The Platform for Privacy Preferences, or P3P, is being developed under the auspices of the World Wide Web Consortium, whose members include AT&T Corp., Microsoft Corp. (MSFT) , IBM Corp., America Online Inc. (AOL) and DoubleClick Inc. (DCLK) . The consortium says P3P would allow Web surfers to configure their browsers according to individual privacy preferences. Under the protocol, privacy policies at P3P-enabled Web sites could be automatically checked against the user's preferences, warning the user if the policy doesn't meet the user's privacy expectations. The new technology is being developed amid the debate over online privacy standards and the proper role of government in riding herd on the Web.
Dozens of companies and government agencies met in Manhattan on Wednesday for an interoperability test of the new system. Microsoft announced that it would build P3P into future versions of its Internet Explorer Web browser. The White House hailed the protocol as "another example of the president's and vice president's support for private-sector leadership in electronic commerce," and said P3P would be built into the White House and Commerce Department Web sites, among others. A Microsoft spokeswoman said online privacy is "a critical component for the vision of how Microsoft moves to the Web."
"We commend the W3C, AT&T and the other participating organizations," says Microsoft spokesman Richard Purcell. "The P3P effort is a great example of how the industry can work toward developing technology-based solutions [to online privacy]." The consortium will hold other tests later this year before finalizing the standard.
But some privacy advocates criticize P3P as a poor substitute for mandated online protections. The Electronic Privacy Information Center and Junkbusters released a joint report calling P3P "a complex and confusing protocol that will make it more difficult for Internet users to protect their privacy."
The W3C, which includes advocacy groups such as the Center for Democracy and Technology and the Electronic Frontier Foundation, said P3P would give users greater control over how their personal information is obtained and used. The W3C concedes that P3P has no enforcement mechanism to make sure that Web sites actually live up to their privacy policies. The protocol also isn't designed to monitor third-party collection of data on Web sites. A Federal Trade Commission report issued last month said 59 percent of Web sites that collect personally identifying information don't offer users notice or choice about how their data is used.
EPIC and Junkbusters are worried that P3P could be improperly touted as a panacea that would prevent the need for new laws and better online privacy practices. P3P's supporters, including the Center for Democracy and Technology, argue that the perfect shouldn't be the enemy of the good. As CDT puts it, P3P should be seen as "just one stone in the foundation" including legislation and other privacy tools.
Last month, the FTC recommended that Congress pass baseline legislation guaranteeing minimum standards of notice, choice, access and security for online data practices. Sentiment for new legislation is growing on Capitol Hill, as lawmakers increasingly question the industry's dedication to policing itself.
A bipartisan group of U.S. senators sent a letter to FTC Chairman Robert Pitofsky on Wednesday asking for clarification of the FTC's position. The senators also urged Pitofsky to include consumer groups in ongoing talks between the FTC and Internet advertising companies regarding a new set of online advertising privacy rules. At the same time, the senators said that new industry self-regulation "is at best an interim measure to improve privacy protection in the absence of legislation."