21 June 2000 Platform for Privacy Preferences (P3P) Project Interop Report

On June 21, 2000, about 100 people gathered at the AT&T building at 32 Avenue of the Americas in New York to witness the first public tests and demonstrations of the Platform for Privacy Preferences Project (P3P). W3C's public "interoperability session" gave companies the opportunity to unveil new prototypes, to test them with other P3P services, and to provide input into the P3P design process. The prototypes are early versions of P3P-compliant tools expected to be offered to end users in the coming year. [See Interop agenda, interop mailing list archive]

Presentations and Demos

Daniel Weitzner (W3C), Harriet Pearson (IBM), Deirdre Mulligan (CDT), and Lorrie Cranor (AT&T) gave opening remarks, including background and an overview of P3P [PowerPoint slides]. Implementers then demoed four P3P user agent implementations and two P3P policy generators. The demos were followed by a question and answer period. Attendees were then invited to try the presented demos as well as some additional demos that were setup on computers around the room.

User Agent Demos

Ron Perry from IDcide demoed a version of the IDcide Privacy Companion augmented with P3P. The Privacy Companion is a browser extension that allows users to find out whether a site is using cookies, including third party cookies, and also to block all cookies and/or third-party cookies. With P3P added, users can customize their settings to only block cookies from sites that do not match their privacy preferences. [screen shots of IDcide Privacy Companion]

Noboru Shimizu from the Electronic Network Consortium (ENC) demoed the Privacy Information Management System. The browser component uses a proxy server that fetches P3P policies and compares them with user preferences. The system also includes an authoring tool that can generate P3P policies and a site bureau where Web sites can register their privacy policies.

Chris McLaren and David Zimmerman from YOUpowered demoed a version of Orby Privacy Plus augmented with P3P. Orby allows users to accept or deny cookies while surfing, automatically fill out forms, and determine how well a site matches their privacy preferences. The Orby Trust Meter displays a trust rating determined by analyzing a site's P3P policy. Users can click to get more detailed information about the site's policy and the factors that went into determining the rating. YOUpowered has also developed a tool for authoring P3P policies. [screen shot of Orby toolbar]

Greg Hampson from Microsoft demoed prototype P3P user agent software developed jointly with AT&T. This user agent is implemented as a browser helper object for Internet Explorer. When users install this software, it adds a privacy button to the top of their browser window. Clicking on this button brings up a window where users can set their privacy preferences, check how well a site's P3P policy matches their preferences, or view a site's privacy policy in P3P or human-readable format. [screen shot of preference setting window]

Policy Generator Demos

John Newman from PrivacyBot.com demoed the PrivacyBot system for generating privacy policies in both human-readable and P3P format. The PrivacyBot system is accessed via a web browser and does not require users to download any additional software. Users fill out a series of online questionnaires in order to create their privacy policies. The software is already available to customers.

Martin Presler-Marshall from IBM demoed a P3P Policy Editor. This is a visual tool for creating P3P policies. Users can use a mouse to drag various policy elements into place and view the results in both XML and English. The tool includes extensive documentation. Beta software is available for download free of charge.

P3P Compliant Web Sites

Over a dozen Web sites were made P3P compliant in time for the event including:

Tatiana Gau from AOL, Barbara Lawler from Hewlett-Packard, and Mel Peterson from Procter & Gamble spoke briefly about the process of making their sites P3P compliant.

These web sites were tested with the W3C P3P Validator and the demoed user agents.

Feedback

The P3P Specification working group held an open meeting after lunch. The group discussed each of the demos and compiled a list of issues that need further discussion.

User Interface Ideas and Issues

Allow settings to be customized on a per-site basis
Keep a log of privacy policies and places users left data
It's important for the user to be able to find out why the "red light" is on
Need to find good way of representing to users that sites and embedded objects have a different policy
Need to be able to tell users what settings represent -- what is a "medium" setting?
UIs might be configured by asking users a small number of questions rather than setting sliders and buttons
An APPEL editor or at least an APPEL viewer would be useful
Usability studies are needed

Specification Working Group Issues

Does protocol, safezone, etc. work properly when cookies are set on redirect responses?
Companies need guidance on how to do P3P strategically -- not just how to write the policy, but also things like how to figure out if you need one or multiple policies -- HP and P&G volunteered to help based on their experiences
How can sites state that they don't log IP addresses and/or that they keep only some of the bits of the ip address? do we need an explicit IP address data element?
Make sure spec is clear that categories are not data elements (and must hang off dynamic.miscdata) -- also make sure validator will not approve policies that use categories incorrectly like this
Could we add a vocab tag to indicate whether or not a site is a childrens' site (as defined by US COPPA act)? Clearly this could be done with an extension, but does it make sense to make that part of the vocab itself?
Unique ID category remains problematic .... perhaps we should pull out Social Security Number or government ID as specific data elements? Perhaps also pairwise ID, identity hash, etc.?
It is difficult for sites to represent that they have optional purposes, that is purposes that you may opt-in or opt-out of. Should we add syntax to handle this or just document the sort of kludgy way it can be handled currently and recommend that implementers learn to recognize this?
Can we rename the p3p.xml file so that it is not in the root directory? Perhaps put it in a /metadata/ directory or a /metadata/w3c directory or something like that.
Can we modify the recipients field to allow web sites to optionally declare specific recipients by name?
if we drop immutability, should we recommend or require sites to keep history of changes to their privacy policy?

Next Steps

The P3P Specification Working Group will discuss the issues raised at the Interop as well as other issues that have been raised since the May 10 working draft was issued. The group will try to resolve these issues and release a new working draft in August. This draft is expected to have a two-week public review period before the group begins the process of advancing towards a W3C recommendation.

Attendees

Attendees included representatives from the following companies and organizations:

America Online, AT&T, Bank of America, CDT, Chase Manhattan, DMA, DoubleClick, ENC, Engage, FTC, GMD, Hewlett-Packard, IBM, IDcide, ID-Vault, Intel, ISTPA, JunkBusters, Microsoft, NCR, New Jersey State General Assembly, New York State Office of the Attorney General, Privacy Exchange, Privacybot.com, Privada, PrivaSeek, Proctor & Gamble, RealNames, Sony, TRUSTe, U.S. Department of Commerce, W3C, YOUPowered, ZDNet

Press Coverage

The event was covered widely by the press. The following are some of the stories filed so far:

Wire services - attending event

AP: Anick Jesdanun
(Beth Keiser, AP Photos)
Story: Web Privacy Tools Unveiled
21 June 2000 http://dailynews.yahoo.com/h/ap/20000621/tc/internet_privacy_8.html
has run in multiple publications

Reuters: Jim Wolf
Story: White House Backs Web Privacy Plan http://dailynews.yahoo.com/h/nm/20000621/pl/tech_privacy_dc_2.html
has run in multiple publications

Singular publications - attending event

Computerwire: Jo Maitland
Subscription piece, "W3C Privacy Spec Slammed by Lobby Groups"

Internet World: James Luh, Tom Perratta articles coming

National Journal Technology Daily: Drew Clark, Louis Peck preview articles available by subscription only

National Public Radio: Larry Abramson
Story: http://search.npr.org/cf/cmn/cmnps05fm.cfm?SegID=75730
Links to Real Audio file

Network World/NW Fusion: Carolyn Marsan
Companies to demo products based on emerging privacy standard
19 June 2000
http://www.nwfusion.com/news/2000/0619privacy.html
Privacy spec gains momentum, sparks criticism
21 June 2000
http://www.nwfusion.com/news/2000/0621p3pmarsan.html

New York Times: Jeri Clausing, Lisa Guernsey
Story: New Technology Is Aimed at Increasing Web Privacy
by Jeri Clausing
22 June 2000 http://www10.nytimes.com/library/tech/00/06/cyber/articles/22privacy.html

Newark Star Ledger, Kevin Coughlin
Story: Internet's privacy puzzle still unsolved
June 22, 2000 http://www.njo.com/business/ledger/index.ssf?/business/ledger/fe4c17.htm

Those not attending

Computerworld
Microsoft, others unveil tools to protect online privacy
by Linda Rosencrance
21 June 2000 http://www.computerworld.com/cwi/story/0,1199,NAV47_STO46118,00.html
* also ran as Internet privacy eyed - InfoWorld
http://www.infoworld.com/articles/hn/xml/00/06/21/000621hnp3p.xml

cnet
Microsoft embraces tool to boost Web privacy
by Mike Ricciuti
21 June 2000 http://news.cnet.com/news//0-1005-200-2120950.html?tag=st.cn.sr.ne.2

Dow Jones Newswires
White House Supports P3P Internet Privacy Standard
by Campion Walsh
(subscribers only)

InfoWorld
Vendors huddle over privacy
by Jennifer Jones
21 June 2000
http://www.nwfusion.com/news/2000/0621p3pmicrosoft.html
* also ran as Vendors Huddle over privacy - CNN Technology
http://www.cnn.com/2000/TECH/computing/06/22/vendors.privacy.idg/index.html

InfoWorld
Putting Privacy Protection to the Test
by Jennifer Jones
21 June 2000 http://www.pcworld.com/pcwtoday/article/0,1510,17327,00.html

USAToday
The news behind the Net- A new tool to 'decode' privacy policies
by Leslie Miller
21 June 2000
http://www.usatoday.com/life/cyber/tech/jk062100.htm

USAToday
The news behind the Net - White House backs Web privacy initiative
by Leslie Miller
22 June 2000
http://www.usatoday.com/life/cyber/tech/ebrief.htm

Wall Street Journal
(subscription only)
Clinton Supports Move to Protect Consumer Privacy on the Internet
by Glenn Simpson
22 June 2000

Wired
Privacy Protocol Lauded, Sort Of
by Chris Oakes
22 June 2000
http://www.wired.com/news/politics/0,1283,37145,00.html

ZDNet News
MS adds privacy standard to Windows, IE
by Margaret Kane
21 June 2000
http://www.zdnet.com/zdnn/stories/news/0,4586,2591604,00.html

Copyright© 1997-2000 W3C (MIT, INRIA, Keio ), All Rights Reserved. W3C liability,trademark, document use and software licensing rules apply. Your interactions with this site are in accordance with our public and Member privacy statements.

last revised $Date: 2000/07/19 17:05:14 $ by $Author: djweitzner $