P3P Future Work: Items 2, 5, and 6

P3P Future Work Item 2: Indication of Agent Status, Multiple Domains Owned by 
One Company, etc.

Purpose: 
Many companies have sites on multiple domains and, with the current 
implementations of P3P, have had a very difficult time implementing P3P and 
compact policies on all its sites. When content is shared between domains, 
significant difficulties have been encountered with both P3P and compact 
policies from different sites being inconsistent with the practices of the 
site using the content or cookies from the second domain being blocked even 
when the same company owns both sites. In addition, some companies are acting 
as agents for another company and are simply following the contracting 
company's privacy policy. 

There is no mechanism in the specification to allow a site to handle content 
sharing between domains or indicate that one site is acting as the agent for 
another. (HINT is sometimes incapable of fully expressing the relationship 
between sites.) To encourage adoption of P3P, a mechanism or mechanisms are 
required to permit a site to easily share content without an unduly 
complicated P3P policy or compact policies and to indicate that one site is 
the agent for another site.

Scope: 
Work on the issues discussed above could, without excluding other ideas, 
center on the following:

    1.  Along with the work being done to review other aspects of compact 
policies, review the efficiencies, if any, associated with compact policies 
and even the need for compact policies given the experience of implementing 
P3P so far; and

    2.  Creating a mechanism to allow a site to declare other sites as 
first-party sites, i.e., that they are all owned by the same company and have 
the same or similar privacy practices or are acting for another site as an 
agent and are bound by the other sites privacy policies, in both P3P and 
compact policies; and

Resources:
There is no known work already on this topic. However, extensive experience 
exists in the private sector with implementing P3P on sites that share 
significant amounts of content. These experiences could be leveraged to 
identify problems and potential solutions.

Time Frame:
The issues here should be relatively easy to resolve. It should be possible 
to reach consensus on a mechanism to accomplish the last objective above 
within the timeframe for version 1.1 of the specification. Review of compact 
policies might take longer to complete. (See P3P Future Work Item 4.)


-------------------------------------------------------------------------------

-

P3P Future Work Item 5: User Agent Behavior

Purpose: 
Developers have begun to implement P3P in new versions of their products, 
mostly web browsers. As with the first version of most products, these 
efforts have received mixed reviews from users and site operators.

The current implementations have interfered with the functionality of some 
sites, confused users, and implement different standards. These 
implementations of P3P have required the developer to make certain decisions 
regarding what privacy practices to review and what to do if that particular 
privacy practice is enabled at a site, e.g., does the browser look for 
cookies that store personally identifiable information on the user's computer 
and then block them or just downgrade them.

Sites have been enabling P3P, particularly compact policies, and have had 
difficulties implementing P3P and maintaining functionality in the new user 
agents. Now functionality is not only limited by the rendering engine of a 
browser, for example, but also whether the browser will block cookies based 
on some particular privacy practice.

More consistency between user agents in how P3P is implemented would be 
helpful to users as their experience on one user agent would be transferable 
to another and to sites so that they could build the site and develop one 
consistent privacy policy.

Scope: 
Work on the issues discussed above could, without excluding other ideas, 
center on the following:

    1.  Determining whether some basic recommendations are needed for 
implementing P3P in user agents; (NOTE: The word "recommendation" is used 
here only to describe the scope of this effort. The form, e.g., whether 
recommendations, suggestions, guidelines, a separate specification, or even 
just a white paper, is an unresolved question.)

    2.  Reviewing the experiences of users and site operators with the 
currently available user agents to determine what areas should be addressed 
in this conversation; and

    3.  Prepare recommendations for developers of user agents to follow when 
appropriate in implementing P3P.

Resources:
There has been significant work already done on this topic. Resources are 
available from developers as wells as governmental regulators and NGOs. In 
addition, there are probably significant resources available in academia to 
assist in this effort. Despite the significant resources available, it is 
expected that reaching consensus on any recommendations would take a 
substantial amount of work and time. However, no formal recommendations may 
be required, the discussion itself may be useful to developers of users 
agents as well as site operators.

Time Frame:
The issues here will probably be relatively hard to resolve and the timeframe 
for any formal recommendations would be significant. However, given previous 
discussions, it is doubtful that any recommendations coming from this effort 
would be included in the P3P specification. It would likely be in a separate 
document instead and allow this work and other work on the specification 
itself to proceed on different schedules.


-------------------------------------------------------------------------------

-

P3P Future Work Item 6: Description of the Contours of P3P

Purpose: 
While many sites have adopted P3P, adoption has been slower than hoped for 
because companies are unsure of their liabilities for statements made in P3P 
and compact policies given the limitations of the technology at this time. No 
one is suggesting that sites are not liable or should be given immunity for 
mistakes or misrepresentations in their P3P statements. However, everyone 
recognizes that P3P does not allow a site to describe every nuance of its 
privacy practices and that the specification is a work in progress. The 
purpose of this item is to clarify the current state of the specification as 
to what privacy practices can and cannot be expressed in the lexicon of P3P.

Scope: 
The work is limited to descriptive text only. The text would more 
explicatedly describe what privacy practices can and cannot be described in a 
P3P or compact policy and other limitations of the technology. For instance, 
P3P with its limited vocabulary cannot be expected to represent every nuance 
of a site's privacy policy. The additional text may also recognize, without 
rendering P3P irrelevant, that the human readable privacy policy is the 
authoritative statement of a site's privacy policies.

Resources:
Minimal resources required to complete this item. A draft of proposed 
language could be drafted by a small group of P3P Specification Working Group 
members and circulated broadly for comment by the remaining members.

Time Frame:
Based on the discussion at the P3P Workshop, there appeared to be some common 
ground on this issue and it should be relatively easy to resolve. It should 
be possible to reach consensus on language within the timeframe for version 
1.1 of the specification.

Brian (<A HREF="aol://9293:bzwit/">AOL IM</A> | <A HREF="mailto: bzwit/a">AOL Mail</A>)

-----------------------------------------------------------------
Brian J. Zwit, Director, Integrity Assurance
America Online, Inc.
( (703) 265-6232 l AIM: bzwit l Internet * <A HREF="mailto: bzwit@aol.com">bzwit@aol.com</A>
----- AOL Confidential Information -----