings... this should be anticipated and design should avoid problems ... joint note on transferring P3P references with SOAP?

discussion of location vocabulary and privacy policies - work being done at OMA, 3GPP

P3P group will continue to provide feedback to Liberty

March 7

The Article 10 issues and UA behavior issues were discussed on a phone conference. Dialing in were Giles Hogben, Marc Langheinrich, and Marty Abrams


Giles - plans to make detailed report with proposals before June Kiel meeting

ambiguity on cookie processing requirements - set or replay?

notification of user before data processing - to satisfy EU law human-readable portion of policy should be displayed to user before data is processed

ability to specify jurisdiction

preference language


Marty Abrams - layered notices

brooks concerned about scope -- P3P does nice job of binding policies... layered notices are cya

brian - lawyers would get more legalistic in full policy with layered notices

Lorrie - use P3P human-readable fields to provide layered notice

Brooks - not that much legal uncertainty -- regulators say that whatever the users see first you have to live up to so they all have to be consistent

Everyone would benefit from more specific testing of language that makes sense to users

highlights notice glossary - go box by box and come up with vetted phrases and words that define an item - that group will convene in May

Other areas for user agent guidelines

Microsoft beta 1 is planned for January... they would like guidelines ASAP so that it is possible for them to take them into account for that release... will be very difficult to incorporate changes from WG later


North American outreach: Ari

WS Policy

Microsoft/IBM/BEA effort (not affiliated with W3C) - still underspecified, but eventually should define bindings that may be helpful in our efforts to define P3P beyond HTTP... political problems due to this work taking place outside W3C

Jeremy had a long list of suggestions

Jeremy said it is likely that we will see preview of new IE P3P functionality in October when Microsoft shows preview at developer conference

ACTION: Lorrie, add Bugzilla issue to consider expanding definition of consequence field in spec and/or adding structure to consequence field

ACTION: Lorrie, add Bugzilla issue to consider adding a statement grouping mechanism, possible through statement grouping element or group name attribute

ACTION: Lorrie, add Bugzilla issue to consider adding human-readable explanation strings to all elements that don't currently have them, perhaps generalizing LONG-DESCRIPTION

ACTION: Lorrie, add Bugzilla issue to draft statement (perhaps Note) on identified/identifiable, linked, etc.

ACTION: Ari, write first draft of note on identified/identifiable/linked


Mike Champion, co-chair WSAG

Multiple places where P3P policy (reference) might live

working together going forward -- first step: collaboration on use cases

Author: Lorrie Cranor
Last update $Date: 2003/03/14 19:53:14 $ by $Author: rigo $