Re: simple, standardized privacy policy discovery

For Link relations, we just need an RFC # really... it doesn't matter
if it's Informational or Standards track. The effect is the same.

On Mon, Aug 19, 2013 at 7:08 PM, Nicholas Doty <npdoty@w3.org> wrote:
> The difficulties in finding privacy policies for Web sites are occasionally mentioned. I've heard this raised as an issue for:
> * end users, who may not want to dig around for a privacy policy link on a Web page
> * end users on mobile devices, for whom finding and following links can be particularly difficult
> * researchers, who might be crawling or analyzing privacy policies to study en masse
> * civil society, who may want to provide automated comparison, versioning or analysis of privacy policies
>
> While discovery of a human-readable privacy policy is a very limited part of the general problems our industry has encountered with long-form privacy policies on the Web, standardized discovery protocols would contribute to a variety of use cases and could facilitate some larger scale solutions (short notices, privacy icons, registries, etc.).
>
> I don't claim to know every proposal in this area, but here are a few that address the very specific question of discovery of human-readable privacy policies that apply to a particular Web page. (Apologies if I'm repeating an incomplete collection that has already been gathered somewhere else.)
>
> 1. P3P discuri attribute
>   http://www.w3.org/TR/P3P/#POLICY
> A mandatory discuri on every <policy> element in an XML P3P policy gave a full URI for a human-readable version of the privacy policy. This is implemented now, for example, by Yahoo! and Microsoft. P3P policies are discoverable in a defined way (well-known URI, Link header, link tag) and then the <policy> element can be parsed to find the human-readable version.
>
> 2. DNT Tracking Status Resource
>   http://www.w3.org/2011/tracking-protection/drafts/tracking-dnt.html#status-resource
> An optional element of a site-wide tracking status resource (itself discovered through a well-known URI or response header) is a JSON policy field which points to a human-readable policy, though this is suggested to be specific to the kind of tracking relevant to a DNT preference. That document is currently a draft and I don't know offhand of any in-the-wild implementations of this section.
>
> 3. A "privacy-policy" or "terms-of-service" Link relation
>   http://tools.ietf.org/html/rfc6903
> RFC 6903 defines privacy-policy and terms-of-service as relations of links, to be used either inline in HTML or as a Link HTTP header. The RFC was published (Informational) just this March. (I also see some earlier suggestions, not widely pursued, for rel="privacy", but I don't see any problem with the longer form.)
>
> 4. policies.txt
>   https://www.sixlines.org/2013/08/19/policiestxt.html
> Most recently, I saw this brought up by Aaron Massey, who suggests a policies.txt file in a well-known location, similar to the widely used robots.txt protocol and the informal humans.txt analog.
>
> Personally, I think the Link relation (#3) is both flexible and very easy to implement. IETF published the documentation as an informational draft, and I'm not sure the history there or why it wasn't pursued on the standards track. Sites that have different privacy policies for different URLs can implement it through different link tags in the heads of documents. Very small sites can just add rel="privacy-policy" to a plain old anchor tag. And hey, it works for terms-of-service too.
>
> Questions for you all:
> * Would you find standardization/use of this valuable?
> * Is there any standardization necessary beyond the informational Link relation definition? If so, what features would you want to see?
> * Would you be willing to implement it, or what would be needed to encourage implementation?
>
> Thanks,
> Nick
>
> CC Aaron Massey, who brought this up on Twitter/his blog, Jason Snell who authored the Link relation proposal. I'm also sharing this with the Open Notice group who have been talking about related standardization efforts.

Received on Tuesday, 20 August 2013 15:52:47 UTC